8 Ways to Find Companies Using HubSpot (Without Paying)

HubSpot has over 230,000 paying customers and is the default CRM and marketing stack for a huge chunk of B2B companies in the 10 to 500 employee range. That makes HubSpot users one of the most valuable prospect pools for indie hackers to tap.

If you built an integration, a complementary tool, or offer any kind of marketing or sales ops service, a list of confirmed HubSpot customers is essentially a pre-qualified pipeline. These companies already have CRM budget, already live inside the HubSpot ecosystem, and are already looking for ways to get more out of it.

HubSpot is a great target for IndieHackers specifically because:

You built a HubSpot integration. You need to find the ~200,000+ companies actively using it to pitch directly.
You run a small HubSpot agency or consultancy. You need a steady pipeline of companies to approach for onboarding, migrations, or audits.
You are doing pre-launch customer discovery. Finding HubSpot users helps you validate whether your idea fits a real workflow before you build anything.
You sell adjacent tools. Email tools, CRM add-ons, sales automation, RevOps software, anything that complements HubSpot means HubSpot users are your ideal customer profile.

The usual advice is to buy a list from a data vendor. That is not realistic for most bootstrapped founders. The good news: HubSpot users leave digital footprints everywhere. Here are 8 ways to find them without spending a dollar.

1. Mine Job Boards Using ATS Site Operators

Job postings are one of the strongest intent signals available. A company hiring a "HubSpot Administrator" or a "Demand Gen Manager (HubSpot required)" is confirming platform usage and active investment at the same time.

Avoid LinkedIn and Indeed. They are flooded with recruiter reposts. Instead, go directly to the applicant tracking systems (ATS) that companies use to self-post roles.

For SMBs and growth-stage companies:

site:workable.com "HubSpot"
site:bamboohr.com "HubSpot"
site:recruitee.com "HubSpot"
site:applytojob.com "HubSpot"

BambooHR and Workable are especially popular with companies in the 50 to 500 employee range.

For funded startups and tech companies:

site:job-boards.greenhouse.io "HubSpot"
site:jobs.ashbyhq.com "HubSpot"
site:lever.co "HubSpot"

Greenhouse, Ashby, and Lever are the standard ATS stack for VC-backed companies.

For enterprise:

site:myworkdayjobs.com "HubSpot"
site:icims.com "HubSpot"

Go deeper with more specific queries:

Companies using Marketing Hub: site:job-boards.greenhouse.io "HubSpot Marketing Hub"
RevOps teams using HubSpot: site:jobs.ashbyhq.com "HubSpot" "revenue operations"
Companies running HubSpot alongside Salesforce: site:myworkdayjobs.com "HubSpot" "Salesforce"

Each result is a direct company posting with their name, the role they are hiring for, and a clear signal of which HubSpot products they are actively using. The entire process takes about 5 minutes.

2. Search `site:hs-sites.com` to Find HubSpot CMS Users

HubSpot's Content Hub hosts customer websites on the hs-sites.com domain. A single Google search returns thousands of companies using it:

site:hs-sites.com

Results look like 72048193.hs-sites.com or 880442.hs-sites.com. The subdomain is the company's HubSpot Portal ID, not their name. Just click through and identify the company from the page title, logo, or footer copy in a few seconds.

Target specific industries by adding keywords:

site:hs-sites.com "logistics"
site:hs-sites.com "B2B software"
site:hs-sites.com "professional services"

Any company that built their full website on HubSpot CMS is not a casual user. They are deeply invested in the platform and almost certainly running Marketing Hub and Sales Hub alongside it.

3. Detect HubSpot Usage via DNS and Page Source

If you already have a list of target companies and want to quickly filter for HubSpot users, two publicly available technical signals make this easy:

Signal 1: SPF records. Companies using HubSpot for email include _spf.hubspot.com in their DNS TXT records. SPF records are publicly queryable.

Signal 2: Tracking script. HubSpot injects analytics JavaScript from hs-analytics.net on websites using their platform.

Here is a Node.js script that checks both signals across a list of domains:

const dns = require("dns").promises;
const https = require("https");

async function fetchPage(domain) {
  return new Promise((resolve) => {
    const req = https.get(`https://${domain}`, { timeout: 5000 }, (res) => {
      let body = "";
      res.on("data", (chunk) => (body += chunk));
      res.on("end", () => resolve(body));
    });
    req.on("error", () => resolve(""));
    req.on("timeout", () => { req.destroy(); resolve(""); });
  });
}

async function checkHubspot(domain) {
  // Check SPF record
  try {
    const records = await dns.resolveTxt(domain);
    for (const record of records.flat()) {
      if (record.includes("spf") && record.includes("hubspot")) {
        return { domain, result: true, signal: "SPF" };
      }
    }
  } catch {}

  // Check page source for HubSpot JS
  const html = await fetchPage(domain);
  if (html.includes("hs-analytics.net") || html.includes("hs-scripts.com")) {
    return { domain, result: true, signal: "JavaScript" };
  }

  return { domain, result: false, signal: null };
}

const domains = ["acme.com", "widgetco.io", "examplecorp.com"];

(async () => {
  for (const domain of domains) {
    const { result, signal } = await checkHubspot(domain);
    console.log(`${domain}: ${result ? "YES" : "NO"} ${signal ? `(${signal})` : ""}`);
  }
})();

Run this against 1,000 domains in a few minutes at zero cost. No API keys, no credits.

If you prefer a no-code approach, upload your company list to Clay or Databar and run AI enrichment using your own OpenAI API key. That costs roughly $0.001 to $0.003 per lookup versus $0.10 to $0.50 for their built-in tech stack enrichment features.

4. Find HubSpot Service Hub Users via Support Subdomain CNAMEs

This method specifically surfaces companies using HubSpot Service Hub, their customer support and knowledge base product.

Companies often host their support portals at subdomains like support.company.com, help.company.com, or kb.company.com. When those subdomains are powered by HubSpot, the CNAME record contains hubspot or hs-sites.

Here is a Ruby script to check a list of domains:

require 'resolv'

def hubspot_service_hub?(domain)
  subdomains = %w[kb support help docs]
  subdomains.each do |sub|
    fqdn = "#{sub}.#{domain}"
    begin
      cname = Resolv::DNS.open { |dns| dns.getresource(fqdn, Resolv::DNS::Resource::IN::CNAME) }
      target = cname.name.to_s
      return true if target.include?("hubspot") || target.include?("hs-sites")
    rescue Resolv::ResolvError
      next
    end
  end
  false
end

domains = ["acme.com", "widgetco.io", "examplecorp.com"]
domains.each do |d|
  puts "#{d}: #{hubspot_service_hub?(d) ? "Service Hub detected" : "not found"}"
end

Service Hub is a paid product. Any company running it is not just using the free CRM tier, and may need integrations, chatbot tools, or customer success software built around their support stack.

5. Scrape HubSpot Partner Directory Reviews

The HubSpot Solutions Partner Directory lists thousands of HubSpot agencies with client reviews. In the UI, reviewers appear as "James T." But if you inspect the network requests in your browser's DevTools, the underlying API response actually returns the full company name of each reviewer.

How to use this:

Find a HubSpot agency that serves your target market (e.g., an agency specializing in SaaS onboarding or e-commerce)
Open their partner profile, open DevTools (F12), go to the Network tab
Look for API calls that return review data. The JSON includes a companyName field not shown in the UI
Write a script to iterate through all reviews for that agency

The real play here is filtering for 1 to 3 star reviews. Those companies are confirmed HubSpot users, clearly have agency budget, and are currently unhappy with their vendor. That is about as warm a lead as you will find if you offer HubSpot consulting or migration services.

This requires some light scraping but the targeting precision is hard to match anywhere else.

6. Lurk in HubSpot Slack Communities

HubSpot has several active Slack communities where users troubleshoot problems and share best practices in real time. These are not stale database records. These are people actively working in HubSpot right now, often with an urgent problem.

Key communities to join:

HubSpot Developer Slack: The most active. Channels to watch: #hs-get-started, #hs-apis, #hs-workflows
HubSpot Solutions Partner Slack: For HubSpot agencies and consultants
HubSpot for Startups Slack: Venture-backed startups in the HubSpot startup program

When someone posts "How do I set up lead routing for our enterprise accounts in HubSpot?" in one of these channels, they have just self-identified as an active user with a live problem. Most people use their real name in Slack. Take their name and search:

"[First Last]" HubSpot site:linkedin.com

You will land on their LinkedIn profile with their company, title, and enough context to reach out with something relevant.

Do not spam. Lurk, identify, then reach out with a message that directly addresses what they were asking about.

7. Search LinkedIn for HubSpot INBOUND Conference Activity

HubSpot's INBOUND conference draws tens of thousands of attendees each year, mostly power users, agencies, and companies running multiple HubSpot products. People post about it constantly on LinkedIn before, during, and after the event.

Search LinkedIn directly:

"INBOUND 2025" OR "INBOUND 2026"
"attending INBOUND"
"see you at INBOUND"

Or use Google with LinkedIn site operators:

site:linkedin.com/in "INBOUND" "HubSpot"
site:linkedin.com/posts "INBOUND conference"

Each post surfaces the person's name, company, and job title. INBOUND tickets run $500 or more before travel costs. Any company sending employees is a serious HubSpot customer, not a free-tier signup.

Also worth checking: INBOUND sponsors and speakers. Companies that sponsor the conference are embedded in the HubSpot ecosystem at a completely different investment level.

8. Sign Up for Free Trials of HubSpot Customer Databases

If all else fails, a few tools maintain dedicated databases of HubSpot customers and offer free trials or limited exports. These are worth trying as a last resort before committing to a paid plan.

Bloomberry: Tracks companies using HubSpot with filters for company size, industry, and geography. Free trial available.
BuiltWith: Detects HubSpot usage from website technology scans. You can browse the HubSpot customer list and export a limited number of records on a trial.
Apps Run The World: A customer database specifically for enterprise software products including HubSpot CRM.

These are useful when you want a clean export fast and have exhausted the free methods above.

Wrapping Up

You do not need an expensive data subscription to build a qualified list of HubSpot users. DNS records, job postings, CMS infrastructure, Slack communities, conference activity, and partner reviews all surface real companies with confirmed usage.

The bigger advantage of these methods over buying a list is that they find companies with active needs right now, not passive names in a quarterly-refreshed database. Someone asking a question in Slack, hiring a HubSpot Admin, or leaving a negative review for their agency has a live problem and real budget. That is fundamentally better signal than a CSV export.

For bootstrapped founders and small agencies, this kind of scrappy research is exactly how you build a qualified pipeline without enterprise budgets.