Key takeaways from this article:
- The data broker industry is a $331 billion market — and that’s just the legitimate side. The pipeline that moves contact data from a scraped website to a spam operation passes through multiple commercial layers, each adding value by enriching, verifying, and reselling the same records.
- Contact data scraped from a single WordPress site typically passes through three to five separate buyers before it reaches the operations sending you robocalls and spam texts. Each buyer pays a fraction of a cent per record. At scale, the economics are compelling enough to sustain a massive automated infrastructure.
- Your contact information doesn’t just get sold once. Data broker lists are resold repeatedly, bundled with other datasets, and redistributed across networks you’ll never see. Removing yourself from one list does nothing to the copies already in circulation.
- The pricing is documented: bulk email lists sell for as little as $120 per 10 million addresses. Phone number databases are priced similarly. The market for contact data is liquid, competitive, and largely automated.
- The only intervention that meaningfully affects this pipeline is preventing your contact data from entering it in the first place — which means ensuring it doesn’t exist as readable text in your WordPress site’s HTML source code.
Most people understand, in a vague way, that spam comes from somewhere. They know their email address ended up on some list, that some company sold it to someone else, that the robocall at 8am was probably connected to a website they visited at some point. The mechanics stay fuzzy because nobody wants to explain them — the people running the pipeline have obvious reasons not to, and the victims don’t have an obvious way to investigate.
But the mechanics are knowable. The data broker industry that sits between your contact information and the operations using it is documented, regulated in some jurisdictions, and financially significant enough to be covered extensively by market research firms. And understanding how the pipeline actually works changes what you do about it — because the interventions that work operate at the point of entry, not at any point downstream.
Here is how your contact information gets from your WordPress website to the operations using it against you.
The Scale of the Market Behind the Spam
The data broker industry — companies that collect, aggregate, and sell personal information — was valued at $331 billion in 2025, according to The Business Research Company’s 2026 Global Data Broker Market Report. It is projected to reach $519 billion by 2030, growing at a compound annual rate of 9.3%. That growth is driven by increasing demand for targeted marketing data, the expansion of AI-powered consumer profiling, and the sheer volume of contact information being generated and exposed across the internet every day.
That $331 billion covers the legitimate end of the market — firms like Acxiom, Experian, and LexisNexis that sell data to marketers, insurers, and financial institutions. The shadow end of the market, where contact data is sold specifically for spam and scam operations, is harder to quantify but well-documented through law enforcement cases and security research. According to OneRep’s 2026 data broker analysis, there are over 5,000 data brokers operating worldwide — ranging from Fortune 500 companies to single-operator spam list services operating through encrypted messaging platforms.
The legitimate and shadow markets are not cleanly separated. Data originating in legitimate collection pipelines — scraped from public websites, harvested from public records, extracted from data breaches — flows into both. A record that starts at a legitimate data aggregator can end up in a spam operation’s database after several resales down a distribution chain where each buyer has progressively fewer scruples about how the data gets used.
The Pipeline: From Your Website to a Spam Operation
Understanding where your contact data goes requires understanding the specific pipeline it travels through. The journey from your WordPress footer to a robocall operation typically involves five stages:
Harvesting — automated scraping of your HTML source
Scraping bots crawl your WordPress site within hours of it going live, reading the HTML source of every page and extracting every string matching an email pattern, phone number format, or physical address structure. This is not hacking — it’s reading publicly accessible text. The bot doesn’t need credentials or exploits. It needs your contact page URL and a regex pattern. The harvested data goes into a raw collection database — a list of email addresses, phone numbers, and addresses organized by domain, geographic region, and industry.
Aggregation — combining your data with other records
Raw harvested contact data has limited value on its own. Aggregators combine it with data from other sources — public records (WHOIS registration data, business filings, court records), data breach dumps, social media profiles, and other harvested datasets — to build enriched profiles. Your email address becomes an email address plus a name plus a business category plus a geographic location plus additional phone numbers. Each enrichment layer makes the record more valuable and more dangerous.
Verification — confirming the data is live and accurate
Before sale, high-value lists are verified. Email verifiers send test messages to confirm addresses are active and receiving. Phone number verifiers check carrier data to confirm numbers are in service. Verified lists sell for significantly more than unverified ones — which is why some spam operations send initial probes before the primary campaign. If you respond to a spam email or answer an unknown call, you’ve just confirmed your record is active and increased its resale value.
Sale — the commercial exchange
Verified contact lists are sold through multiple channels simultaneously. Legitimate data brokers sell to marketing agencies through formal commercial arrangements. Shadow market operators sell through encrypted Telegram channels, dark web forums, and private broker networks. Dark web price indexes document the going rates: bulk email databases sell for $100 to $120 per 10 million addresses. Phone number lists are similarly priced. At fractions of a cent per record, the economics support massive automated operations buying and deploying lists continuously.
Redistribution — the list that never stops circulating
This is the stage most people don’t account for. As Privacy Bee’s 2026 data broker trends analysis documents, your data doesn’t get sold once — it gets resold again and again. Modern data marketplaces make it easy to buy, bundle, and resell datasets. A record purchased by one spam operator gets included in a list sold to the next, and the next, and the next. Incogni reported processing over 245 million data removal requests across 420+ data broker databases in 2025 — and that’s only the databases cooperative enough to accept removal requests. The ones running spam operations aren’t on that list.
What the Buyers Do With It
The buyers at each stage of this pipeline have different use cases, and understanding those use cases explains why the spam you receive takes the specific forms it does.
Bulk email spammers purchase large unverified lists for broadcast campaigns — product promotions, phishing attempts, malware distribution. The per-record cost is low enough that even a tiny conversion rate generates revenue. The emails often appear to come from legitimate domains through compromised mail servers or spoofed headers, which is why spam filters catch some but not all of them.
Robocall and robotext operations purchase phone number lists, often enriched with geographic data to enable localized scams. ZeroFox documented a dark web forum posting in June 2025 in which a threat actor advertised “freshly scraped and verified” mobile numbers from over 20 companies, noting the data’s usefulness for social engineering attacks. These operations deploy automated dialers that can make thousands of calls per hour from rotating numbers, which is why call-blocking apps struggle to keep up.
Targeted phishing operations use enriched profiles — email plus name plus business category plus address — to craft personalized attacks that reference your business by name, your location, or your industry. These are significantly more convincing than generic phishing because they contain specific details that appear to confirm the sender knows who you are. The data behind that personalization came from the aggregation stage of the pipeline described above.
Lead generation operations resell contact data to businesses running legitimate marketing campaigns — telemarketing firms, direct mail companies, email marketing services. These buyers aren’t running scams, but they’re using the same data infrastructure that scammers use, and their campaigns contribute to the same overall spam volume. The legal and illegal markets share the same underlying data supply chain.
Why Removal Doesn’t Work
The standard advice for dealing with spam is to unsubscribe, request removal, or use a data removal service. That advice is correct as far as it goes — and it doesn’t go very far for contact data that entered the pipeline through website scraping.
Data removal services like Incogni, DeleteMe, and Privacy Bee work by submitting opt-out requests to data brokers that are legally required to honor them. In 2025, Incogni alone processed 245 million removal requests across 420+ databases. That is genuinely useful work. The problem is that it addresses only the databases that cooperate with removal requests — the legitimate end of the market. Spam operations running through encrypted channels and shadow market platforms are not on the opt-out list. They don’t have a removal process. They’re not required to have one, and they don’t care that you’d like to be removed.
There’s also the redistribution problem. By the time a removal service reaches your record at one broker, it may have already been sold to and redistributed across dozens of others. Removal is a process of draining a bathtub with the tap still running — useful, but limited by the rate at which new copies are created and distributed.
Every stage of the pipeline described in this article depends on one thing: your contact information existing as readable text in your WordPress site’s HTML source code. The scraper can only harvest what it can read. The aggregator can only enrich what the scraper found. The resale chain can only distribute what the aggregator collected. Protecting your contact data at the source — encoding or encrypting it so that it doesn’t exist as extractable text — is the intervention that stops the pipeline before it starts. It’s the only intervention that addresses the root cause rather than a downstream symptom.
What Source-Level Protection Actually Does
When WhoKnew Shield™ encodes your email address, what appears in your HTML source code is not an email address — it’s an encrypted string that your browser decodes for display but that a scraping bot’s regex pattern cannot match. The visitor sees a working email link. The bot sees noise. There is nothing to harvest, nothing to aggregate, nothing to sell.
The Pro tier adds site-specific encryption keys — meaning even if a sophisticated bot captures the encoded string, it can’t reverse-engineer the original address without a key that’s unique to your installation. Silent Contact™ rendering goes further: contact information is converted to a PNG image, eliminating the HTML text entirely. There is no string to capture at all.
The Scraper Trap™ honeypot system adds active detection on top of the passive protection. Hidden elements that legitimate crawlers never interact with identify scrapers the moment they trigger them. When WhoKnew Shield™ launched and we deployed it on our own WordPress sites, we caught 47 scrapers in the first 24 hours — automated tools that had been harvesting contact data from those sites continuously, invisibly, without any indication in standard security logs that anything unusual was happening. Most of them were operating through IP ranges we’d never seen flagged by any other security tool. They weren’t hacking. They were reading. And reading was all they needed to feed the pipeline.
Download the free version of WhoKnew Shield™ from WordPress.org and check what’s currently readable in your site’s HTML source. The free version includes dual-layer contact encoding and auto-detection across your entire site — no shortcodes, no manual configuration, no pages to remember to protect.
Spam isn’t random. It’s the downstream output of a commercial pipeline that starts with contact data being harvested from publicly accessible websites and ends with that data being deployed by operations that bought it for fractions of a cent per record. Understanding the pipeline changes the response from reactive (filtering, blocking, requesting removal) to proactive (preventing the data from entering the pipeline in the first place). The reactive tools are worth using. The proactive intervention is the only one that addresses the root cause.
Further Reading
- What Is Contact Scraping and Is It Happening to You? — the scraping stage of this pipeline explained in detail, with the signs it has already happened to your site.
- Good Bots vs Bad Bots: What’s the Difference? — why the bots running this pipeline ignore robots.txt and every other cooperative convention.
- What robots.txt Does (And Why Bad Bots Ignore It) — why the most commonly used bot management tool doesn’t stop the bots feeding this pipeline.
- What the Spam Epidemic Costs Small Businesses Each Year — the downstream financial consequences of the pipeline described in this article.
- Where Robocallers Get Your Number (And How to Stop Them) — the phone number side of the same data pipeline.
Who knew that the robocall at 8am and the spam text at midnight both traced back to the same automated bot that read your WordPress footer at 3am the night your site went live — and that the $331 billion industry behind it was already waiting.
