The Problem With Bought Lists

Every B2B sales team has run this cycle at least once: buy 10,000 contacts from a data vendor, watch a third of the emails bounce, discover half the companies don't match your ICP, and burn your sender reputation on the rest. Purchased lists are stale by design. They're collected once, resold many times, and decay at a few percent per month as people change jobs and companies pivot, merge, or close.

The fix isn't a better vendor. It's building prospect lists from primary sources: the directories, registries, and public listings where businesses describe themselves, refreshed as often as you need, filtered to your exact criteria before a single name enters your CRM.

That's a web scraping problem, and it's one of the highest-ROI uses of scraping in B2B. It's also the one with the most ways to do it badly. This guide covers where good prospect data lives, how to enrich it, and the lines a responsible operation doesn't cross. Read that last part even if you skip everything else.

The Rules First

This section sits near the top on purpose, because it shapes every decision after it.

The core distinction is business records versus personal data harvesting. A company's name, address, main phone line, website, industry, and role-based inboxes (info@, sales@) are records the company publishes in order to be found; scraping them at scale is how every business directory on earth was built. Harvesting personal emails of individuals, especially by crawling social profiles, is a different activity with a different risk profile, and it's where most "lead scraping" operations go wrong.

On the law: CAN-SPAM in the US doesn't prohibit cold email. It requires accurate headers, a physical address, a working unsubscribe, and prompt opt-out handling. Follow those and cold outreach to business contacts is legal. GDPR is stricter. Business contact data tied to an identifiable person is personal data ([email protected] yes, [email protected] generally no) and needs a lawful basis. Legitimate interest can cover relevant, professional B2B outreach, but it demands genuine relevance to the recipient's role, easy objection handling, and transparency about where you got the data. Bulk-blasting scraped personal emails across the EU does not clear that bar, whatever the vendor selling you the tool claims.

Platform terms matter too. LinkedIn pursues profile scrapers aggressively, and our advice is blunt: don't build your lead engine on scraping individual people's profiles anywhere. Build it on company-level data and handle the human layer through compliant enrichment later. For the broader landscape, see is web scraping legal?

None of this is legal advice. But a scraping partner who never mentions these constraints is telling you something about how they operate.

Where Good Prospect Data Lives

The right sources depend entirely on who you sell to. The pattern that works: pick sources where your ICP self-identifies.

Directories

General directories (Yelp, Yellow Pages, BBB, chamber-of-commerce listings) and vertical ones (Avvo for lawyers, Healthgrades for medical practices, Houzz for contractors, Clutch for agencies) list businesses with category, location, size hints, and contact details. Verticals are usually better. A firm that keeps its Clutch profile current is actively selling, which also means it's actively buying tools.

Google Maps

For any business with a physical location, Google Maps is the most complete and current directory in existence. A query like "HVAC contractors in Phoenix" returns names, addresses, phone numbers, websites, hours, ratings, and review counts, and review count turns out to be a serviceable proxy for business size and activity. Sellers of local-services software, insurance, supplies, or financing can build entire territories from Maps data. The mechanics are in our guide to Google Maps scraping; the same techniques retail teams use for site selection work fine for prospecting.

Associations and licensing boards

Trade association membership rosters are curated ICP lists that someone else maintains for you. Licensing boards go further: many states publish searchable registries of licensed contractors, pharmacies, insurance agents, and medical practices. Public records, verified business status, and occasionally a downloadable CSV nobody bothers to look for.

Exhibitor lists

Our favorite underused source. Trade show exhibitor lists are public, structured, and pre-qualified twice over: every exhibitor is in the industry, and every exhibitor is demonstrably spending money on growth. A company that paid $20,000 for a booth at a logistics expo is a warm target for anyone selling into logistics. Scrape the exhibitor directories of the top ten events in your vertical and you have the list your competitors built by walking the floor with a badge scanner.

Job boards

Hiring is a buying signal. Three open DevOps roles means infrastructure tooling spend is coming; a first "Head of Compliance" hire means compliance software is about to get evaluated. We cover this angle in depth in our guide to scraping job postings.

The Core Record

A useful company-level prospect record looks like this:

Field	Source	Why it matters
Company name, website	Directory / Maps	Identity anchor; the website unlocks enrichment
Address, geography	Directory / Maps	Territory assignment, local relevance
Phone (main line)	Directory / Maps	Direct outreach channel
Industry / category	Directory taxonomy	ICP filtering
Size signals	Reviews, locations count, careers page	Segmentation, deal-size estimation
Role-based email	Company website	Compliant first-touch channel
Social/web presence	Company website	Activity and legitimacy check

Notice what's absent: no scraped personal emails, no individual profiles. Finding the right decision-maker is a separate, later step, best handled through compliant enrichment providers, Sales Navigator used as intended, or plain research on the shortlist that survives filtering.

Enrichment

A name-and-address list is a phone book. Enrichment is what turns it into a ranked pipeline.

Start with the company's own website and extract what it says about itself: employee count claims, locations, customer logos, careers-page activity. A company with 12 open roles and 8 offices is a different prospect than one whose site was last touched in 2019.

For software sellers, tech stack detection is the highest-value enrichment there is. A site's HTML, headers, and script tags reveal its stack: Shopify vs. Magento, HubSpot vs. Marketo, Intercom, Segment. If you sell a Shopify app, a scraped list of stores running Shopify Plus in your target categories is your market, enumerated. Detection is pattern-matching against known fingerprints:

# Simplified tech detection from a homepage
import requests

FINGERPRINTS = {
    "shopify": ["cdn.shopify.com"],
    "hubspot": ["js.hs-scripts.com"],
    "intercom": ["widget.intercom.io"],
}

html = requests.get("https://example-store.com", timeout=10).text
stack = [tech for tech, sigs in FINGERPRINTS.items()
         if any(s in html for s in sigs)]

Then layer in timing: recent Google reviews, new locations, fresh job postings, a redesigned website. Businesses in motion buy things.

Quality Beats Volume, and It Isn't Close

There's a persistent fantasy in outbound sales that more contacts equal more pipeline. Run the math. Sending 50,000 emails to a badly filtered list at a 0.2% positive-reply rate yields 100 conversations, while torching your domain reputation and, since Google and Yahoo tightened bulk-sender rules in 2024, risking deliverability for all your mail. Sending 2,000 emails to a tightly filtered, verified list at a 5% positive rate yields the same 100 conversations from 4% of the volume, with a sender reputation that survives the quarter.

Scraping's real advantage in lead generation isn't volume. Anyone can produce volume. It's precision: the ability to define "companies matching exactly these criteria, verified this month" and enumerate them exhaustively. Every med spa in Texas that opened in the last 18 months, runs on Square, and has over 50 Google reviews. No list vendor sells that, because it's your ICP, not theirs.

Verification closes the loop: websites resolve, phone formats are real, emails pass verification checks, the business isn't marked permanently closed. Expect to throw away 10–25% of raw scraped records. Good. Every discarded record is a wasted touch you didn't make.

From Raw Scrape to CRM

Between "we scraped 8,000 businesses" and "sales is working the list" sits a pipeline that decides whether any of this was worth doing.

Dedup comes first. The same company shows up in Google Maps, two directories, and an association roster as "Smith & Sons HVAC" and "Smith and Sons Heating". Entity resolution — matching on normalized name plus address plus phone plus domain — collapses these into one record and merges the best fields from each source. Skip it and your SDRs email the same company three times in one week. They will hear about it.

Then scoring: rank every surviving record against your criteria (size signals, tech stack, activity, geography). The top quintile gets human research and personalized outreach; the bottom quintile gets archived, not emailed.

Then suppression: diff the list against existing customers, open opportunities, competitors, and previous opt-outs before anything reaches an outreach tool. Cold-pitching a current customer is the cheapest possible way to look incompetent.

Finally, format for the destination. CRM imports have opinions about field mappings, picklist values, and owner assignment. A list delivered in the CRM's exact import schema gets used the same day. A raw CSV with 40 unmapped columns sits in a shared drive forever. In practice this last, least glamorous step decides whether the project produces pipeline or a file.

Keeping Lists Alive

Prospect data decays fast. Businesses close, move, rebrand, and get acquired, and a scraped list is accurate the day you build it and degrades from there. The durable version of this is a refresh pipeline, not a one-time export: re-scrape sources monthly or quarterly, diff against the existing list, flag closures and changes, and surface new entrants. New entrants are often the best prospects of all, because new businesses are still choosing their vendor stack.

How We Run These Projects

DIY lead scraping stalls in predictable places: directories with anti-bot protection, Google Maps pagination limits, sources that each need custom extraction, and the dedup and verification pipeline that separates a usable list from a liability. Every source you add is a parser you now own. Our build vs. buy breakdown covers the full cost picture.

ScrapeAny runs prospect-list projects as a managed service. You define the ICP — industry, geography, size signals, tech stack, any criterion visible in public data — and we handle source selection, collection, enrichment, cross-source dedup, verification, and scheduled refreshes. We're explicit about the boundaries: we collect company-level public data and role-based contact points, we don't harvest personal emails or scrape individual social profiles, and if a request crosses a line we'll say so rather than quietly doing it. Delivery is whatever your stack expects: CSV, JSON, API, or CRM-ready feeds.

Build a List Worth Emailing

The best prospect list matches your ICP exactly, was verified this month, and contains nobody your competitors' generic vendor also sold to. Describe your ideal customer — tell our team what you're targeting and we'll send back a verified sample list within days, so you can judge the quality before committing to anything.