You forgot to mention it involved paid whitelisting, and the requirements for compliance were so weak that even major malvertising vectors, like Google, were considered acceptable.