client-discovery-osint

Files (1)

• SKILL.md

SKILL.md (first lines)

# Client Discovery via Cross-Referencing (OSINT)

## Overview

How to identify the clients and customers of a private company using only open-source intelligence. Private companies (especially bootstrapped VARs, consultancies, and services firms) rarely publish client lists. This skill provides a systematic methodology for extracting client signals from 12+ data source categories, cross-referencing them, and building a tiered confidence registry.

Developed and validated on BROGAV Solutions LLC (data center equipment VAR, ~$4.5M revenue, 1 publicly named client out of an estimated 75-150 total). Started with a single confirmed client (Cologix). Finished with 6 confirmed + 6 probable + 17 event sponsors + 10 warm-network connections = 43+ companies identified across 7 tiers.

Use this skill when you need to:
- Build a client list for a company that doesn't publish one
- Assess customer concentration risk for an acquisition target
- Map a competitor's installed base
- Identify warm leads through relationship intelligence
- Validate an ICP list against real-world relationship evidence

---

## When to Use

- **M&A due diligence:** The target claims "100+ customers" but won't share names before LOI. Use OSINT to verify the claim's plausibility and identify concentration risk.
- **Competitive intelligence:** You need to know who a competitor serves so you can target the same accounts or adjacent ones.
- **Partnership assessment:** Before partnering with a company, verify they actually serve the market they claim.
- **Sales prospecting:** Use identified clients of a competitor to build a lookalike prospect list.
- **Investor diligence:** Verify a startup's claimed traction by finding evidence of real customer relationships.

---

## Prerequisites

- Company name, website URL, and founder/CEO LinkedIn profile URL
- Access to web search, LinkedIn (manual or saved HTML), and public records databases
- Familiarity with the `linkedin-activity-intelligence` and `era-validated-linkedin-analysis` skills (for timeline verification)
- Optional: SignalHire, ZoomInfo, or Apollo for contact enrichment
- Optional: Wayback Machine CDX API access for historical page captures

---

## Method

### The 12 Source Categories

Search all of these. Most private company client intelligence hides in the intersection of multiple weak signals, not in any single strong one.

#### 1. Testimonials (website)
Scrape the company website for testimonial pages. Look for:
- Named clients with named contacts (strongest signal)
- Unnamed testimonials with CMS template errors (e.g., `{they were established}` reveals a Squarespace merge-field failure, meaning the testimonial was pulled from a structured database)
- Product-specific testimonials that narrow the client type (e.g., "liquid cooling installation" narrows to high-density compute operators)
- Testimonial tone and vocabulary (a facility engineer writes differently than a procurement VP)

**Extraction command:**
```bash
curl -s https://example.com/testimonials | grep -oP '"[^"]{50,}"' | sort -u
```

#### 2. Case Studies (website + partner sites)
Case studies often name the client, the product, and the outcome. Check:
- Company website case study pages (and Wayback captures of removed case studies)
- LinkedIn posts describing project completions with tagged companies
- **Supplier/partner websites** — this is the breakthrough source. Manufacturers list their resellers' case studies to promote their own products. Example: RLE Technologies published a BROGAV case study on their website, revealing a Cologix installation that BROGAV never mentioned on its own site.
- YouTube project walkthrough videos

**Key insight:** Supplier case studies are harder for the target company to hide or retract, because they're on a third party's website.

#### 3. LinkedIn Posts (company + founder + team)
The richest source for relationship-driven businesses. Extract:
- Posts explicitly saying "partners and customers" with tagged companies
- Event recap posts tagging attendees from client companies
- Project completion posts with hashtags (#pduinstallation, #pdustartup, #datacenter)
- "Congratulations" posts to clients on expansions, openings, or milestones
- Founder's personal LinkedIn activity archive (see `linkedin-activity-intelligence` skill)
- Employee LinkedIn posts (sales reps, project managers, field technicians often post from client sites)

**Critical warning:** Apply the `era-validated-linkedin-analysis` skill before attributing any LinkedIn intelligence. A founder's feed contains posts from prior employers.

#### 4. Event Sponsors and Speakers
Companies that sponsor or send speakers to the target's proprietary event have a commercial relationship. Classification:
- **Premier sponsors ($5K-$10K+):** Deep commercial relationships — nobody spends $10K to sponsor a 120-person event unless there's a business reason
- **Speakers from end-user companies** (facility managers, procurement VPs, CTOs): Likely clients
- **Speakers from supplier companies:** Upstream partners, not clients — classify separately
- **Event attendees** (non-speaker, non-sponsor): Weakest signal, but still indicates engagement

Source sponsor lists from: event web pages, Wayback Machine captures, YouTube video thumbnails showing sponsor banners, LinkedIn sponsor thank-you posts, sponsorship package PDFs, event registration platforms (Eventbrite, Sched, Emamo).

**Photo intelligence method:** A single event photo can reveal 5-10 sponsor relationships. Download event recap images from LinkedIn and decode every logo on sponsor banners, step-and-repeat backdrops, and table tents.

#### 5. YouTube Transcripts and Videos
Search video transcripts for client names. Check:
- Founder interview videos for "we worked with [company]" references
- Installation demo videos for facility identifiers or client equipment labels
- Event recap videos for sponsor banners and name badges
- Video descriptions and comments
- Podcast guest appearances (often hosted on YouTube)

**Transcript extraction:**
```bash
yt-dlp --write-auto-sub --skip-download --sub-lang en -o "transcript" "VIDEO_URL"
grep -i "client\|customer\|partner\|install\|project" transcript.en.vtt
```

#### 6. Website Crawl (full site)
Crawl every page of the company website. Search for:
- Client logos on "trusted by" or "our clients" sections
- Partner/client distinction (many sites blur these — "partners" may mean clients, suppliers, or both)
- Product pages mentioning specific installations or deployments
- Blog posts referencing projects
- Deleted pages recovered via Wayback Machine (event pages, sponsor pages, member directories)

```bash
wget --spider --recursive --level=3 --no-parent -o crawl.log https://example.com
grep -oP 'https?://[^ ]+' crawl.log | sort -u > all_urls.txt
```

#### 7. Employee Career Histories
Former employers of current staff are warm-lead pools. In relationship-driven industries, salespeople sell to their old networks. Map:
- **Founder's career** (10+ years of accumulated client relationships transfer to the new company)
- **VP Sales connections** (their rolodex is the pipeline)
- **BDMs with manufacturer backgrounds** (they bring their OEM's client list as warm introductions)
- **Field technicians from competitors** (they know where every rack is installed)

From ever-just/agentskills, MIT.

More from ever-just/agentskills