re. ucabt.com - read below before checking it out.

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Wed Jul 15, 2009 6:52 am

Hello all,
I received spam from ucabt.com. Now, spam is bad enough, but it would seem that these guys promote their scam/spam mails using malware to hack people's yahoo and hotmail addresses, so please make sure you're on a safe system before entering the site. I googled ucabt, and this thread on another forum came up: http://www.dslreports.com/forum/r22276002-Spam-Kanicn. I take it kanicn is just one more of their many registered domains.

ucabt bears the telltale signs of a scamming site. Payment only via moneygram, WU or bank wire. They have beautiful icons for credit cards, but when you click them you just get directed back to the start page. They use a hotmail address. But hey - they do have phone numbers for customer service. Toll: +86-0-00000000000 Outside: +86-0-00000000000 : 8am-5pm M-F PST. Laughing

Anyway, I did a search on this forum, but did not come across ucabt and wonder if it might present an interesting challenge to some of you experts in here...? I know it's way way way out of my league to do anything about it. I might be mistaken and it's already being dealt with, of course.

The header and the mail is here:
Content-Type: message/rfc822;
name="Dear friend s.eml"
Content-Transfer-Encoding: 8bit
Content-Disposition: inline;
filename="Dear friend s.eml"

X-Account-Key: account2
X-Mozilla-Keys:
Return-Path: <[email protected]>
Delivered-To: [email protected]
Received: from cicero4.cybercity.dk (cicero4.xxxxx.dk [212.xxx.40.xx])
by uf6.xxxxx.dk (Postfix) with ESMTP id B632D15B84C7
for <[email protected]>; Tue, 14 Jul 2009 21:52:55 +0200 (CEST)
X-Greylist: whitelisted by SQLgrey-1.7.6
Received: from blu0-omc3-s6.blu0.hotmail.com (blu0-omc3-s6.blu0.hotmail.com [65.55.116.81])
by cicero4.xxxxx.dk (Postfix) with ESMTP id 787D73CBC12
for <[email protected]>; Tue, 14 Jul 2009 21:52:55 +0200 (CEST)
Received: from BLU138-W32 ([65.55.116.73]) by blu0-omc3-s6.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
Tue, 14 Jul 2009 12:52:54 -0700
Message-ID: <[email protected]>
Content-Type: multipart/alternative;
boundary="_41dfe074-d445-4b63-98c3-e0c21ad5528f_"
X-Originating-IP: [115.49.93.35]
From: GUSTAVO RODRIGUEZ NICODEMO <[email protected]>
To: <[email protected]>
Subject: Dear friend s
Date: Tue, 14 Jul 2009 19:52:54 +0000
Importance: Normal
MIME-Version: 1.0
X-OriginalArrivalTime: 14 Jul 2009 19:52:54.0701 (UTC) FILETIME=[ADA365D0:01CA04BC]

--_41dfe074-d445-4b63-98c3-e0c21ad5528f_
Content-Type: text/plain; charset="ks_c_5601-1987"
Content-Transfer-Encoding: 8bit

Dear friend,
We are a large international wholesaler,located in Shanghai of China, all our products are brand new and original.
We mainly sell all kinds of digital products such as Ipone, iPod, laptop, television�� The LCD, camera, GPS, PS3, motorcar and so on.
If you are interested, please browse our site and take a look.
please feel free to contact us. Thanks

Site: www.ucabt.com
MSN: [email protected]
E-MAIL: [email protected]

O d

_________________________________________________________________
Windows Live��: Keep your life in sync. Check it out!
http://windowslive.com/explore?ocid=TXT_TAGLM_WL_t1_allup_explore_012009
--_41dfe074-d445-4b63-98c3-e0c21ad5528f_
Content-Type: text/html; charset="ks_c_5601-1987"
Content-Transfer-Encoding: 8bit

<html>
<head>
<style>
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Verdana
}
</style>
</head>
<body class='hmmessage'>
Dear friend, <BR>We are a large international wholesaler,located in Shanghai of China, all our products are brand new  and original. <BR>We mainly sell all kinds of digital products such as Ipone, iPod, laptop, television�� The LCD, camera, GPS, PS3, motorcar and so on. <BR>If you are interested, please browse our site and  take a look. <BR> please feel free to contact us. Thanks <BR><BR><BR>    Site: www.ucabt.com <BR>     MSN: [email protected] <BR>  E-MAIL: [email protected] Windows Live��: Keep your life in sync. <a href='http://windowslive.com/explore?ocid=TXT_TAGLM_WL_t1_allup_explore_012009' target='_new'>Check it out!</a></body>
</html>
--_41dfe074-d445-4b63-98c3-e0c21ad5528f_--

--------------000300060507060904020205--

Fixed blowout due to long line - Roy

Not quite a Newb Joined: 22 Jul 2009 Posts: 42

I know it's a long shot, but did the name "catalina" come up in any of your searches on this?

I'm tracking a counterfeiter working out of Shanghi who also sells digital electronics, art and other stuff. I don't mean a scammer producing fake web sites or lottery schemes, a real live counterfeit operation producing fake US currency! They sometimes appear to be just like any other of thousands of exporters of electronics, but occasionally they slip in counterfeit currency, ancient jade carvings and ivory. I think their plan is to swamp the inspectors with boring shipments so no one pays that much attention to them.

I can prove it on a small scale, but I suspect the "catalina" group is just a middle man, I want more on them before I break the ring.

Yeah, I know counterfeiting not exactly within the scope of this web site, just a pet project I'm working on the side.

Just drop me a note if you run across "catalina" from Shanghi or find a group over there selling a very strange mix items...mostly new electronics, with the occasional old "art" or old "collectible" item mixed in.

re. ucabt.com - read below before checking it out.	View next topic View previous topic