In my experience, 80% of bans at project launch have nothing to do with message copy or warm-up - they come from where the list was sourced. Scraping open groups and buying ready-made lists is the fastest path to a flood block within 48 hours. Here is the full map, from safe sources to outright account killers.
WhatsApp evaluates not only what you send, but the sender's behavioral profile relative to recipients. If an account suddenly messages hundreds of numbers with no prior interaction - no inbound messages, no saved contact, no chat history - the algorithm flags it as an anomaly.
Technically, each send checks the sender–recipient pair against the contact graph and message history. A cold number from scraping or a purchased list is an isolated node. The more such nodes in a short window, the higher the sender's risk score.
In practice: the same 500-recipient blast can run smoothly on a CRM export - order history, sometimes support chats - and destroy an account on 500 numbers scraped from Telegram groups.
We tested outreach for a clinic: 100 numbers from a website booking form with SMS verification. Three reports - normal background noise, account held. By complaint metrics, that is already elevated attention, but not an automatic ban with this source.
In parallel, the same clinic ran 100 numbers bought from a "regional medical clinic database broker." Result: 11 reports in two hours and a shadow ban - messages delivered but not read, the classic ShadowBan pattern.
The copy was identical. The difference: recipients in the second run never gave their number to that company and treated the message as spam from a stranger.
| Source | Legal risk | Account risk | List quality |
|---|---|---|---|
| CRM/ERP export | Low (with consent) | Low | High |
| Offline cards, loyalty | Low | Low | Medium–high |
| Forms with SMS verification | Low | Low | High |
| Pop-up without verification | Medium | Medium | Low (noise) |
| Purchased/rented lists | High | Very high | Low–unpredictable |
| Open-group scraping | High | Critical | Unpredictable |
| Business registries | Medium | Medium | B2B-specific |
Before: "We need a list fast for launch - we'll buy regional business-owner numbers and pitch our service."
After: mass reports on day one because numbers never interacted with the company, plus stale entries or numbers not on WhatsApp. Ban, lost number, reputational damage to IP and device in a multi-account setup.
Fix: same budget into a landing page with a lead magnet and SMS confirmation. Slower volume, but every number already interacted with the brand, and communication consent is logged.
Scraping numbers from open groups, chats, and directories via Selenium, Puppeteer, or cloud tools is possible - but adds two risk layers at once.
First, behavioral: cold numbers with no history. Second, the scraping activity itself. Scripts hitting WhatsApp Web or APIs produce request patterns unlike normal use: fixed intervals, no human noise - typos, pauses, chat switching. Session fingerprinting catches this, same as typical bulk services, before the blast even starts.
Practical takeaway: use scraping to enrich an existing list - find a company number in a public directory for a targeted B2B touch - not as the main channel for mass outreach lists.
Buying lists is not always an absolute "no." Condition: segment the list and validate WhatsApp attachment before upload.
If the vendor cannot show live WhatsApp percentage or offer a test segment - the list was likely scraped or is stale. Even "good" sellers rarely deliver more than 30–40% usable WhatsApp numbers after validation.
If you already bought a list:
In markets with personal-data law - EU, Russia, CIS analogues - outreach without logged consent is not only a ban risk but a fine risk if a recipient complains to a regulator.
Minimum workable consent standard:
This is not bureaucracy for its own sake - under mass complaints, the consent log separates a temporary rate limit from a permanent ban.
Before your next blast, audit the list: what share came from verified forms vs scraping or purchase. If "cold" sources exceed 20–30% of one send volume - split into separate pools and test the cold segment in small batches from a warmed account.
Practical rule:
A list is not an asset by volume - it is an asset by interaction history. One number that has seen your company once is worth more than a thousand scraped entries.
