Crackdown looms for web 'typosquatters'

To those who've tried to garner Internet traffic for a web site using any gimmick available, it may seem too good to be true. But there is a way to create a popular web site overnight: You can just buy the traffic. That's what Quantum Leap Media specializes in.

For example, web traffic analyst PC Data, Inc. says an obscure financial news services web site named OTCStreet.com had more traffic in August than BusinessWeek.com and nearly as much as Forbes.com and Nasdaq.com. OTCStreet is hardly more than a shell of a page; it offers free e-mail "for the serious investor" and a few news links. Despite that shallow content, between July and August, traffic to the site jumped from about 200,000 unique visitors to nearly 600,000.

How did OTCStreet accomplish this amazing growth? It has been the beneficiary of Quantum Leap Media's "traffic hose."

Quantum Leap is a 'typosquatter,' one of several firms that appear to be controlled by the same individuals. Collectively, they own hundreds of web site domain names that are a slight variation of the Web's most popular brands -- sites like www.hotmail.com. According to a former employee, the firms can "turn on the traffic hose and send as much traffic as web sites want."

During July and August, according to information on Quantum Leap's web site, about 200,000 clicks per day were being redirected from the firms' farm of typosquatted domains toward other sites, most headed for OTCStreet.

There's nothing illegal about redirecting web traffic that's the result of a surfer's typographic errors, and some argue that it's just a clever business strategy. But two former employees of Powerclick, Inc. and some of the firm's clients say activities inside that typosquatting farm went far beyond redirected traffic. A source at one of Powerclick's victims, who requested anonymity, said his company had reported Powerclick to the FBI. Jeff Duffett, a former Powerclick consultant, was interviewed by the FBI on Tuesday. The FBI investigator whom Duffett spoke with refused to comment on the matter.

Powerclick and Quantum Leap now admit some of the unseemly activity took place, but they say the two employees acted on their own and have sued both for fraud and conspiracy.

In perhaps the most dramatic example, an employee of the company sent out spam mail to investing bulletin boards touting a stock that the company had recently received as payment.

A Quantum Leap-affiliated web site named TickerProfiles.com "featured" a firm named WSI Interactive in November of last year. The web feature was still live on the Internet on Monday and indicated nearly 274,000 people had visited the TickerProfiles page devoted to WSI since Nov. 25, 1999.

In its disclosures section, TickerProfiles.com said it received 120,000 shares of WSI in exchange for publication of the profile. Richard Cushing, who works in investor relations for WSI, told MSNBC.com his company never paid TickerProfiles for the feature but could not explain why the disclaimer on Tickerprofiles' site asserted otherwise. After the MSNBC.com inquiry, the profile and disclosure were removed from the site.

Two months later, on Jan. 24, hundreds of notes were posted to Raging Bull, Inc. investing bulletin boards calling attention to WSI stock. The simple note linked back to TickerProfiles and read: "WSI Anyone know anything about this one? WIZZF Their start looks similar to CMGI. www.tickerprofiles.com/
profiles/wsi/index.shtml."

According to one observer on a Raging Bull bulletin board, the note was sent to "literally every board found under that keyword [technology], more than 300!"

Former employee Duffett said he had opened more than 2,000 user accounts at Raging Bull and used a computer program to send the spam out with different user names to disguise the fact that it was a mass mailing. He provided a database of those user names to MSNBC.com, and most appeared to still be active at Raging Bull.

A spokesperson for Raging Bull said multiple notes written by members with user names Duffett provided to MSNBC.com had been deleted in the past year but refused further comment.

It is impossible to say what, if any, influence the spam had on the stock. That day the stock rose 25 percent on Wall Street, and on Jan. 25 it rose 42 percent more. Also on Jan. 25, one day after the spam, trading in the stock was temporarily halted on the Canadian Venture Exchange. By day's end, it had climbed about 50 percent in that market.

The jump could be unrelated to the spam. By March, on Wall Street, WSI Interactive rose to nearly $5, then fell back down below $1. That rise is likely connected to press releases issued by the company during the period.

Duffett told MSNBC.com he posted the January notes at the instruction of Dom Einhorn, an executive of both Powerclick and Quantum Leap. Einhorn did not respond to e-mails, but Quantum Leap attorney Jeff Shumway said Duffett was acting on his own when posting the note.

He added that he didn't learn of the incident until this summer, and Duffett was fired soon after.

Duffett told MSNBC.com he never owned any WSI stock and did not benefit from the rise in the stock. Shumway also said neither he nor Einhorn had ever owned WSI stock.

Shumway, meanwhile, asserts that Quantum Leap does not own or operate TickerProfiles; however, a Quantum Leap logo appears at the bottom of TickerProfiles.com, and the domain name is registered to Quantum Leap Media.

There was at least one other incident where Duffett says Einhorn instructed him to post hundreds of notes about a penny stock on Raging Bull. On Sunday, July 23, the following note, calling attention to a recently announced merger, was posted multiple times: How will this merger affect the stock?. SBAQ www.hollywoodbroadcasting.com/
investor_page/press.html

According to other posts on the bulletin boards, the note was posted about 700 times during that weekend.

Duffett provided an e-mail to MSNBC.com which appeared to be sent to Duffett by Einhorn on July 20. That e-mail read: Jeff, Here is the link we need for the boards Dom www.hollywoodbroadcasting.com/
investor_page/press.html.

When asked about the e-mail, Shumway said, "We have significant reason to believe that the purported e-mail is a fake."

Prior to this incident, there appears to have been some kind of business dealings among Powerclick and Sunburst Acquisitions IV Inc. (whose ticker symbol is SBAQ), Hollywoodbroadcasting.com and WSI Interactive, the companies that appear in the separate Raging Bull postings.

In March of this year, WSI sold a web site property named Stocksecrets.com to a firm named InternetFinancialCorp.com. In a March press release, InternetFinancialCorp.com listed the same Sunset Boulevard address as HollywoodBroadcasting.com -- which was later acquired by Sunburst Acquisitions. According to documents filed with the Securities and Exchange Commission, until Feb. 11, 2000, Powerclick board member Earl Gilbrech was a member of InternetFinancialCorp.com's board of directors.

Also, in September of 1999, WSI Interactive issued a press release stating one of its subsidiaries, Medianet, had recently signed an agreement with Hollywoodbroadcasting.com Inc. to "provide all related Internet services for live streaming video broadcasts on the World Wide Web."

Duffett told MSNBC.com the Raging Bull incidents were not the only tricks his employer asked him to pull using massive numbers of computer-generated accounts. In another incident, Powerclick used computer automation to generate $750,000 worth of fake sign-ups at Mail.com.

Earlier this year, Powerclick became an affiliate of Mail.com, meaning Powerclick would be compensated $3 for every web surfer it convinced to open a Mail.com account.

In its lawsuit, Powerclick says it generated $100,000 in revenue in the first week of the deal. Six weeks later, the firm had billed a client $750,000 -- Powerclick director Earl Gilbrech identified the client as Mail.com.

But the account signups were all fake, generated by the automated sign-up program authored by Duffett. The program even had the accounts generate e-mail activity so they would appear legitimate.

Duffett says Powerclick executives told him to open the fake accounts, saying they were intended to be a test of Mail.com's servers. In its lawsuit, Powerclick says Duffett misled the firm about what the program did, and fired him after learning the accounts were fake.

According to the suit, the company thought Duffett's program was merely sending out spam mail to a 750,000-name e-mail list Duffett had gleaned from eBay.com. Powerclick's suit claims the company thought the revenue was generated by a very successful e-mail campaign sent to this list.

"No one's attention was raised because they were working directly with the billing department," said Gilbrech when asked why the company didn't investigate the unlikely success rate sooner.

Powerclick's lawsuit indicates part of the money has been refunded to Mail.com, and Gilbrech says the two firms have resolved the matter.

Duffett, meanwhile, said Powerclick also instructed him to set up fake accounts at numerous other sites. He said he signed up thousands of accounts at iWin.com, earning "a couple of bucks" per signup for Powerclick. Officials at iWin.com refused to comment. Since leaving Powerclick, Duffett has started a firm called "Realusertest.com" to help web sites prevent the kind of automatic sign-ups he says he generated for Powerclick.

Last week, MSNBC.com reported that four companies -- Powerclick Inc., Global 2000 Inc., Stoney Brook Investments and Data Art Enterprises -- had acted together to register hundreds of typosquatter domain names. There is evidence suggesting the firms are tightly connected, though Powerclick officials deny that. Gilbrech also maintains that Quantum Leap is a separate entity from Powerclick, though he said the two have several common investors.

When contacted for last week's typosquatting story, Gilbrech, a member of Powerclick's board of directors, said his firm was not connected to Stoney Brook, Data Art or Global 2000. He said Powerclick had at one time bought traffic from Stoney Brook Investments, which he said was a Belize firm, but added he had never heard of Global 2000. Gilbrech also told MSNBC.com there was no connection between Powerclick and Quantum Leap Media.

But there is evidence suggesting the companies are more tightly connected. There is much overlapping information in domain names registered to the firm. For example, the registration information for Yahu.com lists Global 2000 and Stoney Brook as owner and Powerclick.com computers as the DNS servers.

Gilbrech did not offer an explanation for this but said his firm was investigating.

There is also information linking Quantum Media and Powerclick. Last week, MSNBC.com was also able to view a public web page on Quantum Media's site which listed hundreds of typosquatter domains and where they were redirecting visitors. On several of those web pages, the title field said, "Powerclick.com host access count."

The web page appeared to be a tool that allowed Powerclick or Quantum Leap employees to manage the typosquatted domains. One option on the page allowed visitors to shift accidental traffic from one domain to another -- for example, on Sept. 19, www.hotmail.com was sending visitors to a trivia contest hosted at OTCStreet.com.

The traffic gleaned from typosquatting is anything but trivial, if statistics in the tool are to be believed. The tool says about 20,000 clicks are sent every day from www.hotmail.com; myyahoo.com gleans about 10,000; and each day, well over 200,000 clicks are redirected.

Gilbrech said he was unaware of the tool and couldn't explain why Powerclick's name was connected to a Quantum Leap Media web page.