isn't the whitelist bound to the user? i mean if i register account as a publisher on some ad exchange, i should be asked for domains where i will be showing my ads. in that case i can not simply report that my username is generating traffic from cnn.com f.e. as this domain is not associated with my account. or this is not how it works?

Got it. So preventing domain spoofing would solve this problem. Who's job is that?