> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getoneprofile.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Find companies that use a tool

> Turn one competitor's domain into a list of the companies running on it, then enrich the list and reach out.

Companies that already pay for a tool like yours are the shortest path to a sale. This guide finds them from a single domain.

<video alt="A screen recording of Find subdomains: a competitor domain is entered, the published web addresses come back with a count, the list is read for customer names, and the rows become a new table." controls className="w-full aspect-video rounded-xl" poster="https://static.getoneprofile.ai/docs/videos/find-companies-that-use-a-tool/poster-32c06805.jpg" crossOrigin="anonymous">
  <source src="https://static.getoneprofile.ai/docs/videos/find-companies-that-use-a-tool/find-companies-that-use-a-tool-79260ecc.mp4" type="video/mp4" />

  <track kind="captions" src="https://static.getoneprofile.ai/docs/videos/find-companies-that-use-a-tool/find-companies-that-use-a-tool-1e202289.vtt" srcLang="en" label="English" default />
</video>

*2:14 video, recorded August 2026. The app moves fast, and the steps below stay current.*

## What you'll learn

* **Subdomain search**: read a competitor's public certificate record to see who they host.
* **Reading the result**: tell a customer tenant apart from the vendor's own infrastructure.
* **Turning it into outreach**: make the list a table and enrich it into contacts.

## Before you start

You need one domain belonging to a tool whose customers you want. This works when a vendor gives each customer its own address, so it finds nothing for a vendor that does not.

## Find the tenants

<Steps>
  <Step title="Open the search">
    Click **Find subdomains** in the sidebar.
  </Step>

  <Step title="Enter the domain">
    Type the vendor's bare domain into **Company domain** and run the search.
  </Step>

  <Step title="Read the result">
    The count above the list tells you how many addresses were found. The **Web address** column holds each one.
  </Step>

  <Step title="Make it a table">
    Click **Create table with N rows** to bring the whole list in.
  </Step>
</Steps>

## Turn addresses into people

<Steps>
  <Step title="Work out the company">
    A tenant address usually carries the customer's name. Add a function column to pull that name out of the address.
  </Step>

  <Step title="Enrich the company">
    Add an enrichment column from the **Company** shelf to fill in the real company behind the name.
  </Step>

  <Step title="Find the people">
    Use the company list as the starting point for a people search, then enrich for contact details.
  </Step>
</Steps>

## Good to know

<AccordionGroup>
  <Accordion title="Why did a well-known vendor return nothing?">
    Some vendors put every customer behind one shared address, which leaves no per-customer record to read. The search can only see what is published.
  </Accordion>

  <Accordion title="Are all of these customers?">
    No. The list mixes customer tenants with the vendor's own staging and internal addresses. Scan it before you enrich it.
  </Accordion>

  <Accordion title="Is this public information?">
    Yes. It comes from the public log of certificates issued for a domain, which anyone can read.
  </Accordion>

  <Accordion title="How current is the list?">
    It reflects certificates that have been issued and not yet expired, so a long-gone customer can still appear.
  </Accordion>
</AccordionGroup>

## Next steps

<CardGroup cols={2}>
  <Card title="Find subdomains" icon="globe" href="/find-leads/find-subdomains">
    The full reference for the search and its limits.
  </Card>

  <Card title="Find people and companies" icon="user-search" href="/find-leads/find-people-and-companies">
    Turn the company list into named contacts.
  </Card>

  <Card title="Function columns" icon="sigma" href="/tables/columns/function-columns">
    Pull a company name out of a web address for free.
  </Card>

  <Card title="What you can enrich" icon="list-checks" href="/enrich/what-you-can-enrich">
    The shelves in the catalog and what each one returns.
  </Card>
</CardGroup>