Massive Nigerian scam syndicate fake sites

[firefly]

bankofghana-gov.com - email only domain, impersonating Bank of Ghana

Fake site details - http://db.aa419.org/fakebanksview.php?key=117679:
Domain Name: BANKOFGHANA-GOV.COM
Updated Date: 2016-10-03
Creation Date: 2016-10-03
Registrar Registration Expiration Date: 2017-10-03
Registrar: BigRock Solutions Ltd

Registrant details:
Registrant Name: Frank Paul
Registrant Organization:
Registrant Street: federal road, Zanith building
Registrant City: Jiawa
Registrant State/Province: Other
Registrant Postal Code: 251242
Registrant Country: NG
Registrant Phone: +234.752156425
Registrant Email: moorefredrick553@yahoo.com

[firefly]

lagos-liaisonoffice.org - email only domain, impersonating Lagos Liaison Office.

Fake site details - http://db.aa419.org/fakebanksview.php?key=117680:
Domain Name: LAGOS-LIAISONOFFICE.ORG
Updated Date: 2016-09-07
Creation Date: 2016-09-07
Registry Expiry Date: 2017-09-07
Sponsoring Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com

Registrant details:
Registrant Name: Handy Reuben
Registrant Street: 3 little oak road Southampton united kingdom
Registrant City: Southampton
Registrant State/Province: Southampton(Cityof)
Registrant Postal Code: 20E C2M
Registrant Country: GB
Registrant Phone: +44.77000653875
Registrant Email: kayode553@yahoo.co.uk

[firefly]

sparbanken-oresund.com - email only domain, impersonating Sparbanken Öresund, Swedish bank active since 1826.

Fake site details - http://db.aa419.org/fakebanksview.php?key=117682:
Domain Name: SPARBANKEN-ORESUND.COM
Updated Date: 2016-09-07
Creation Date: 2016-09-07
Registrar Registration Expiration Date: 2017-09-07
Registrar: Domainshype.com, Inc

Registrant details:
Registrant Name: Handy Reuben
Registrant Street: 3 little oak road Southampton united kingdom
Registrant City: Southampton
Registrant State/Province: Southampton(Cityof)
Registrant Postal Code: 20E C2M
Registrant Country: GB
Registrant Phone: +44.77000653875
Registrant Email: kayode553@yahoo.co.uk

[firefly]

clientonlineloginportalss.com - fake banking portal used by numerous of the scam banks.

Fake site details - http://db.aa419.org/fakebanksview.php?key=117683:
Domain Name: clientonlineloginportalss.com
Update Date: 2016-06-22
Creation Date: 2016-06-22
Registrar Registration Expiration Date: 2017-06-22
Registrar: Wild West Domains, LLC

Registrant details:
Registrant Name: Handy Reuben
Registrant Organization: ABATI
Registrant Street: 3 little oak road
Registrant Street: Southampton united kingdom
Registrant City: Southampton
Registrant State/Province: Georgia
Registrant Postal Code: 85213
Registrant Country: US
Registrant Phone: +1.447700039801
Registrant Email: kayode553@yahoo.co.uk

[firefly]

From the same fake sites maker using the email address ruchardpills454@outlook.com.

The fake site is a spoof of J.P. Morgan Asset Management.

From the fake site:

US Office

J.P. Morgan
712 Main Street
Houston, TX 77002
+1 713.242.1587
UK Office

1 Knightsbridge
London SW1X 7LX
United Kingdom
+44.20.3322.6314
Email

info@am-jpmtexas.com
admin@am-jpm-texas.com

+17132421587 Twillio VoIP number

+442033226314
Number billable as geographic number
Country or destination United Kingdom
City or exchange location London
Original network provider* (aq) Limited trading as aql

From the fake site details - https://db.aa419.org/fakebanksview.php?key=119866:
Domain Name: AM-JPM-TEXAS.COM
Updated Date: 2017-01-09
Creation Date: 2017-01-09
Registrar Registration Expiration Date: 2018-01-09
Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com

Registrant Name: esther gab
Registrant Street: 278 Kalagbor Street
Registrant City: port harcourt
Registrant State/Province: rivers
Registrant Postal Code: 23409
Registrant Country: NG
Registrant Phone: +234.37259423354
Registrant Email: ruchardpills454@outlook.com

This is what the fake site is looking like:

am-jpmtexas.com

am-jpmtexas.com is used only for the email address.

From the fake site details - https://db.aa419.org/fakebanksview.php?key=119867:

Domain Name: AM-JPMTEXAS.COM
Updated Date: 2017-01-12
Creation Date: 2017-01-12
Registrar Registration Expiration Date: 2018-01-12
Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com

Registry Registrant ID: Not Available From Registry
Registrant Name: lorenkinn
Registrant Street: 25, obafemi awolowo way
Registrant City: ikeja
Registrant State/Province: Abuja Capital Tercltory
Registrant Postal Code: 23409
Registrant Country: NG
Registrant Phone: +234.8047205634
Registrant Email: loren.kinn@yahoo.com

The victims are receiving another link to another domain when they are asked to join the site: am-jpm-client7586-texas.com.

From the fake site details - https://db.aa419.org/fakebanksview.php?key=119865:

Domain name: AM-JPM-CLIENT7586-TEXAS.COM
Creation Date: 2017-01-18
Updated Date: 2017-01-18
Registrar Registration Expiration Date: 2018-01-18
Registrar: NAMECHEAP INC
Reseller: NAMECHEAP INC
Registrant Name: WhoisGuard Protected

This is what the fake site is looking like:

[firefly]

The fake sites pretends to be Commerzbank – Corporate Banking Investment Banking.

Commerzbank AG, Brussels Branch Boulevard Louis Schmidt 29, 1040 Etterbeek, Belgium
+32-2-588-1980
+32-2-588-2896
legal.department@commerzbank-be.com

+3225881980 / +3225882896
Number billable as geographic numbers
Country or destination Belgium
City or exchange location Brussel

From the fake site details - https://db.aa419.org/fakebanksview.php?key=119868:
Domain Name: CZBNK-BE.COM
Updated Date: 2017-01-17
Creation Date: 2017-01-16
Registrar Registration Expiration Date: 2018-01-16
Registrar: CRAZY DOMAINS FZ-LLC
Reseller: GLOBEHOST INDIA PRIVATE LIMITED

Registry Registrant ID: 21534615
Registrant Name: ESTHER GAB
Registrant Organization:
Registrant Street: 278 KALAGBOR STREET
Registrant City: PORT HARCOURT
Registrant State/Province: RIVERS
Registrant Postal Code: 23409
Registrant Country: NG
Registrant Phone: +234.37259423354
Registrant Email: ruchardpills454@outlook.com

This is what the fake site is looking like:

commerzbnk-be.com is used only for the email address.

From the fake site details - https://db.aa419.org/fakebanksview.php?key=119946:
Domain Name: COMMERZBNK-BE.COM
Updated Date: 2016-12-30
Creation Date: 2016-12-30
Registrar Registration Expiration Date: 2017-12-30
Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com

Registry Registrant ID: Not Available From Registry
Registrant Name: vera steph
Registrant Organization:
Registrant Street: 15, fatai iranwo street, lagos
Registrant City: LAGOS
Registrant State/Province: Lagos
Registrant Postal Code: 23401
Registrant Country: NG
Registrant Phone: +234.8166548083
Registrant Email: verasteph85@yahoo.com

Their victims receives a direct link to log in on the fake site: http: / /czb. onldataadminhtmlssl.website/Login

From the fake site details - https://db.aa419.org/fakebanksview.php?key=119869; the registrant is using the privacy protection given by the registrar to hide his/her identity:
Domain Name: ONLDATAADMINHTMLSSL.WEBSITE
Updated Date: 2017-01-08
Creation Date: 2017-01-03
Registry Expiry Date: 2018-01-03
Sponsoring Registrar: Namecheap
Registrant ID: C107749172-CNIC
Registrant Name: WhoisGuard Protected

This is what the fake site is looking like:

[firefly]

The fake site impersonates First Bank Virgin Islands. The domain is used only for the email address.

From the fake site details - https://db.aa419.org/fakebanksview.php?key=122194:
Domain Name: FIRSTBNKVI-USVI.COM
Updated Date: 2017-01-09
Creation Date: 2017-01-09
Registrar Registration Expiration Date: 2018-01-09
Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com

Registry Registrant ID: Not Available From Registry
Registrant Name: ruchard pills
Registrant Street: 25, obafemi awolowo way, ikeja
Registrant City: ikeja
Registrant State/Province: Other
Registrant Postal Code: 23409
Registrant Country: NG
Registrant Phone: +234.348036664539
Registrant Email: ruchardpills454@outlook.com

[firefly]

The fake site pretends to be International Development Bank of Commerce.

Contact details on the fake site:

International Development Bank of Commerce, 2203 E Rawson Ave, Oak Creek, WI 53154
+1 920 395 6468
info@idboc.com

+19203956468 - GoTextMe VoIP number

From the fake site details - https://db.aa419.org/fakebanksview.php?key=119877:
Domain Name: IDBOC.COM
Updated Date: 2017-01-18
Creation Date: 2017-01-18
Registrar Registration Expiration Date: 2018-01-18
Registrar: CRAZY DOMAINS FZ-LLC
Reseller: GLOBEHOST INDIA PRIVATE LIMITED

Registry Registrant ID: 21539667
Registrant Name: ESTHER GAB
Registrant Street: 278 KALAGBOR STREET
Registrant City: PORT HARCOURT
Registrant State/Province: RIVERS
Registrant Postal Code: 23409
Registrant Country: NG
Registrant Phone: +234.37259423354
Registrant Email: ruchardpills454@outlook.com

This is what the fake site is looking like:

Their victims receives a link to log into the fake site: http: / / idboc.am-jpm-client7586-texas.com/Login: a subdomain on the one used for am-jpm-texas.com. This clearly proves what we are saying here is correct and all these scams are linked.

From the fake site details - https://db.aa419.org/fakebanksview.php?key=119865; the scammer is using the privacy protection given by the Registrar to hide his/her identity:

Domain name: AM-JPM-CLIENT7586-TEXAS.COM
Creation Date: 2017-01-18
Updated Date: 2017-01-18
Registrar Registration Expiration Date: 2018-01-18
Registrar: NAMECHEAP INC
Reseller: NAMECHEAP INC
Registrant Name: WhoisGuard Protected

This is what the fake site is looking like:

[firefly]

Fake site impersonating the International Monetary Fund.

From the fake site details - https://db.aa419.org/fakebanksview.php?key=119875:
Domain Name: IMF-GOVOFFICE.ORG
Updated Date: 2017-01-17
Creation Date: 2017-01-17
Registry Expiry Date: 2018-01-17
Sponsoring Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com

Registrant ID: DI_63694471
Registrant Name: esther gab
Registrant Organization: N/A
Registrant Street: 278 Kalagbor Street
Registrant City: port harcourt
Registrant State/Province: rivers
Registrant Postal Code: 23409
Registrant Country: NG
Registrant Phone: +234.37259423354
Registrant Email: ruchardpills454@outlook.com

[firefly]

Another spoof of the same J.P. Morgan.

From the fake site details:
Domain Status Registered And Active Website
Domain Name: JPMCPBNK.COM
Updated Date: 2017-01-17
Creation Date: 2017-01-16
Registrar Registration Expiration Date: 2018-01-16
Registrar: CRAZY DOMAINS FZ-LLC
Reseller: GLOBEHOST INDIA PRIVATE LIMITED

Registry Registrant ID: 21534611
Registrant Name: ESTHER GAB
Registrant Street: 278 KALAGBOR STREET
Registrant City: PORT HARCOURT
Registrant State/Province: RIVERS
Registrant Postal Code: 23409
Registrant Country: NG
Registrant Phone: +234.37259423354
Registrant Email: ruchardpills454@outlook.com