How to build a warm buyer list out of data companies publish themselves — no scraping services, no paid databases. The whole thing in one line: every company that turns on HTTPS writes itself into a public log. Read the log, confirm the tool is live, sort by who hasn't upgraded — and you've got the warmest list in your market. WHY THIS LIST BEATS ANYTHING YOU CAN BUY
A bought list knows who they are. This one knows what they're already paying for. Apollo sells you "SaaS founders, 10–50 employees" — a demographic. This gives you "companies on your competitor's base plan who haven't upgraded" — an intent signal. That's the difference between a 1% reply rate and a 20% one. They already bought the category. No education needed — they're sold on the problem, you're just a better answer. You know their exact setup. Your first line can name it. That alone doubles replies.
The three public sources source 1
Certificate Transparency
The page itself
Every HTTPS certificate ever issued is written to a public, append-only log. Browsers require it. It's searchable at crt.sh.
Whatever a site ships to your browser — scripts, widget config, meta tags — is public by definition. View source is not hacking.
The tell
Their own contact pages
DNS & CNAMEs
About, footer, /contact, /privacy. GDPR actually forces most companies to publish a contact address.
A CNAME pointing at a vendor is a signed confession that they're a customer. Free to query, instant.
Steps 1–3 · build the raw list
1 Pull the cert trail
Recon
When a SaaS onboards a customer onto a custom domain — chat.acme.com, acme.vendor.io — somebody has to issue a certificate. That certificate is logged publicly, forever, with the hostname in it. # every cert ever issued under a vendor's domain curl -s 'https://crt.sh/?q=%25.vendor.com&output=json' \ | jq -r '.[].name_value' | tr ',' '\n' | sort -u # and the reverse: certs the vendor issued FOR customer domains # (search the vendor's cert issuer or their onboarding subdomain pattern)
crt.sh is free and needs no account. Censys and Subfinder do the same with nicer filters. Sort by issue date. Newest certs = just onboarded = still in the honeymoon, still comparing.
2 Confirm it's live, not a ghost
Verify
A cert proves a hostname existed once — not that anyone still uses it. Skip this and half your list churned two years ago, which is the fastest way to look stupid in a cold email. Request the homepage. Dead domain, parked page, or 404 → drop it. Check the vendor's script actually loads in the HTML. No script tag, no customer. Resolve the CNAME. If it still points at the vendor, they're live today.
3 Read the plan off what the page already gives you
Segment
This is the part everyone misses. A widget has to tell your browser how to render itself — so it ships its own config to every visitor. Which means the plan tier is usually sitting right there in plain sight. The branding tell. "Powered by [vendor]" visible = free or base plan. Removed = they paid to remove it. That single bit is your entire segmentation. The feature tell. Widget config often lists which modules are enabled. Base plan and premium plan render differently. The plan tell. Some vendors put the tier straight in a data attribute or the config object. Free money. Stay on the visitor side of the line. Everything above is what any browser gets by loading the page. That's public. Do not log in, guess IDs, or poke endpoints a visitor wouldn't hit. The moment you're enumerating something that isn't served to the public, you've left research and entered a computer-misuse statute. One request per site, slowly. You're sampling a list, not load-testing it. Hammering is what turns "research" into "incident."
Steps 4–6 · turn it into revenue
4 Sort into the four buckets
Score
Every row now has a tier. Split it — these four groups need different emails, and blasting them all the same is why cold outreach dies. HOTTEST
Warm
Base plan, no upgrade
Cert issued < 60 days
They bought the category, hit the ceiling, didn't pay to break through. Your best offer lands here.
Mid-rollout. Not locked in, still comparing, nothing to rip out yet.
Slow burn
Skip
Full premium
Dead or ghost
They pay for this category — which proves budget exists. Long game, not a first email.
Script gone, domain parked. Delete them. A tiny clean list beats a big dirty one.
5 Get the email from their own front door
Contact
No data vendor needed. Companies publish contact addresses on purpose — privacy law often requires it. /privacy and /terms — GDPR makes companies name a contact. Most people never look here. Footer, /about, /contact, /team — the obvious ones, still the highest hit rate. Only find hello@? Use it. A real message to a shared inbox beats a guessed address that bounces and wrecks your sender reputation.
6 Write the email that doesn't read as scraped
Convert
You did all this for one sentence: the line that proves you looked. Observation, one ask, get out. No deck, no "hope this finds you well." THE TEMPLATE
Hey [Name] — Noticed [company] is running [competitor] on [their domain], still on the base setup. We do the same job but [the thing they're missing] is included, not an upgrade. Worth 10 minutes? Or I can just send a 2-min video. — [You]
Before you run it
THE RULES OF THE ROAD Everything here reads data that was deliberately made public — that's why it's fine. Stay on this side of the line and you're doing what BuiltWith and Wappalyzer have sold commercially for a decade. Public means served to any visitor. CT logs, DNS, page source, published contact pages. That's the entire toolkit. No credentials, ever. Don't log in, don't reuse a session, don't try IDs that aren't yours. That's the bright line and it's criminal on the other side. Rate limit yourself. One polite request per domain. If you'd be embarrassed to describe your request volume out loud, lower it. Cold email has actual laws. CAN-SPAM, GDPR, India's DPDP. Real sender identity, real physical address, working unsubscribe, honour it same day. Don't publish the list. Aggregating public data into a customer roster and posting it is a different act from using it for your own outreach.
SHIP IT THIS WEEK I pulled their cert trail and stripped the staging/wildcard noise. I verified each domain is alive and the script still loads. I tagged every row with a plan tell (branding on/off). I split the list into the four buckets and deleted the dead ones. Every email came from a page the company published itself. My first line names their actual setup — and doesn't mention how I found it. I sent 20, read the replies, and fixed the pitch before scaling. Real sender identity + working unsubscribe on every send.
If you do only one thing: pull one competitor's cert list and tag each row branding-on or branding-off. That single column — who's on the base plan and hasn't upgraded — is worth more than every lead database you've ever paid for.
Found this useful? Come build with me.
More no-fluff guides, product breakdowns & behind-the-scenes — every week.
instagram.com/sanskarr.tiwari
