Reinventing.AI/Use Claude Code to Find Every Business Running the Software You Replace

Live Training · Tue Aug 11 · 10:00 AM EDT · Free for Members

  • Tuesday at 2:00 PM – 3:00 PM UTC

Use Claude Code to Find Every Business Running the Software You Replace

  • Zoom
  • $149

Most prospecting starts with a guess about who your customer might be. In this session, you'll learn to use Claude Code to find every business running a specific piece of software by the traces it leaves on their public website, verify each one is a current customer, and get a contact route for most of them. I found 1,419 businesses this way using only free tools. I packaged it all into a Claude Code skill for you.

Save $149 and Get Instant Access to this + Many more apps, agents, & tools.

For founders selling software to a market that does not know it exists yet

Your buyers already pay for something. If your product displaces, extends, or fixes a hosted platform, that platform's customer list is your target list, and it is sitting in public. I found 1,419 verified businesses on one platform this way, with a contact route for 1,132 of them, using free tools only.


Cold lists are guesses. This is not.

Every prospecting tool sells you a filter: company size, industry code, job title, region. Those are demographic guesses about who might have your problem, and you find out whether the guess was right after you have spent the budget.

There is a much stronger signal available and almost nobody uses it. If you sell something that replaces a hosted platform, then the businesses running that platform are provably your market. Not "similar to your market." Running the exact thing you displace, today.

Every hosted platform leaves traces on its customers' public websites. A CDN hostname. A login path. A distinctive set of meta tags. Those traces are queryable at internet scale, for free. You can build the list yourself in a few sessions, and nobody can sell you the same one.

The six stages, end to end

  1. Find the fingerprint. What every customer site leaks, where it lives, and the measurement step almost everyone skips. Two candidate fingerprints on the same platform measured 89% and 14% coverage. They looked identical.

  2. Pick the index. Four families of search corpus, what each one can actually query, and why the highest-precision option is free and almost nobody has tried it. It ran at 99% precision.

  3. Extract at scale. Getting thousands of hostnames out of tools that cap your output, without paying for a plan you do not need.

  4. Verify before you believe. Only about 43% of hits from the biggest channel were still real customers. Skipping this step is what makes cold outreach read like a scrape.

  5. Enrich to a contact route. The eight-step protocol that took a list to 1,132 reachable businesses, including the step that recovered 57% of missing routes where the obvious approach got 4%, and the one-word regex mistake that wrongly labelled 213 of 311 pages.

  6. Qualify and rank. How to find public evidence that a business has your problem right now, and the counter-intuitive rule about which prospects are actually the best ones.


The proof

What it produced

  • Verified businesses found · 1,419

  • With a working contact route · 1,132

  • Precision of the best channel · 99%

  • Spend on tools · $0

Every number in the session is measured from that run, including the mistakes. You will see the regex that corrupted a third of a contact list and the API-budget decision that wasted 60% of a channel's quota, because the failures are more instructive than the wins.


Who it is for

This is for you if:

  • You sell software, an AI tool, or a service that replaces or extends a hosted platform

  • You are selling into a category people do not know to search for

  • You would rather build a list nobody else has than rent one everybody has

  • You are comfortable running a Python script, or comfortable asking Claude to run it

This is not for you if:

  • You want a done-for-you list handed over. This teaches you to build one.

  • Your product has no relationship to any identifiable software

  • You are looking for a way to send high-volume unsolicited email. The session spends real time on the opposite: routing, rate limits, two-touch limits, and the jurisdictions where cold email is not the right channel.


What you leave with

  • The full playbook, written up, yours to keep

  • Three working scripts: fingerprint discovery with coverage measurement, verification, and the eight-step enrichment protocol

  • A Claude Skill that runs the whole method, so you can point Claude at a platform and work through it conversationally

  • The recording


Honest note

One thing I want to be straight about: this session is about finding buyers, not converting them. I can show you the list I built and exactly how.

Live session, recording included, and you leave with the Claude Code skill.

Tuesday @ 10 AM EDT · Save my seat + get the Claude Skill

Meet the Developer

Mark Fulton

Mark is an expert prompt engineer, marketer, AI developer, and entrepreneur who is passionate about leveraging the best AI solutions for business and marketing.

With 25+ years of experience in digital marketing and web development, Mark applies his knowledge to create amazing AI tools, AI agents, and AI automation.

Mark has been featured on The Rundown, PromptBase, Mindstream, AINews, and competed in numerous prompt engineering competitions including HackAPrompt 2023 (Top 1%) and FlowGPT Hackathon (1st Place).

FAQ

Questions You May Have

Will this get me customers?

It gets you a list. I want to be precise about that, because it is the most important sentence on this page.

I can show you 1,419 verified businesses, 1,132 of them with a working contact route, and the exact method that produced them. That part is done and measurable. I am running the outreach campaign from that list now, and I do not yet have conversion numbers to show you. When I have them, everyone who attended gets them, good or bad.

If someone is selling you a prospecting method with a conversion rate attached, ask them to show you the campaign.

What if I do not have an obvious competitor to target?

You do not need a competitor. You need a hosted product your buyers already run. That can be something you replace, which is the obvious case. It can be something you extend or plug into, which is often better, because those customers have already proved they buy tools in your category. It can also be something adjacent that signals the same budget and the same problem.

If you sell an AI writing tool, every business running a CMS is a candidate. If you sell analytics, every business running a checkout is a candidate. The question is not "who competes with me", it is "what does my buyer already pay for that leaves a trace."

Will this work in my niche?

The method is niche-agnostic because it keys on software, not industry. It works anywhere the target runs a hosted product that renders on a public website.

It works less well if your buyers use only self-hosted or desktop software with no web-visible trace, or if they have no public website at all. Come to the session with a platform in mind and you will know inside the first twenty minutes whether yours qualifies.

How long does this take?

The first pass on a new platform is a few focused sessions, not months. Most of the elapsed time is waiting on scripts rather than working.

The part that takes real thinking is stage one, finding and measuring the fingerprint. Get that wrong and you can lose a week harvesting the wrong signal, which is exactly why the session spends the most time there and why one of the scripts exists purely to measure it for you.

What if the platform I want to target is small?

Then your list will be small, and that is often good news. A verified list of 300 businesses that provably run the thing you replace is worth more than 30,000 filtered by employee count.

The method also tells you the size of the market before you commit to it, which is useful information on its own. Finding out a category has 400 businesses in it rather than 40,000 is worth knowing early.

Is any of this legal?

I am not a lawyer and this is not legal advice, so take it as an honest description of what the method does rather than a ruling.

Collecting is reading public web pages. Every source used in this session is a public page, a public search index, or a public internet scan. Nothing requires a login, nothing bypasses a paywall, and nothing touches private data.

Sending is where the regulation lives, and it varies by jurisdiction. That is a separate question from finding, and the session treats it as one. There is a whole segment on routing: which recipients should get a published contact form rather than a cold email, why a platform's own messaging widget is often the appropriate channel, and where cold email is not the right tool at all.

If you operate in or contact people in the EU or UK, get your own advice on your specific setup. What I can tell you is that the method as taught routes those recipients away from bulk cold email by default rather than as an afterthought.

Is this just scraping? Will I get blocked?

It is closer to searching than scraping. Most of the volume comes from querying indexes that exist to be queried: internet-wide scan data, a public URL scan archive, and ordinary search engines.

You do fetch pages directly during verification and enrichment, and yes, you can get rate limited. Platform edges commonly throttle after a few hundred requests from one IP. In one real run the limit appeared around 170 homepage fetches. The scripts are written to run at modest concurrency and to resume, and the session covers pacing.

The short version: be a polite guest on other people's servers and you will not have a problem.

Is this not just a fancy way to spam people?

It is the opposite bet, and I will defend it directly. Spam works on volume and indifference. This method works on the smallest, best-qualified list you can build, and everything in it is designed around that.

Two touches maximum. There is never a third.

Verify before you send. Roughly 43% of hits from the biggest channel had already churned off the platform. Contacting them is the definition of a blast.

Disclose the pitch in the first message. In a small market you contact the same few thousand people repeatedly and they talk to each other. Hiding that you are selling something costs the relationship the moment they find the price.

Honour every opt-out immediately, including implied ones. And never fabricate a contact address, because guessing info@ is both ineffective and the fastest way to destroy your sending reputation.

If your plan is to blast 10,000 addresses, this session will annoy you. The whole point is to earn a much smaller number of real conversations.

How is this different from BuiltWith, Wappalyzer or ZoomInfo?

Those tools are useful and they solve a narrower problem.

Technology lookup tools tell you what a site you already know about is running. This finds the sites in the first place.

Paid technographic lists will sell you domains using a given technology. There are three differences. You are buying a list your competitors can also buy. You cannot see or control how it was built. And you are limited to platforms the vendor has written a signature for. Building it yourself means you choose the fingerprint, so you can target things no commercial tool detects, including platforms too small for anyone to have bothered with.

The bigger difference is what comes after. A purchased list of domains is not a list of leads. This method continues into verification, contact-route enrichment, and qualification, which is where most of the work and most of the value actually sits.

What do I leave with?

The full written playbook, all six stages, yours to keep. Three working scripts: fingerprint discovery with coverage measurement, verification, and the eight-step enrichment protocol. The Claude Skill, packaged and ready to install. And the recording.