Skip to main content
Companies that already pay for a tool like yours are the shortest path to a sale. This guide finds them from a single domain. 2:14 video, recorded August 2026. The app moves fast, and the steps below stay current.

​
What you’ll learn

  • Subdomain search: read a competitor’s public certificate record to see who they host.
  • Reading the result: tell a customer tenant apart from the vendor’s own infrastructure.
  • Turning it into outreach: make the list a table and enrich it into contacts.

​
Before you start

You need one domain belonging to a tool whose customers you want. This works when a vendor gives each customer its own address, so it finds nothing for a vendor that does not.

​
Find the tenants

1

Open the search

Click Find subdomains in the sidebar.
2

Enter the domain

Type the vendor’s bare domain into Company domain and run the search.
3

Read the result

The count above the list tells you how many addresses were found. The Web address column holds each one.
4

Make it a table

Click Create table with N rows to bring the whole list in.

​
Turn addresses into people

1

Work out the company

A tenant address usually carries the customer’s name. Add a function column to pull that name out of the address.
2

Enrich the company

Add an enrichment column from the Company shelf to fill in the real company behind the name.
3

Find the people

Use the company list as the starting point for a people search, then enrich for contact details.

​
Good to know

Some vendors put every customer behind one shared address, which leaves no per-customer record to read. The search can only see what is published.
No. The list mixes customer tenants with the vendor’s own staging and internal addresses. Scan it before you enrich it.
Yes. It comes from the public log of certificates issued for a domain, which anyone can read.
It reflects certificates that have been issued and not yet expired, so a long-gone customer can still appear.

​
Next steps

Find subdomains

The full reference for the search and its limits.

Find people and companies

Turn the company list into named contacts.

Function columns

Pull a company name out of a web address for free.

What you can enrich

The shelves in the catalog and what each one returns.