Yes seen sites which depending the time of the day or country you come from, will display ok or malware page; further I even seen some in a skimmed blind network, which shows different page depending on http referer i.e., if you go to the domain from browser type in or google, it shows ok (so for network or anyone to check it), if it comes from a link in other site of network (and they got mirrored db of network sites to check from), it shows the bad page, this is evil for sure.
Trade traffic is interesting job but I prefer not to be into it
