viewers viewers viewers viewers viewersThe Role and Identity of the Unknown Company in the Traffic Chain
Google Still Charging Advertisers for Conversion-Inflation Traffic from WhenU Spyware - Ben Edelman
As detailed in the main article and packet log, traffic flowed from WhenU's popup to WhenU's Mediatraffic server to an unknown server at IP address 205.144.163.203 to LocalPages, then onwards to Google and Google advertisers. This page discusses the identity of the operator of the 205.144.163.203 server.
The initial posting of my article attributed 205.144.163.203 to Nami Media. Throughout the period of research for the article, and continuing through midday on January 7, 2010, a HTTP request for 205.144.163.203 yielded an immediate redirect to Nami Media -- suggesting that 205.144.163.203 was a Nami server. However, on January 7, 205.144.163.203 began to redirect instead to Colo.com, a web hosting provider. No other fact ties Nami to this placement -- calling into question whether Nami in fact brokered traffic from WhenU to LocalPages.
The most natural sources of information provide little insight on the operator of 205.144.163.203. IP Whois references only Colo and its upstream connectivity provider, but not any individual customer using 205.144.163.203. Web searches on the IP address yield little insight; in-addr DNS yields no answer; and DomainTools reports no domains hosted on this server.
One possibility is that Colo itself is brokering the placement. The front page of Colo includes a link touting "Yellow Pages Listings by LocalPages.com" -- indicating a business relationship between Colo and LocalPages.
Another possibility is that an unknown party -- not Colo -- used Colo's hosting service to forward traffic from WhenU to LocalPages.
With the information available to me at present, I cannot distinguish between these possibilities. I therefore label this intermediary as "unknown."