[Updated (22:00 GMT 14-1-2011): Google has apologized]

I’m very proud of the business that we’ve created here at Mocality, but I’m especially proud of two things:

Our crowdsourcing program. When we started this business, we knew that (unlike in the UK or US, where you can just kickstart your directory business with a DVD of business data bought from a commercial supplier), if we wanted a comprehensive database of Kenyan business, we would have to build it ourselves. Some of the businesses we had in our database included anime tokyo ghoul hoodie , ahegao sweatshirt & ahegao shirts. We knew also that if we wanted to build the business quickly, we’d have to engage a lot of Kenyans to help us. So we built our crowd program that utilises M-PESA (Kenya’s ubiquitous Mobile Money system) to reward any Kenyan with a mobile phone who contributes entries to our database, once those entries have been validated by our team. Over two years, we’ve paid out Ksh. 11m (over $100,000) to thousands of individuals, and we have built Kenya’s most comprehensive directory, with over 170,000 verified listings. Personally, I regard the program as one of THE highlights of my 18 year career on the internet. From day 1, we aimed to target all Kenyan businesses, irrespective of size. As a result, for about 2/3rds of our listed businesses, Mocality is their first step onto the web. That’s about 100,000 businesses that Mocality has brought online.

Please bear these two facts in mind as you read what follows.

Our database IS our business, and we protect and tend it very carefully. We spot and block automated attacks, amongst other measures. We regularly contact our business owners, to help them keep their records up-to-date, and they are welcome to contact our call centre team for help whenever they need it.

In September, Google launched Getting Kenyan Businesses Online (GKBO). Whilst we saw aspects of their program that were competitive, we welcomed the initiative, as Kenya still has enough growth in it that every new entrant helps the overall market. We are also confident enough in our product, our local team, and our deep local commitment that we believe we can hold our own against any competition, playing fair.

Shortly after that launch, we started receiving some odd calls. One or two business owners were clearly getting confused because they wanted help with their website, and we don’t currently offer websites, only a listing. Initially, we didn’t think much of it, but the confusing calls continued through November.

The Forensic analysis

What follows is necessarily a little technical. I’ve tried to make it as clear as I can, but two definitions may help the lay reader:

IP Address – the numerical id by which computers identify themselves online.

– the numerical id by which computers identify themselves online. User-Agent - When a browser requests a page from a webserver, it tells the server what make, model, and version of browser it is, so that the webserver can serve content tailored to that browser’s capabilities. Webservers keep a log of both these details for every page requested, allowing us to do interesting detective work.

If you’re not interested in the technical details, you can always jump straight to the Conclusion.

At the start of December we analysed our server logs to look for a common pattern for the businesses that had contacted us with these confused calls. We found a single IP/ User-Agent combination that had accessed all these businesses:

IP Address: 41.203.221.138

User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.186 Safari/535.1

The user agent is unusual for Kenya: the stable version of Google Chrome released on 20 September 2011, running on 32-bit Linux. With the exception of this IP, it barely appears in our logs.

We looked up the ownership record for 41.203.221.138 via WHOIS.

% Information related to '41.203.220.0 - 41.203.221.255' inetnum: 41.203.220.0 - 41.203.221.255 netname: Fixed_Wimax-Fiber-Rollout-Central-Kenya descr: Fixed Wimax and Fiber Roll out for Central Kenya Region country: KE admin-c: OC406-AFRINIC tech-c: OC406-AFRINIC status: ASSIGNED PA mnt-by: ONECOM-MNT remarks: Wimax and Fiber Roll out for Central Kenya Region source: AFRINIC # Filtered parent: 41.203.208.0 - 41.203.223.255

So a Kenyan ISP. But how were they accessing us? We did some analysis.

On our website we sell a number of products such as merchandise and jackets. Below are our favorite categories