The Role and Identity of the Unknown Company in the Traffic Chain
Google Still Charging Advertisers for Conversion-Inflation Traffic from WhenU Spyware - Ben Edelman
As detailed in the main article and packet log, traffic flowed from WhenU's popup to WhenU's Mediatraffic server to an unknown server at IP address 184.108.40.206 to LocalPages, then onwards to Google and Google advertisers. This page discusses the identity of the operator of the 220.127.116.11 server.
The initial posting of my article attributed 18.104.22.168 to Nami Media. Throughout the period of research for the article, and continuing through midday on January 7, 2010, a HTTP request for 22.214.171.124 yielded an immediate redirect to Nami Media -- suggesting that 126.96.36.199 was a Nami server. However, on January 7, 188.8.131.52 began to redirect instead to Colo.com, a web hosting provider. No other fact ties Nami to this placement -- calling into question whether Nami in fact brokered traffic from WhenU to LocalPages.
The most natural sources of information provide little insight on the operator of 184.108.40.206. IP Whois references only Colo and its upstream connectivity provider, but not any individual customer using 220.127.116.11. Web searches on the IP address yield little insight; in-addr DNS yields no answer; and DomainTools reports no domains hosted on this server.
One possibility is that Colo itself is brokering the placement. The front page of Colo includes a link touting "Yellow Pages Listings by LocalPages.com" -- indicating a business relationship between Colo and LocalPages.
Another possibility is that an unknown party -- not Colo -- used Colo's hosting service to forward traffic from WhenU to LocalPages.
With the information available to me at present, I cannot distinguish between these possibilities. I therefore label this intermediary as "unknown."