How do sites end up on toxic domains?

Pretty much every site I've ever audited is listed on massively toxic domains like the globe.net or the globe.in or websearch.net on a page named "the world's most visited web pages". These are all link farms but it's uncanny that every customer I speak with swears blind they've never had anyone do dodgy link building for them, or paid for cheap blackhat SEO. Do these sites just scrape and crawl and automatically list as many sites as they can? I always disavow them anyway but it's always the same sites with the same format, sometimes referred to images rather than pages.