Tag Archive: Related Websites

From Google Treasure Chest to Sun Tan Scam in Nevis on the BBC?

From Google Treasure Chest to Ubertan Sun Tan Scam in Nevis on the BBC?

A.  yes it’s true!

Ubertan On BBC

Ubertan On BBC

An article on the BBC website today highlighted the dangers of a tanning products called Ubertan.  On reading it, and following up with a simple Google search, the way it is portrayed in forums immediately set off warning bells because of its similarity to other scams I’ve seen.

Ubertan

Ubertan Search

Ubertan Search

A simple Google search showed that warnings about Ubertan have been going on for some time.  This website warned way back in April 2011 and here we have a Mens’s Health forum being shilled by Ubertanners with a post starting in Jan 2011…  The first even shows that the Ubertan website changed it’s copy when folks started complaining.

The Ubertan website is currently ‘live’ however, it is showing no content!  At all!  The Google cache is interesting though (more on that later)…

WHOIS Ubertan

Ubertan WHOIS

Ubertan WHOIS

Who is Ubertan indeed?  !!

WarningBell

Warning Bell

What we see is that “Manufacturers Direct” owns several domains and one Vernon Veira is the contact on the dual island nation of Kitts-Nevis.

10 Solomons Arcade
Charlestown,  00000
KN
+1.3057484919

This is when the warning bells started ringing….

Doing The Charlestown in Nevis

It’s two years ago that I started looking at the now seriously-discredited Google Treasure Chest scam (see http://strangelyperfect.tv/3099/google-treasure-chest-its-a-scam-and-a-half/).  the amount of information I had, meant I had to post over several different postings, and it was during these later investigations that a Post Office address (P.O. Box) came up on Nevis.  In Charlestown.

Unfortunately, I couldn’t remember exactly what address it was.  But it’s easily found here a comment from @NotKevin.  I think it’s the first time we saw the address, although it has since popped up many times when checking out folks that would be preferred to be known as “online marketeers” but we like to call scammers.  This is on the posting,

This is the address.

New Online Systems Ltd.
P.O. Box 642, Main Street
Charlestown, Nevis, West Indies

Google Cache

Ubertan Google Cache

Ubertan Google Cache

Ubertan may be silent, but the Google Cache is active and shows this address down at the bottom of the first cached page:

Ubertan.com +44 161 408 5816
Subertan Ltd 642 Main Street, Charlestown, Nevis

 

Uber morphs into Suber, and because the Post Office on Charlestown is one of the few buildings on Main  Street, Charlestown; a whole host of P.O. Boxes exist inside.

P.O. Box 642 means 642 Main Street!

Who are these people using 642?  I don’t know.

What I do know is that the domains listed by @NotKevin, although not exactly the same,  bear a shocking similarity to those domains used by people like Jesse Willms (say) before he decided to turn into a saint-like activist and Pacific WebWorks (say) before they got their pants sued off them.  This is what @NotKevin said:

That West Indies address is also linked with porn:
http://www.highdefriches.com/contact.php
http://www.eshspt.com/
(another Co Durham address on that one too!)
“health products”:
http://hiltonhg.com/
Colon cleansing:
http://www.colocleansemax.com/contact-us.php
Acai:
http://acaidetoxmaxx.com/
and Govt Grants:
http://www.complaintsboard.com/complaints/government-grants-avaliable-cd-c116063.html

Now compare and contrast those domains and businesses with the very large list to be found here on WebCops – the plethora of time-limited similarly-named domains means tracking them is an onerous task, well beyond my spare time.

However, yet again, we have seen the same address appear when dealing with dodgy ego-massaging products.

Phoenix-Like TryUbertan

Ubertan may be dead, but it doesn’t take long to find son-of-Ubertan when looking at the decidedly un-Caribbean telephone number for Ubertan.

+44 161 408 5816 is actually a Manchester, UK number!!

TryUbertan Contact Page

TryUbertan Contact Page

A quick search pulls out…..

Beginnings

Now I know they’re trying to hide!!!

TryUbertan.net on the T&C page now shows the address of Ubertan to be:

Ubertan Sunless Tanning System
c/o Toocoo Media Inc.
39555 Orchard Hill Place
Suite 600
Novi, Michigan
48375

Although it’s supposed to be available from ” high end salons in the U.K, France, Germany, Spain and North America” from their FAQ page, these stores will be doing so ILLEGALLY!  The UK government has officially banned it (as per the UK news item) and is EXPLICITLY ISSUING DANGER WARNINGS about its usage!

Still, TryUbertan (WHOIS is Pennsylvania USA) don’t care.  They’ll just grab the cash and morph into something else.

TooCoo Media CEO

TooCoo Media CEO

The decidedly minimalist website of Toocoo Media Inc, http://www.toocoomedia.com, throws up some interesting conundrums, if that really is their mailing address.  There are two LinkedIn links:

  • http://www.linkedin.com/company/toocoo-media-inc.
  • http://www.linkedin.com/in/jumanok

The latter is for the CEO, a Peter B. Lee whose 3 website links at the bottom of his profile point to the totally and bizarrely un-related websites of:

  • http://www.viafoura.com/
  • https://www.netiq.com/products/migrate/ which then redirects to novell.com as Novell has bought them out
  • http://www.oracle.com/index.html

Mr Lee, who claims to be Canadian from the LinkedIn profile, also has a poetry blog on blogger assuming the same quite distinct user name is being re-used, which is for invited guests only!!!  See The Poetry of Peter B. Lee with the url of http://jumanok.blogspot.com/  I’ve highlighted his key username as it matches the LinkedIn profile.  I don’t think that this Peter Lee (interestingly, a place name in County Durham of all places!) is the same who’s name is used in some recent versions of the classic 419 scam.  Try these examples for a start:

To add to the surreal mix that I’m uncovering, there are also two videos on YouTube uploaded by a “jumanok”!!  One of half a minute looks very much like Mr Lee, doing  some testing thing in Nov 2008 here:

This is a screenshot in case it’s pulled:

Jumanok YouTube

Jumanok YouTube

This is Jumanok from LinkedIn:

Jumanok LinkedIn LargePic

Jumanok LinkedIn LargePic

And here is “Crystal” telling us how her life state has improved after seeing something on OPRAH (down below she says) – except there’s nothing below!!  It appears to be a video plug for something intended to include Oprah in the spiel, except it never happened as there’s nowt to see.  This was uploaded in May, 2009.  The termination of Oprah-related plans may or may not have had something to do with the legal action, taken in May 2009, by Oprah, and reported here on her website;

http://www.oprah.com/health/The-Truth-About-Oprah-Dr-Oz-Acai-Resveratrol-and-Colon-Cleanse

Of course, Oprah sued and won damages against a host of scammers, one of which was Jesse Willms.

Conclusion

  • Time and again we come across scams that are based on a business with a very flakey base (here it’s a banned tanning product with government issued health warnings).  Usually, they are about improving one’s body or finances via unproven “new” medicines or foodstuffs, or get-rich-quick schemes.
  • Time and again we find a myriad of international contact phone numbers & addresses, for businesses that are very minor and specialist yet feel the need to spread themselves to the far corners of the globe.  Q. Why?  A.  Avoidance of easy scrutiny.
  • Time and again, we trace these businesses via LinkedIn (a bit like Jonathon Eborn, say) and other social networks high and wide.  They all start off appearing very legitimate.   As an aside, the Eborn results show a consulting website of http://www.jonathanebornconsulting.com/ and another of http://www.jonathandeborn.com/ which have both been hacked and defaced!  Made my day that!
  • Many businesses have a very public website, of minimalist design and content.  It’s very hard to discern exactly what they’re doing.  Compare these “online marketeers” to the website of Ford or Esso, say?  Now can you tell the difference?

Finally, (and very importantly for your health).  Don’t shove dodgy untested stuff of unknown provender up your nose.  Simple eh?

Related Posts:

Psychic Search mucks up Search!

Problem

Bridge Supports

Support?

As a follow up to this post, Disabled my blogtrafficexchange.com Plugin, I trawled through some likely plugin candidates for the symptoms mentioned by @Not Kevin.  These are obviously anything related to “web searching” in all it’s guises.

Problem Solved

The problem plugin is Psychic Search from MaxBlogPress.  In two browsers at least (Chrome & Firefox – I didn’t test any more as one instance of the particular behaviour is bad enough, thank you very much), anyone arriving at my site from a search was left with a blank page but the correct URL showing in the address bar!  This manifested for anyone, including myself when logged on, even using the search boxes on the site main page!!!

MaxBlogPress

You pays your money and takes your choice.  Most WordPress plugins are free and there is a recognised support path via the WordPress community.  Most plugins are available via the WordPress plugin repository, and a side-benefit of this is that all previous plugin versions are there to download…..

Unfortunately, MaxBlogPress plugins are not in the repository and only available via their website.  There’s only a single version to download as well.   This means I cannot find a version to roll back to for the duff plugin as I never kept a local copy of the original.

Psychic Search is free but a registration process is required.  This leads to emails from MaxBlogPress of ever increasing urgency about the latest whizz-o product to improve your SEO or whatever.  Quite frankly, it’s almost spam…

Related Websites

Anyway, the Related Websites plugin from blogtrafficexchange.com is now up and running and both their and my websites seem back in order again!  Woo-Hoo!!

Related Posts:

Comments are closed

Disabled my blogtrafficexchange.com Plugin

Strangely post on June 1st, 2010
Posted in Internet Tags: , , , , , , , , ,

blogtrafficexchange.com

I’ve recently had a few web-outages, slow loading pages (especially the admin pages) and a very recent drop in hits to this website.  Being short of time, I’ve let things continue.

However, having a longer moment, after disabling the Related Websites plugin from blogtrafficexchange.com, things have speeded up remarkably!  Not surprising really since I don’t waste time calling up invisible websites…

It’s another of those websites that needs to hide itself using Domains by Proxy, Inc., but hey-ho, I’ve given them a go anyway.  The WHOIS shows that a renewal is due this month, so maybe it’ll fire up again….?

The link for the plugin is here, currently non-working.

http://www.blogtrafficexchange.com/related-websites

This is the WordPress repository link.  Obviously, the plugin is no good if it’s backend server feeds are broken.

http://wordpress.org/extend/plugins/related-websites/

Related Posts:

Watch Out for cleanup-registry.net!

Introduction

I got a ping this morning from a website called cleanup-registry.net   It arrived because I’d been referenced as a website in the network setup using the plugin, “Related Websites” by the Blog Traffic Exchange (actually, it may be time to knock this experiment on the head as generally, the sites are only loosely related and have poor linkage otherwise).

Whatever; the link referenced an old post of mine about Microsoft software problems here.  Notionally, the website looks okay and professional – but I smelled a rat!

cleanup-registry.net

Cleanup-Registry.net

Cleanup-Registry.net

This is a screenshot of the whole post (at ).  So I did a search on the user’s  error message:

‘The DOTNETFX35SETUP.EXE file is linked to missing export NTDLL.DLL:NtShutdownSystem.’ (it turns out later that I should have just done a search on the text in the first paragraph of the post…)

Yahoo!Answers page

Yahoo!Answers page

About six entries down in the Google search results, is this page from the respected ‘Yahoo! Answers’ forums website, shown at left.

The screen-shots of each WILL blow up to full-size, but to save you making direct textual comparisons, let me tell you now that the text in both, and one comment, the accepted answer in Yahoo! Answers, is EXACTLY the same!

For your interest, the accepted answer is that the OS’s are incompatible and there’s a fix described.

The real problem is the dates!  cleanup-registry.net’s is the 8th September 2009;  Yahoo! Answer’s is from 8 months ago!

Conclusion

What we are seeing is the same sort of tactic employed by the Google Treasure Chest scammers of a fake blog (now called a flog!) being used as part of a selling campaign.  They’ve content-scraped decent content and passed it off as their own as a means of justifying their flogging area.

Q. Their product?

A. They are trying to sell a registry cleaner type software and a computer maintenance service ($25 per month!) in Las Vegas.

All of this is done under the banner of some fairly useful video how-tos and some less worthy content scraping from other websites….

The killer bits are that all the ‘blog’ entries are dated 24/9/2009 (apart from the odd one) and all the pages and how-tos are dated 24/7/2009!!!

Furthermore, the domain owner is hidden by our old friends at Domains by Proxy..

Do you really trust this sort of stuff?  I don’t.  Whether it’s supporting malware or not, it’s selling by devious means using the same methods as used by zillions of scams worldwide.

Caveat Emptor – buyer beware!

Related Posts:

Google Treasure Chest – Update

@AmazonSince the first posting about this scam about 10 days ago, Google Treasure Chest – it’s a scam and a half! alone has attracted over 3000 page views.  From these, about 100, sometimes desperate,  people have commented and admitted that they’ve been sucked into the scam on that and the other postings around the subject.

Make from these numbers what you will.

  • Maybe it means I’ve stopped over 2000 people getting ripped off?
  • Maybe, as I suspect, most people don’t like to admit they’ve been made to look a chump – and I can empathise with that.

I’m in a computer-free zone for a day or two so any further comments will be held for moderation.  If I didn’t, I’d have about 3000 comments of viagra garbage from our friends in St Petersburg and Shanghai which would make information very hard to find!  The comments list would be about a mile long…

So until then, if you’ve been conned by the Google Treasure Chest/kit/pack and the host of related websites:

  • Don’t give up
  • Act swiftly
  • Call one of the numbers that we’ve found that works from people’s comments under the postings
  • Cancel the subscription
  • Warn your bank if necessary
  • Change your credit card if necessary

You can still leave information and tips for other victims, but if you’ve not commented before, your comment won’t show immediately.  As a resource for others, all information is valuable, so please post away!

I’ll be back

Audio clip: Adobe Flash Player (version 9 or above) is required to play this audio clip. Download the latest version here. You also need to have JavaScript enabled in your browser.


Related Posts:

© 2007-2017 Strangely Perfect All Rights Reserved -- Copyright notice by me