Contact and lead harvesting in Classifieds marketplaces

How the attack works

1. The harvester opens listing contact details through the phone-number reveal, email or enquiry route, seeking information that helps a genuine buyer reach the lister.
2. It repeats contact requests across many adverts, gathering details from categories such as property, vehicles or local services without a genuine intention to enquire.
3. The collection is spread across sessions and networks so that an individual client appears to request only a small number of contacts.
4. The extracted details are assembled for unsolicited outreach, spam or phishing, separating the information from the context in which the lister chose to publish it.
5. Listers receive unwanted calls or messages and report the experience, while the platform must reconstruct which contact routes were accessed and how widely collection occurred.

Why it gets through

A classifieds service needs to make contact possible. Listers publish an advert because they want the right person to reach them, and a contact reveal or enquiry action is often part of the normal journey. That necessary access becomes valuable to harvesters when the same route can be requested repeatedly across a large pool of adverts.

Hiding details behind a button changes their presentation but does not by itself establish the purpose of the client requesting them. Automation can still reach the underlying contact route. If controls consider each address separately, distributed requests may remain below a simple volume threshold while the combined activity collects a much larger set of phone numbers or email addresses.

Genuine users sometimes compare several listings before contacting the right person. Approved partners may also have a defined reason to access listing information. Protection therefore needs to consider repeated request activity and the business’s access rules, rather than making all contact requests difficult or assuming that every session without an account has an unwanted purpose.

The lister churn rate can rise when unwanted calls and messages outweigh the value of genuine interest. Users may remove an advert, hide contact details or take their next listing elsewhere. The business then loses supply because a feature intended to make contact easier has become a source of nuisance or risk for the people providing it.

Contact-misuse report volume creates work across support, moderation and engineering. Teams must investigate which information was exposed and explain what they can establish about later use. Keep these reports connected to the available request evidence, without assuming that the platform can observe every call, message or onward transfer after contact details have been collected.

The qualified enquiry rate becomes less useful if contact reveals and form submissions are treated as meaningful interest by default. A lister may appear to receive strong demand while few approaches become credible conversations. Use available enquiry outcomes and lister feedback to distinguish that experience from healthy comparison shopping before evaluating whether contact access is working well.