Which SEO Did WhenU Use? The Best Inference: Synergy6
WhenU Spams Google, Breaks Google "No Cloaking" Rules - Ben
Edelman
[ Motivation - Findings - Conclusions - Other Synergy Practices - Responses - Full HTTP Logs ]
As discussed in WhenU Spams Google, WhenU attributes its cloaking and other prohibited sites to "an outside search engine optimization firm based in New York." (See c|net article quote from WhenU CEO.)
It is therefore of interest to detmermine which outside SEO WhenU hired. It is necessary to know which SEO WhenU hired in order to attempt to confirm (by asking the SEO) whether the SEO acted in accord with WhenU's instructions, or whether the SEO went beyond what WhenU requested and/or authorized. Knowing which SEO did the cloaking is also of interest in order to seek out other search engine optimization sites that might violate search engines' listing rules.
I have observed that most or all of WhenU's cloaking domain names share their web servers (i.e. their IP addresses) with other domain names. For example, whenushop-advertising-central.com and blackjack-on-the-web.com both use 209.10.79.72, and savenow-popup-ads.com and best-website-hosting-network.com both use 209.208.179.226. Indeed, most or all of the other WhenU cloaking sites use IP addresses within these or nearby IP address blocks.
Using a HTTP client that sends a HTTP Referer header of a Google URL, I confirmed that requests for the default web page on blackjack-on-the-web.com yield a redirect to the following URL:
http://wireless.freeze.com/cingular/synergy6f/?&engine=www.google.com&search=cellphone
The same redirect URL results from requests for the default page on best-website-hosting-network.com, and from the default pages on most or all other domain names that share IP addresses with the WhenU cloaking sites.
The destination URL format used here is precisely the same as that used on WhenU's cloaking sites. (Compare with HTTP logs of WhenU's cloaking, which used the same ?&engine=...&search=... syntax for their destination URLs.)
I see strong evidence to support the inference that Synergy6 is the SEO that performed cloaking services on WhenU's behalf.
Notice the "synergy6" text embedded within the redirect destination URL. This text represents an attempt to track how many users reached the destination Freeze site via the cloaking site at blackjack-on-the-web.com. An SEO's performance is often measured according to the volume of traffic it products. A SEO's destination URL therefore often includes its name, or other identifiers associated with the SEO, to allow the site to recognize the SEO's traffic. According to the destination URL found here, there is reason to think that "syngergy6f" (or similar) might be the name of the responsible SEO.
According to synergy6.com, Synergy6 is an online advertising firm that offers search engine marketing services. Consistent with WhenU's statement of using a SEO based in New York (see c|net article), Synergy6's contact page gives an address in New York.
So far, I have devised one scenario that makes the facts described above consistent with WhenU hiring an SEO other than Synergy6: Suppose WhenU hired some SEO (call it "SEO X") to perform cloaking for WhenU. Separately, suppose that rather than performing cloaking on its own, Synergy6 hired another SEO (call it "SEO Y") to perform cloaking for Synergy6 and its clients. If SEO X is the same company as SEO Y, or if SEO X in turn hired SEO Y, I would observe the same facts described above, but WhenU would not have hired Synergy6. However, this scenario adds substantial additional complexity, while the simpler story (WhenU hires Synergy6) fits the facts equally well and is equally consistent with WhenU's statements to date as to its choice of SEOs ("... based in New York"). In any event, a response from WhenU and/or Synergy6 -- which I expect will be forthcoming -- should clear up this question.
Other Synergy6 Practices and Other Synergy6 Cloaking Customers
The findings above suggest that Synergy6 may be using cloaking for other clients too, e.g. freeze.com wireless. See the HTTP logs (below), comparing the results of requesting best-website-hosting-network.com with and without a HTTP referer.
This is not the first prohibited behavior with which Synergy6 has been alleged to be involved. In December 2003, the attorney general of the state of New York and Microsoft sued Synergy6 for sending out junk email. See Microsoft Spam Litigation Case Fact Sheet, and coverage at Techweb, MSNBC, and c|net. According to Search Visibility Report, Synergy6 denies the spam charges.
Responses from Synergy6 and WhenU
To date I have received no responses to these findings, either from Synergy6 or from WhenU.
Archive of HTTP transmission log for a request for best-website-hosting-network.com, with HTTP Referrer tag indicating a Google search:
GET / HTTP/1.1
Host: www.Best-website-hosting-network.com
Connection: close
Referer: http://www.google.com/search?q=cellphone
User-Agent: Sam Spade 1.14HTTP/1.1 302 Found
Date: Sun, 16 May 2004 18:34:51 GMT
Server: Apache/1.3.26-Fil (Unix) PHP/4.0.6
X-Powered-By: PHP/4.0.6
Location: http://wireless.freeze.com/cingular/synergy6f/?&engine=www.google.com&search=cellphone
Connection: close
Transfer- Encoding: chunked
Content-Type: text/html
Archive of HTTP transmission log for a request for best-website-hosting-network.com, without a HTTP Referrer tag:
GET / HTTP/1.1
Host: www.Best-website-hosting-network.com
Connection: close
User-Agent: Sam Spade 1.14HTTP/1.1 200 OK
Date: Sun, 16 May 2004 20:35:14 GMT
Server: Apache/1.3.26-Fil (Unix) PHP/4.0.6
X-Powered-By: PHP/4.0.6
Connection: close
Transfer-Encoding: chunked
Content-Type: text/htmle53
<HTML>
<HEAD>
<TITLE>Shop for Website Hosting Online</TITLE>
[rest of web page omitted]
