|
|||||||
|
|
|
|||||
|
|
|||||||
|
|||||||
|
|
|
|||||
|
|
|||||||
Odysseus Marketing, Walt Rines, and ClientMan
This is a report of my research on Odysseus Marketing, Walt Rines, and ClientMan, an advertising parasite program owned by Walt Rines and operated on his server Odysseus Marketing http://www.odysseusmarketing.com/. He also owns Quantum Communications http://www.quantumcom.com, Global Technology Marketing (several of these so I don't know which one is his site), First Bookmark http://www.firstbookmark.com, Targit Interactive http://www.targitmail.com/, Adcaster Extreme http://www.unitedvending.net, Kazanon http://www.kazanon.com, World Portal http://www.world-portal.com, Message Broadcaster http://www.messagebroadcaster.net, Search Assistant http://www.searchassistant.net, Refer-A-Website http://refer-a-website.com, http://www.datastorm.biz and IEMMC. He also co-owned Global Technology Marketing with Sanford Wallace, and was a member of IEMMC.
At least seven websites: http://default-homepage-network.com, http://www.firstbookmark.com, http://www.messagebroadcaster.net, http://www.refer-a-website.com, http://www.kazanon.com, http://www.passthison.com, and http://www.odysseusmarketing.com are used as servers to operate ClientMan on. What is unclear is who owns default-homepage-network.com?
ClientMan has a notorious history of sabotage and generally wrecking havoc on the public through browser hijacks and unwanted downloads. Symantec lists them as spyware http://securityresponse.symantec.com/avcenter/venc/data/spyware.clientman.html as does PestPatrol http://www.safersite.com/PestInfo/c/clientman.asp
It's public knowledge that Walt Rines and Sanford Wallace were one-time spamming partners and long-time friends.
Here's the documentation which
shows that http://www.odysseusmarketing.com, http://default-homepage-network.com, and http://www.firstbookmark.com are all used to operate ClientMan:
http://www.mvps.org/winhelp2002/hosts.txt
http://default-homepage-network.com which operates on ClientMan that Walt Rines owns contains the same site copy as http://www.passthison.com which was once owned or may still be owned by Sanford Wallace (http://www.adinfo.businessweek.com/technology/content/0009/el0901.htm). Does this mean that Sanford owned passthison and default-homepage-network?
If you type in the URL for www.odysseusmarketing.com, Walt Rines' site will appear:
But if you have a logging program that records all computer activity, odysseusmarketing.com records as clubplumcrazy.com in the logs:
This wouldn't be such an odd coincidence, since Walt owned the club at one time, but Sanford bought it from him in January of 2002. The odysseusmarketing registry was created in September of 2003, nearly two years after Walt sold the club.
On Sept. 16, 2003, (prior to another change on December 5, 2003) the whois information for default-homepage-network.com was changed to:
Registrant:
Seismic Entertainment Productions, Inc. (MPPTIHLLQD)
11 Farmington Road
Rochester, NH 03867
US
Domain Name: DEFAULT-HOMEPAGE-NETWORK.COM
Administrative Contact, Technical Contact:
Cayer, Mike (35890037P) eaglessuck2000@hotmail.com
Seismic Entertainment Productions, Inc.
11 Farmington Road
Rochester, NH 03867
US
603-817-0903
Record expires on 16-Sep-2006.
Record created on 16-Sep-2003.
Database last updated on 5-Dec-2003 01:14:04 EST.
Domain servers in listed order:
NS1.DEFAULT-HOMEPAGE-NETWORK.COM 205.236.189.50
NS2.DEFAULT-HOMEPAGE-NETWORK.COM 69.36.129.34
This information listed Mike Cayer as the administrative contact. The Rochester Chamber of Commerce lists the contact person of Club Plum Crazy as Mike Cayer http://www.rochesternh.org/showaddress.asp?cat=199&alphabet=r. The owner of Club Plum Crazy is Sanford Wallace who bought the club from Walt Rines in 2002 http://www.wired.com/news/business/0,1367,60714,00.html. So this would appear to mean that Mike Cayer is the contact person for both a nightclub that Sanford Wallace owns and a server used to run the ClientMan program which Walt Rines owns.
Also, the whois information listed
Seismic Entertainment Productions, Inc. as the site owner for
default-homepage-network.com. This is the same company that owns
Club Plum Crazy http://66.102.7.104/search?q=cache:9trlng5eCXAJ:clubplumcrazy.com/+%22Seismic+Entertainment+Productions,+Inc.%22&hl=en&ie=UTF-8
This would appear that Sanford Wallace owns
default-homepage-network.com which is operating ClientMan.
If you visit the odysseusmarketing.com website and try to obtain directions on how to uninstall their program (http://www.odysseusmarketing.com/uninstall/) you get a popup advertising SpyWiper, the same advertising that default-homepage-network.com uses when they hijack your browser.
I recently received this email from a Club Plum Crazy employee:
"I work at plum crazy and now you, like others, have fallen into the trap of associating default-homepage-network with our club and mr wallace. The people who created that site (spywiper and some overseas company i believe) pointed the whois to sanford's business knowing it would deflect blame to our business. And now people call us, threaten us, curse at us, etc., over something that has NOTHING to do with any of us. So before you continue down this path, can you please find one piece of evidence OTHER than the incorerrect whois (which i believe was fixed) that associates us with this internet scheme - before you make things worse and more inaccurate. Thank you."
If what this employee says is true, then we can only derive at this conclusion. This would mean that the owner of default-homepage-network is not Sanford Wallace and that they are trying to defame him. But would his long-time friend and associate, Walt Rines, allow someone else to incriminate Sanford by utilizing ClientMan and placing the blame on him? If Walt Rines owns default-homepage-network, as the whois information suggests, would he himself attempt to incriminate Sanford?
In a second email, the same employee states "The people who run default home page COPIED passthison and used a FAKE contact address to confuse people about the true owner. Sanford ran passthison.com which doesnt hijack anything." which means she is again accusing either Walt or someone else of sabotage towards Sanford Wallace and denying that Sanford owns the site.
But then another element is added to the mystery. A company named ZendMedia is documented as hijacking IE browsers. A visit to the http://www.zendmedia.com website results in a redirect to http://default-homepage-network.com. It would appear at this point that they are owned by the same person, except that default-homepage-network adds a disclaimer to their website emphatically denying any association with zendmedia and their actions.
Immediately after this turn of events, I received a third email from the same Club Plum Crazy employee:
"The truth comes out. We now know why people are associating all this activity with our club and owner. Zendmedia.com has been the one deflecting blame and forging whois. We dont even know who those people are. They are NOT associated with our club or our owner."
If what this employee now says is true, it would seem that her earlier accusations of default-homepage-network altering whois information and copying passthison site content were either inaccurate or in conjunction with her accusations that zendmedia is altering whois information.
Since default-homepage-network apparently wants no association with zendmedia, can we assume that zendmedia is trying to defame Sanford Wallace and that the owner of default-homepage-network is not trying to defame him, in spite of Sanford's employee's earlier accusations that they were?
Who really owns default-homepage-network? If their previous registry information was accurate, it would mean that both Sanford Wallace and Walt Rines own default-homepage-network. If the previous registry information was altered by zendmedia, it would mean that zendmedia would have to have had access to default-homepage-network's registry password. If default-homepage-network themselves altered the registry information to incriminate Sanford Wallace, it would mean that Walt Rines is allowing someone to do so by allowing them to utilize his program ClientMan on their server or that he himself is doing so.
Wired News published the following interview with Walt Rines and Sanford Wallace in October of 2003: http://www.wired.com/news/business/0,1367,60714,00.html This is definately recommended reading.
Two sites to be on the lookout for are: http://www.searchassistant.net and http://www.messagebroadcaster.net. These are both owned by Odysseus Marketing but are currently under construction. SearchAssistant links to Odysseus Marketing and http://www.whois.sc/messagebroadcaster.net shows MessageBroadcaster to be owned by Odysseus Marketing. I am already receiving reports from people being hijacked by messagebroadcaster.net.
Whois for Odysseus Marketing:
Registrant:
Odysseus Marketing, Inc.
8721 Santa Monica Blvd
Los Angeles, CA 90069-4507
US
Phone: 213-947-1271
Domain Name: ODYSSEUSMARKETING.COM
Administrative Contact:
Jones, Ed
hostmaster@odysseusmarketing.com
8721 Santa Monica Blvd
Los Angeles, CA 90069-4507
US
Phone: 213-947-1271
This address is simply a mail box service (http://www.mailservicecenter.com)
For more informative research and
information on this company, please visit
http://www.webhelper4u.com/CWS/defaulthomepagenetwork/passthisonftpexploit.html
and the accompanying links at the bottom of the page.
This website will be updated regularly with any new developments. Anyone wishing to contact me for inquiries or to relate their experiences may do so at nomorespyware@yahoo.com.