Where does a company's software show up in public?
Almost every tool a company pays for leaves a public trace: a script on its website, a record in its DNS, a review in an app store, a line in a job ad or a dependency on GitHub. Each trace works for a different kind of product. Pick the one that matches what your competitor sells.
| Footprint | What it shows | Best for competitors that are | Free way to check |
|---|---|---|---|
| Website code | Scripts, tags and widgets the site loads | Chat widgets, analytics, forms, ecommerce and CMS tools | BuiltWith or Wappalyzer single lookups; PublicWWW code search |
| DNS TXT and SPF records | Domain verification tokens and approved email senders | Workspace, SSO, email and e-signature tools | A "dig TXT" command or a public DNS lookup |
| App store reviews | Store name, country and time using the app | Shopify apps | The app's review page |
| GitHub dependents | Public repositories that depend on a package | Open-source libraries and developer tools | The repository's Dependents tab |
| Job ads | Tools a team expects new hires to know | Back-office software no website loads | Search job boards for the tool's name |
| Public posts | People complaining about, comparing or asking about a tool | Any tool with an active user base | LinkedIn and X search |
Website trackers miss tools that never touch a website. Bloomberry, a technographic data company, makes this point on its homepage, where it says it tracks over 1,700 B2B products, including backend tools it says BuiltWith cannot see. That is a vendor describing its own product. The DNS and job-ad checks below cover much of the same ground at no cost.
What can you check for free?
You can look up single companies for free on three of the main tools, and build small lists on one of them. Here is what each free tier gives you, checked on 24 October 2026:
- BuiltWith. Its plans page says single site lookups on BuiltWith are free, with no time limit.
- Wappalyzer. A free account includes 50 technology lookups and 50 email verifications a month, 5 website alerts and free sample lead lists, according to its pricing page.
- PublicWWW. This search engine indexes the HTML, JavaScript and CSS of web pages. The free plan covers the top 3 million websites, with up to 1,000 rows per search and 20 rows of downloads with snippets, per its price list. Search for the competitor's script domain or embed code and you get a list of sites that load it.
- Shopify App Store. Reviews on an app's page show the store name, its country and how long it has used the app. Klaviyo's review page listed 3,406 reviews on 24 October 2026, 268 of them one-star, and lets you sort by newest and filter by rating.
- GitHub. A repository's dependency graph has a Dependents view that lists repositories and packages using it. GitHub's docs say dependents are only worked out for public repositories and that the counts are approximate.
For a competitor with thousands of customers, the free routes give you a partial list. A partial list is enough for a first test of 50 messages.
What does a DNS lookup reveal? A worked example
A company's DNS TXT records often name the SaaS tools it has set up, because many vendors ask you to add a TXT record to prove you own your domain. Atlassian's domain verification guide, for example, tells admins to paste a TXT record at their DNS host. Email tools work the same way through the SPF record: HubSpot's email authentication guide shows a sample SPF record containing "include:123456.spf03.hubspotemail.net".
We ran the lookup on linear.app, the domain of Linear, which makes product-development software, through Google's public DNS resolver on 24 October 2026. It returned 22 TXT records, a snapshot of public records that the company can change at any time. The record names alone mention 13 other vendors:
- verification tokens naming Google, OpenAI, Anthropic, Cursor, Slack, Notion, Zoom, DocuSign, Stripe, Rippling, MongoDB, LaunchDarkly and Apple;
- an SPF record that includes HubSpot's and Amazon SES's sending domains.
Try it on your own domain first: type "dig +short TXT yourcompany.com" in a Mac or Linux terminal. Then run it on 20 target domains and paste the output into a sheet. A row that contains your competitor's token is a lead.
How much do technographic lead lists cost?
Paid self-serve plans cost $109 to $995 a month, checked 24 October 2026, and most price by the number of technologies you track. The last column is our own arithmetic: the plan price divided by the number of tools it lets you build lists for.
| Tool and plan | Monthly price | Technologies included | Price per tracked tool |
|---|---|---|---|
| BuiltWith Basic | $295 | 2 | $147.50 |
| BuiltWith Pro | $495 | Unlimited | Falls as you add tools |
| BuiltWith Team | $995 | Unlimited | Falls as you add tools |
| Wappalyzer Pro | $250 | 2 lead-list technology targets | $125 |
| Wappalyzer Business | $450 | Unlimited | Falls as you add tools |
| Bloomberry Starter (app) | $199 | 2 vendors | $99.50 |
| Bloomberry Pro (app) | $299 | 5 vendors | $59.80 |
| PublicWWW Pro | $109 | Any code snippet, 100 searches a day | Priced by search, not by tool |
Sources: BuiltWith, Wappalyzer, Bloomberry and PublicWWW pricing pages. BuiltWith's minimum term is one month, and its plans page suggests signing up for Basic, getting the report you want, then cancelling.
Price is not the only limit. In a September 2025 Ask HN thread, one founder of a tech consultancy said BuiltWith was too expensive at $299 for 2 technologies when they wanted 10 or more, and that both BuiltWith and Wappalyzer lacked many niche tools. The person who built Bloomberry replied in the thread, disclosed it, and the poster later reported finding companies that use GitHub, GitLab and Grafana. That is one buyer's experience. Before you pay, search the tool's free directory for your competitor by name and check it is covered.
If you only track one or two competitors, run the free checks first and buy a single month of a paid plan only if they come up short.
Which of a competitor's customers should you contact first?
Contact companies whose use of the tool just changed. A company that has used a competitor happily for three years has no reason to talk to you this week. These signals show a moment of change, strongest first:
| Signal | Where to see it | What it suggests |
|---|---|---|
| They stopped using the tool | BuiltWith and Wappalyzer website alerts; a vendor's DNS token removed | A replacement may already be under review |
| A recent one- or two-star review | App store and review sites, sorted by newest | A named problem you may solve |
| A public complaint or comparison post | LinkedIn and X search for the competitor's name | They are thinking about the category now |
| A job ad naming the tool | Job boards | A team being built around the tool, or a migration |
| They just started using a starter tool | Technographic alerts | A team that is beginning to grow |
BuiltWith lists usage alerts for when a list of websites starts or stops using a technology among its plan features. Bloomberry's homepage says its alerts fire when a company churns from a product. The last row comes from the Ask HN poster, who wanted to find firms that had just started using a starter-level devops product such as Bitbucket, as a sign the engineering team was beginning to scale.
A company that just dropped your competitor is the warmest lead on this list, so check alerts daily rather than monthly. Our guide to reaching a competitor's customers when it shuts down covers the extreme version of this moment.
What should you say to a competitor's customer?
Lead with one specific gap you fill, and never with how you found them. In an April 2026 r/startups thread on selling when customers already use a competitor (20 comments when checked on 24 October 2026), several commenters gave the same advice: skip the full replacement pitch and solve one gap they already feel. One commenter's view: "Happy customers won't switch. Miserable customers already left." The same commenter suggested reading a competitor's three-star reviews to find the two or three complaints that repeat.
Our guide to finding out what users hate about competitor products shows how to collect those complaints. Then use them in a message like these. We wrote these for this guide; they have no measured reply rates behind them.
- After a public complaint. "Hi [name], your post about [exporting reports from Competitor taking an afternoon] stuck with me. We built [product] around that one job. Want me to send a two-minute video of how it works next to [Competitor]?"
- After they dropped the tool. "Hi [name], looks like [company] has moved off [Competitor]. If you are still choosing what comes next, I can share the three questions teams in [industry] ask us most when they switch. Useful?"
- A complement, no switch needed. "Hi [name], most [Competitor] users we talk to keep it for [main job] and still do [gap] by hand. We only do [gap]. Is that a problem at [company], or have you solved it?"
Keep the DNS and website-code research to yourself. "I saw your SPF record" reads as surveillance. A public post or review is fair to mention; a record they never meant for you is not. Our guide on how to win customers from a competitor covers switching offers and migration help.
A one-week plan to build your first competitor list
Pick the footprint
Look at what your competitor installs: a script, a DNS token, an app, a package. Choose the one or two checks from the first table that see it.
Collect 100 domains
Use PublicWWW's free search for the competitor's script, the app store's reviews, the GitHub Dependents tab, or one month of a paid list. Put each domain in a sheet with the date you saw the tool.
Check DNS for back-office tools
Run "dig +short TXT" on every domain and mark rows that name the competitor or its sending domain.
Add the timing layer
Set free website alerts on your top accounts, read the newest low-star reviews, and search job boards and social posts for the competitor's name.
Find the person and write to them
Find the person who owns the tool, usually the team lead whose work it supports, and send one message built on a public signal.
The public-post signals are the part you can hand off. Siela's AI SDR can track the competitors you name on LinkedIn and X, so people who post about them or engage with them become leads, each scored hot, warm or cold with a one-line reason. Our guide to messaging people who engage with a competitor on LinkedIn covers what to say to them.
Frequently asked questions
Is there a free BuiltWith alternative?
Yes, for small volumes. BuiltWith itself is free for single site lookups. Wappalyzer's free account gives 50 technology lookups a month, 5 website alerts and sample lead lists. PublicWWW's free plan searches the source code of the top 3 million websites, up to 1,000 rows per search, checked 24 October 2026. Paid monthly plans start at $109, for PublicWWW Pro.
Can you find companies that stopped using a tool?
Yes. BuiltWith lists usage alerts for when websites start or stop using a technology, Wappalyzer offers website alerts that track technology changes, and Bloomberry says its alerts fire when a company churns from a product. For tools that verify domains in DNS, a verification token that disappears from a company's TXT records can also mean the setup changed.
How do you find companies using back-office software that a website never loads?
Check DNS and job ads. Many SaaS tools ask customers to add a TXT record to verify their domain, and email platforms appear in the SPF record. Running dig on a domain lists these records for free. Job ads that ask for experience with a named tool are another public trace. Some paid tools, such as Bloomberry, say they cover backend products too.
How do you find Shopify stores using a specific app?
Open the app's page on the Shopify App Store and read its reviews. Each review shows the store name, its country and how long the store has used the app. You can sort by newest and filter by star rating, so recent one- and two-star reviews point to current users with a named problem.
Should you tell a prospect you know which software they use?
Mention it only when they made it public, for example in a post, a review or a job ad. Do not mention DNS records, SPF entries or website code. Those sources are public but were never meant for a sales pitch, and quoting them reads as surveillance. Lead with the gap you fill instead.
Sources
- BuiltWith: Plans and pricing (checked 24 Oct 2026)
- Wappalyzer: Plans and pricing (checked 24 Oct 2026)
- PublicWWW: Plans and pricing (checked 24 Oct 2026)
- Bloomberry: Pricing (checked 24 Oct 2026)
- Bloomberry: Real-Time Technographic Data and API (homepage) (checked 24 Oct 2026)
- Google Public DNS: TXT records for linear.app (checked 24 Oct 2026)
- Atlassian Support: Verify a domain to manage accounts (checked 24 Oct 2026)
- HubSpot Knowledge Base: Manage email authentication in HubSpot (checked 24 Oct 2026)
- Shopify App Store: Klaviyo reviews (checked 24 Oct 2026)
- GitHub Docs: Exploring the dependencies of a repository (checked 24 Oct 2026)
- Hacker News: Ask HN: Decent Builtwith alternative for finding leads? (24 Sep 2025)
- Reddit r/startups: How do you sell when your customers already use a competitor? (April 2026; checked 24 Oct 2026)
- PublicWWW: Source code search engine (homepage) (checked 24 Oct 2026)