added to SpamHaus DBL

[Note: As of 7/11/2012 has been removed from the SpamHaus DBL]

Many people were surprised when and the related group of 20 or more websites stopped promoting pump and dump stock Great Wall Builders (GWBU). The last email I received from was at 2:30pm EST on June 24th. Just yesterday I saw a mention of a blog post by a noted spam fighter posted on the iHub Fraud Research Team / Due Diligence message board (the only good message board on iHub). The blog post is the SpamBouncer MainSleaze blog.

The post itself is fairly ordinary — a spam fighter indicated that an email address used only to check for spam received email from The blog post is also fairly old: it was posted on June 5th. The comments are the interesting part. Andrew Barrett, a higher-up at iContact (Director, ISP Relations & Deliverability) replied the same day, saying:

 Thanks for the heads-up, Catherine. I’m in Berlin at the moment, but I’ll have our compliance team drop a hammer.

Then there are a few comments from “centroazteca”, purportedly written on behalf of (Centro Azteca S.A. is the entity listed at the bottom of their emails). Those comments are quite funny, especially where “centroazteca” writes, “We work with large companies such as Goldman Sachs, and only profile legitimate small companies who are looking to succeed.”

The first reply from “centroazteca” was posted on June 23rd, presumably as the people behind realized that Spamhaus Block List was about to add their domain name to its list of domain names that it recommends that email providers not accept emails from (see an explanation of how blocklists work). On June 24th, Andrew Barrett posted the following comment on the blog post:

Hi Catherine,  I have killed the account. I apologize for the length of time it has taken to correctly and permanently remediate the issue. I will be working with management to identify all the points at which our processes broke down, and to correct them.  All the best, Andrew.

The blogger then asked why “centroazteca” had shown up three weeks after the blog post to comment, and Barrett responded by saying:

Well, I hate to name names, but it rhymes with “Spamhaus”

Tom Mortimer of Spamhaus replied to that comment (bold added):

SBL listings are public record, Andrew. It’s quite alright with us if you name names, although we do appreciate the discretion on other issues.  Speaking of which, there were some other issues than simple spam in this case. I can’t go into detail, but suffice it to say that this was most certainly a customer that no reasonable ESP or ISP would want on their network. :/

Right before posting this blog post, I checked the Spamhaus block list and found that is listed as being on the list (marked as a spammer). However, none of their other domain names or IP addresses of which I am aware appear on the list. Check here to see if it is still on the list. I think it is likely that having their main domain name added to the Spamhaus block list forced to change internet hosting providers and judging from Barrett’s comments it is likely they are being forced to find a new email service provider.

A cursory check of a few of the websites of shows that the welcome emails they are currently sending to new subscribers are being sent using, which is further evidence that iContact is no longer doing business with them.

Consider the timing of the last pump email on GWBU and the comment from Andrew Barrett. I do not think it is a coincidence that and related websites have not sent any emails since Barrett wrote that he had “killed the account”. This is an interesting development and may mark a turning point in the effort to fight pump and dumps.

Disclaimer: No relationship with any parties named above (except that I trade pump and dumps) and no positions in any stocks or funds mentioned. This blog has a terms of use that is incorporated by reference into this post; you can find all my disclaimers and disclosures there as well.



15 thoughts on “ added to SpamHaus DBL”

  1. Good morning,

    We’ve experienced some staff and leadership turnover following VOCUS, Inc.’s acquisition of iContact, which played a role in the delay of managing the issue. At the end of the day, however, the fault is wholly mine that they were allowed to continue to send for days and weeks following the initial warnings on Mainsleaze.

    However, I am quite pleased with the end result. Our new management in this incident sends a strong message that this kind of activity will not be tolerated on our application, regardless of the impact on revenue that terminating a large client like this will have.

    iContact has worked very hard over the last year or more to improve its standing within its industry niche, and I am gratified to see that management intends to continue along that same path.

    Andrew Barrett.

    1. Indeed. From our point of view, IContact dealt with the spam issue with its usual dispatch. I’m glad to hear that whatever was causing the delay has been resolved and a direction set against allowing spam and abuse on IContact.

  2. Your block sent a pingback to mine yesterday evening. I just got around to reading it thoroughly this morning. So is known to the penny stock and small trader community as well? I should have realized that this might be the case. :/ It’s odd that the blog with by far the longest comment chain on MainSleaze wasn’t on-topic: it appears that isn’t an “otherwise legitimate company”, at least not as we define the term. (Stock pumping is *not* a legitimate product or service.) But if I’ve helped shine a spotlight on something that needed the light of day, then good.

    Although isn’t really within the scope of the MainSleaze blog, it is definitely within the scope of Spamhaus, other blocklists and reputation services, and (perhaps most important) ISPs and ESPs that host it. You would do everyone a favor, I think, if you would post a list of the domains, IPs, and names that this entity uses, either here or over on MainSleaze. I’ve sent a note to a contact I have at AWeber with links to both blogs. That should get the information in the right hands.

    1. Thanks Catherine. I would certainly agree that (APS) is not a legitimate business as most people would define it, although stock promotion per se is not illegal. I have just created a Google Document with all their websites and IP addresses:

      I should note that I have not personally been spammed by any of these — I opted in to all of them.

      1. Excellent. This should give small ESPs and ISPs information that they can use to identify this spammer and block his abuse of their services, and perhaps provide Spamhaus with some pointers as well. 🙂

        My mother worked in a bank for years, and made a nice pile of money investing in stocks. 🙂 I don’t consider stockbroking or stock promotion illegitimate businesses. I do consider stock *pumping* illegitimate, and as far as I know, it is also illegal in the U.S. and many other countries.

        But my personal concern is primarily about spam. Since you requested this guy’s email, what you received isn’t spam to you. Since my spamtrap did not request it, it was spam to the spamtrap. I rather suspect that a number of spamtraps were on the guy’s list, although not the numbers that would be on the lists of most stock pumping spammers that I’ve encountered previously. Perhaps this person recognized that botnet spam methods, which rely in sending huge volumes of spam to overwhelm spam filters and defenses and get a little bit through, are not a good idea when your “product” is illegal or immoral and law enforcement agencies and governments have shown interest.

        Thanks for the additional information!

  3. Just to note it here, here is some history on and related websites and direct links to several prominent penny stock promoters:

    Past legal entities that owned various APS websites include:
    Free Penny Alerts LLC, based in Delaware,
    Golden Dragon Media Inc, based in Quebec,
    Marketing Integrale Inc., purportedly based in Quebec, but no legal entity with that exact spelling exists in Quebec.

  4. is no longer on the SpamHaus DBL. Furthermore, their various websites seem to now be using and requiring double opt-in (rather than single opt-in as they had previously done).

  5. Excellent job as always, Michael! It seems APS–though not all the affiliates–now has a new mailing company handling their business. Today a few people seem to have received “alerts” for GWBU. Again. I haven’t seen images posted anywhere.

  6. Kudos to iContact and SpamHaus for doing what my colleagues south of the border haven’t yet.

    There are several other less obnoxious stock promoters/spammers who also disseminate via iContact, StockPublisher (Boca) for one. Perhaps that can be looked at later on.

    There was an excellent article in the News and Observer (NC) several months ago on the founders of iContact. They sound like savvy, innovative, and ethical young businessmen.

Leave a Reply

Your email address will not be published. Required fields are marked *

Please complete the formula below to prove that you are human * Time limit is exhausted. Please reload CAPTCHA.

This site uses Akismet to reduce spam. Learn how your comment data is processed.