How We Source Business Owners Nobody Has Contacted Before (Entirely in Claude Code)

Every business buyer in America is pulling contact information from the same few databases (apollo, zoominfo, etc.). Your prospect gets the same 10 cold emails a day. They complain about their flooded inbox, you complain about your lack of replies, & everyone loses.

A PE firm that owns HVAC and plumbing companies across the US wanted to find every shop within 50 miles of their platform companies, and run outreach to find interested, qualified sellers. Pretty standard stuff.

Now, being the cracked out list-builder that I am, I know we can't just go pull names from Apollo for this. To achieve full TAM coverage, we had to build this the right way - bottom-ups. Find the companies first, then use multiple strategies to find as much owner contact information as we can.

Here's exactly how I built a market map with nearly 80% owner coverage in an afternoon on claude code; crushing contact coverage compared to established companies like ZoomInfo (no wonder their stock is down 95% over the last 5 years):

Step 1: Google Maps sweep for the raw universe

Google Maps is the best place to start building a company list for home services. This is common ball knowledge at this point.

We started with a serper.dev /maps API sweep on every unique metro where the client had an existing portfolio company.

For each metro we ran two queries, one for HVAC contractor and one for plumber, with the search radius set to 50 miles by using a 10z zoom parameter.

We paginated fifteen pages deep on each query to catch the long tail. Combined queries would have missed pure-play plumbers who don't tag themselves as HVAC, and vice versa, so two separate queries per city was worth the extra API cost.

Total time on the sweep was 30 minutes and cost about $2 in Serper credits.

Output was ~5,000 unique shops with company name, exact address, phone number, website, review count, and Google Business category.

This is our raw universe.

Step 2: Enrich against the mass-market databases first, to see what's actually missing

We fed the domain list to AI-Ark, which is a LinkedIn-backed people database. Coverage on our 5,000 shops was as expected: 15% got a named owner from AI-Ark, 7% got a verified email.

For a lot of vendors this is where the delivery would stop. Hand the client a 500-lead list and call it done. But 7% coverage on a home services buy-side campaign is unusable. Time to dig deeper.

Step 3: Web Scraping for the missing owners information (This is where AI starts to eat the lunch of these database companies.)

Most of these owners aren't found in Apollo, AI-Ark, and ZoomInfo, but when you search "Owner of {COMPANY} in {CITY}" they show up pretty quickly on Yelp, BBB, LinkedIn, Google Reviews, & public filings.

For every shop still missing an owner name, we ran a general Google search using Tavily with the query "owner of {COMPANY_NAME} in {CITY, STATE}".

Owner name coverage jumped from 15% to 85% (!!) after this step. We just need the name for now, this will allow us to use our own workflows and API calls to pattern-match the owners email address.

Step 4: Now that we have owner names, run pattern-matching to find their emails

With 4,200 named owners in hand, we could pattern-guess their emails and verify against real SMTP servers. For each owner name plus domain, we generated eight permutations:

first@company.com, first.last@company.com, firstlast@company.com, flast@company.com, last@company.com, f.last@company.com, first_last@company.com, first.l@company.com.

Then we hit MailTester Ninja for each one, in order, and stopped at the first VALID response.

MailTester runs an actual SMTP handshake against the target mail server, so a VALID response means the address exists on the server and accepts mail. We're not guessing whether the address is real, we're confirming it is.

This step alone added ~1,000 verified deliverable emails on top of what Apollo and AI-Ark had returned. These addresses exist on real mail servers but aren't in any B2B provider's index because the underlying providers (Hunter, Snov, Anymail Finder) can't find 'em.

Owners with private online presences tend to fly under the radar with db providers. Not with us.

We've made great progress at this point, but we knew we had way more juice to squeeze.

Step 5: Scrape the actual shop websites for the emails that never make it into databases

For every remaining shop that still didn't have an email, we used Jina Reader to scrape their website. Specifically we pulled /contact, /contact-us, /about, /about-us, and the homepage.

Then we regex-extracted every email address on those pages. Every one, not just the ones matching @company.com.

The reflex is to filter scraped emails to only those matching the company's own domain, on the assumption that the owner uses a corporate email.

This assumption is completely wrong for small service businesses. The reality is that a plumber or HVAC contractor with three trucks doesn't always run Google Workspace. They set up their business back in 2003 with a personal Gmail, Yahoo, sbcglobal, or aol address, and they still use it as the business inbox in 2026.

Running Jina Reader on /contact pages and keeping ALL emails, including personal ISPs, added another 300 to 500 verified owner inboxes to the list. Total cost was around $5 to $10 here.

What the final list looked like

Starting numbers on the 5,000-shop universe were 14.5% owner name coverage and 7% verified deliverable email coverage. After the five-step pipeline, the same universe had 85% owner name coverage and 51% verified deliverable email coverage. About 2,300 rows had both a named owner and a verified email, ready to send from Bison the same day.

Total tool spend across the entire pipeline was $20 to $40. Serper for Maps and Search, Jina for Reader and Search, gpt-5-nano for extraction, MailTester Ninja for verification, plus modest AI-Ark and Moltset waterfall usage. MailTester is flat-rate so cost doesn't scale with volume. Runtime was 4 to 6 hours, mostly background while we did other work.

What Makes This List So Valuable

The 2,300 verified addresses on this list have one thing in common. They don't overlap with what Apollo, ZoomInfo, Cognism, or Clay's default enrichment would return on the same query.

Roughly 40% of the emails on our final list are personal ISPs (Gmail, sbcglobal, aol, comcast) that never make it into any B2B database. Another chunk are name-pattern addresses at company domains that exist on the mail server but aren't in any index because no one had scraped them yet.

The prospect's inbox has rarely ever received a cold email at that address. Which is the entire point.

Everything was orchestrated in Claude Code using direct APIs and MCP servers for Bison, Serper, Jina, MailTester, and OpenAI. Not a single tool called from outside the terminal, and the whole pipeline is a set of Python scripts we can run again on any vertical or geography in an afternoon.

Links

• serper.dev