Every lead generation tool runs on two techniques: LinkedIn scraping and email guessing.

Three takeaways. Each row is a claim; the columns say what it means and what it rests on.

Claim	What it means	What it rests on
The industry runs on two techniques	Everywhere except China, the person comes from a LinkedIn profile and the email address is built from the format detected in the company's published emails, then checked against its mail server.	The mechanics are documented by the vendors themselves. That every vendor shares them is my reading as an operator.
The inputs are local	Where LinkedIn and corporate email are missing, the email-based machine stops. China rebuilt outbound on the business registry and the mobile phone; crypto has no equivalent foundation.	China is documented by Chinese press and vendor material. Crypto rests on practitioner and vendor sources.
Outside both, outreach goes generic	Small local businesses are reached through info@ addresses scraped from Google Maps. The inbox is less crowded, but none of the supporting tooling exists.	My own experience, plus vendor claims I cannot verify.

The lead generation market looks crowded: databases, email finders, verifiers, enrichment waterfalls and signal platforms, each with its own pricing and interface. Strip away the interface, however, and every one of them is doing some combination of the same two jobs.

Lead gen industry: two tech in one, but it's always the same tech.

The two jobs every lead generation product performs. Rows are the jobs; columns show the input, the usual method everywhere outside China, and the output.

Job	Input	Usual method	Output
1. Find the person	A target profile: industry, company size, job title, country	Search LinkedIn profiles, usually through Google results or scraping	Name, title, company and company website
2. Find the address	The name and the company website from job 1	Find the company's emails published online, detect their format, apply it to the person, then ping the mail server to confirm the mailbox exists	A work email that is likely to be delivered

Vendors differ in how they bundle and price these two jobs, not in the jobs themselves. That has a geographic consequence: the method only works where professional profiles are public and companies run their own email domains.

The sections below describe each job, show how the main vendors map onto them, and then look at three places where the inputs are different: China, crypto and small local businesses.

In business-to-business sales the person is almost always a LinkedIn profile, in every major market except China. For years the cheapest way to reach those profiles was Google rather than LinkedIn itself, through what recruiters call X-ray search: a query such as site:linkedin.com/in plus a job title and a city returns matching profile links. ^[1]

Tools then turn those links into a list. Boolean Strings documented the full sequence in 2024: run the Google search, collect the result links, upload them to an enrichment tool, and download names, titles and emails. ^[2]

Larger providers bypass Google and collect profiles directly, which LinkedIn contests in court. The record below shows both how central LinkedIn data is to the industry and how exposed that dependency has become.

LinkedIn's actions against profile collection. Rows are cases; columns give the period and the outcome.

Who	When	What happened
hiQ Labs	2017 to 2022	Won on the anti-hacking question but lost on LinkedIn's user agreement. Agreed to a $500,000 judgment, stopped collecting and deleted the data. [3]
Google results	January 2024	Google stopped showing the About and Experience sections of profiles. X-ray search still returns the link, with much less detail attached. [2]
Proxycurl	2025	Sued in January over fake accounts and millions of collected profiles, and shut down on 4 July. Its founder says it had reached about $10 million in revenue. [4]
Apollo and Seamless	March 2025	Company pages removed from LinkedIn on 7 March. Both kept operating, and Apollo's page has since been restored. [5]
ProAPIs	2025	Sued over millions of fake accounts. The complaint alleges customers paid up to $15,000 a month. [6]

Proxycurl is the clearest illustration. A business of roughly $10 million in revenue was built on a single website's data and closed within six months once that website objected.

The email is not guessed blind. The tool first looks for a few of the company's addresses already published somewhere online, on its website, in press releases or in directories, and detects the format they share, such as first.last@ or first initial plus surname.

It then assumes every employee follows that same format, builds the person's address accordingly and confirms it with a single check against the company's mail server. The method works because almost every company applies one format to all staff; if companies stopped doing that, the whole industry would struggle.

The mail server check confirms whether the mailbox exists without sending a message. ^[7] Hunter describes the same approach openly: it crawls more than 30 million web pages a day for addresses, learns each domain's pattern, and returns an "inferred" address where no public source exists. ^[8]

How an email address is inferred. Rows are the steps in order; columns say what happens and where it fails.

Step	What happens	Where it fails
1. Name and domain	Taken from job one.	The person may have changed jobs since the profile was collected.
2. Find published emails	Collect a few of the company's addresses listed publicly on its website, press releases or directories.	Small companies may have none published.
3. Detect the format	Work out the shared format, such as first.last@ or flast@, and assume everyone follows it.	Older addresses, acquired companies and personal exceptions break the assumption.
4. Mail record check	Confirms the domain receives email at all.	Rarely.
5. Ping the mailbox	Build the person's address with the format; the server answers yes or no for it.	Large providers block the check, and catch-all servers accept every address.
6. Send	The email goes out.	Bounces and spam complaints count against the sender's reputation.

The main weakness is the catch-all domain, a mail server that accepts messages for any address and therefore cannot confirm a guess. ZeroBounce counted more than a billion catch-all addresses among the 11 billion it checked in 2025. ^[9]

Some email finders estimate that 30 to 40% of company addresses sit on catch-all domains. ^[10] Since that estimate comes from vendors selling a solution, I treat it as an upper bound.

The two outputs also age at very different rates. A LinkedIn profile link is close to permanent, while a work email stops working when the person changes employer.

The profile link lasts; the work email does not

This explains why the industry stores the LinkedIn link as its permanent key and treats the email as something to be re-derived every few months.

Read against their own documentation, the major vendors differ mainly in where they source each job and what they sell on top. The underlying sequence of finding the person, then finding the address, is common to all of them.

Vendors mapped to the two jobs. Rows are vendors; columns show how each performs job one and job two, and what it adds.

Vendor	Job one: the person	Job two: the address	What it adds
Apollo	Public web collection plus third-party feeds, over 200 million records a month	More than 2 million users whose connected inboxes feed the database, plus verification	Sequencing and dialing [12]
ZoomInfo	Web collection and public profiles	Email signatures and contact books from users of its free Community Edition	Phone numbers, company data [13]
Hunter	Crawls the public web for addresses	Learns the domain pattern, infers and verifies	Shows its sources [8]
Clay	No database of its own	Queries 75 to 150 providers in sequence until one returns a verified address	Orchestration [14]
Proxycurl (closed)	LinkedIn only	Sold profile data to the finders	Showed the dependency [4]
Google Maps scrapers	Business listings rather than people	Crawl the business website, generic addresses first	Local coverage [15]

Clay's figures illustrate the point. A single provider typically finds 40 to 60% of emails on a list, and a sequence of three finds 80% or more. ^[14] Combining providers improves coverage because it runs the same two jobs against several overlapping databases.

The genuine exception is the contributory network, in which users donate their inbox data in exchange for free credits. It is a third source, and I return to it under where this breaks.

China is the one large market where both inputs are missing. LinkedIn suspended its main app in mainland China in 2021 and closed InCareer, its jobs-only replacement, on 9 August 2023, cutting 716 roles. ^[16]

LinkedIn still reported more than 60 million members in China that year. ^[17] Usage was far lower, and local platforms had taken the market.

LinkedIn's last China app against the local platforms

The obvious candidate for a Chinese LinkedIn is Maimai, with about 120 million registered and 35 million monthly users by its agency's count. ^[19] I found no prospecting tool built on Maimai profiles in the way tools everywhere else are built on LinkedIn.

Outbound in China exists nonetheless, and at scale. It is built on two different inputs: the national business registry, which names every company's legal representative, and the mobile phone number.

Tungee, backed by Sequoia China, Qiming and Alibaba, claims a database of more than 180 million companies and offers call center, text message and email outreach on top of it. ^{[20] [21]} Its chief executive has said that at mature Chinese business-to-business companies roughly 70% of revenue comes from outbound prospecting. ^[22]

The two jobs in China and in the rest of the world. Rows are the components of an outbound system; columns compare the two.

Component	Rest of the world	China
Job one: the person	LinkedIn profile	Business registry record and its legal representative, plus recruitment sites, trade fair lists and tender portals
Job two: the address	Inferred work email, checked against the mail server	Mobile number matched to the legal representative; vendors claim verification against carriers' real-name records
Main channel	Email sequences	Phone, including automated dialing, and text messages; WeChat once contact is made
Example vendors	Apollo, ZoomInfo, Hunter, Clay	Tungee (180 million companies); Tankecha (200 million companies, 1 billion contacts); Lixiaoyun (270 million companies, 530 million contacts)
Legal position	Mostly tolerated as business contact data	Under scrutiny: lawyers cite the Personal Information Protection Law and the criminal offence of selling personal information

National Business Daily found working mobile numbers for several of China's best-known entrepreneurs on two of these platforms, priced at fractions of a cent per record. ^[23] One of the platforms also offered automated dialing systems capable of about 1,000 calls a day each.

So China confirms the structure of the argument while correcting its first version. The two jobs remain the same, but the inputs are the registry and the phone rather than the profile and the email, and the channel moves accordingly.

For foreign sellers the domestic machine is largely out of reach. Cold email from abroad performs poorly, and practitioners point instead to trade fairs, introductions and WeChat follow-up after an in-person meeting. ^{[24] [25]}

Crypto has no outbound (no LinkedIn).

Crypto founders operate mainly on Telegram, X and Discord, often under a pseudonym. There is no profile to collect, frequently no corporate email domain, and no registry record that links a person to a project.

Business development job listings in the sector name Discord, Telegram, X and Farcaster ahead of LinkedIn. ^[26] The sales tools that exist are small and built around Telegram, and much of the case for them comes from the companies selling them. ^[27]

The outbound map. Rows are buyer segments; columns show the identity source, the contact route and the maturity of the tooling.

Segment	Who to find	How to reach them	Outbound tooling
Professionals outside China	LinkedIn profile	Inferred and verified work email	Mature: finders, verifiers, sequencers, deliverability
China, domestic sellers	Business registry record	Mobile number, then WeChat	Mature, legally contested
China, foreign sellers	Trade fairs, introductions	WeChat after meeting	Little usable tooling
Crypto	Telegram and X handles	Direct message	Thin and largely manual
Small local business	Google Maps listing	info@ from the website	Scrapers, little else

Non-professional buyers, such as small local businesses, are reached through a different route. The contact is a generic address like info@, found through the Google Maps listing and the business's own website.

The scrapers that serve this segment collect the listing, crawl the linked website for addresses, and rank generic addresses such as info@ and office@ first. ^[15]

Sometimes it works even better due to lack of competition. Mostly it doesn't work, because there is not the whole system built around it.

That is the pattern I have seen up close. It is one operator's observation rather than a measured result.

The standard stack compared with info@ outreach. Rows are what a campaign needs; columns compare the two approaches.

What a campaign needs	Inferred work email	info@ from Google Maps
Who reads it	The named person	Whoever checks the shared inbox
Verification	Per person, at mailbox level	The inbox exists; the reader is unknown
Targeting data	Title, seniority, company signals	Category, reviews, website
Competition in the inbox	Heavy	Light
Tooling around it	Sequencers, signals, warm-up, routing	A scraper and a spreadsheet

The competition on the standard stack is measurable. Average cold email reply rates have fallen by more than half since 2019 across the main published benchmarks.

Average cold email reply rates

Vendors of Google Maps scrapers claim reply rates of 5 to 15% on local businesses. ^[30] I cannot verify those figures, and they come from the seller.

Inbox providers have also raised the standard for the email route. Since February 2024, Gmail and Yahoo require anyone sending 5,000 or more emails a day to authenticate, offer one-click unsubscribe and keep spam complaints below 0.3%. ^[31]

Verification, warm-up, deliverability monitoring and buying signals were all built for the inferred work email. Very little of that tooling exists for generic addresses, which is why info@ outreach rarely scales even when individual campaigns perform well.

Behind the many brands, lead generation everywhere outside China comes down to two techniques. Vendors scrape LinkedIn profiles, often through Google search results, to find the person, then find the company's published emails, detect their format, assume everyone follows it and confirm the person's address with a ping to the mail server.

Everything else, from waterfalls and verifiers to sequencers and deliverability tools, is built on top of those two steps. That is why the products look different but return largely the same data.

Both techniques rest on conditions the vendors do not control. LinkedIn can restrict access to profiles, and if companies stopped giving every employee the same email format, the second technique would no longer work.

The same dependency sets the limits of the market. Where LinkedIn or company email is missing, the machine stops: China rebuilt outbound on the business registry and mobile phones, crypto selling stays manual on Telegram and X, and small local businesses are reached through info@ addresses with no supporting tooling.