info@commwealthbankau.com

[firefly]

The fake site impersonates HSBC Bank Malaysia Berhad, incorporated locally in Malaysia in 1994. The fake site is used only for the email address.

From the fake site details - https://db.aa419.org/fakebanksview.php?key=122071:

Domain Name: HSBC-MALAYSIA.NET
Updated Date: 2016-06-27
Creation Date: 2016-04-27
Registrar Registration Expiration Date: 2017-04-27
Registrar: Domainshype.com, Inc

Registry Registrant ID: Not Available From Registry
Registrant Name: peter james
Registrant Street: suite 100, white house abuja
Registrant City: abuja
Registrant State/Province: Other
Registrant Postal Code: 23409
Registrant Country: NG
Registrant Phone: +234.323384894
Registrant Email: fillscholar162@gmail.com

The initial registrant details:
Registrant Name: aremo gbenga
Registrant Street: suite 100, white house abuja
Registrant City: abuja
Registrant State/Province: Other
Registrant Postal Code: 23409
Registrant Country: NG
Registrant Phone: +234.323384894
Registrant Email: daremcommercial@yahoo.com

[firefly]

The fake site impersonates HSBC Bank US, founded in 1850. The domain is used only for the email address.

From the fake site details - https://db.aa419.org/fakebanksview.php?key=122073:

Domain Name: HSBCBANKUSA.ORG
Updated Date: 2016-08-24
Creation Date: 2016-06-25
Registry Expiry Date: 2017-06-25
Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com

Registry Registrant ID: DI_55418721
Registrant Name: are gab
Registrant Street: block 100, jakande estate,
Registrant City: isolo
Registrant State/Province: lagos
Registrant Postal Code: 23401
Registrant Country: NG
Registrant Phone: +234.48023323327
Registrant Email: gbegab2@yahoo.com

[firefly]

The fake site impersonates HSBC Bank, founded 1836 in the UK. The domain is used only for the email address on another fake site already reported - hsfinid.com. The scammer changed the contact details after the site was reported: http://db.aa419.org/fakebanksview.php?key=117651

Contact details:

Gatot Subroto No. 177A, Menteng Dalam, 12870 Jakarta Selatan, Indonesia, Indonesia. Email: info@hsbcindon.com. Tel: +62 85810060290

From the fake site details - https://db.aa419.org/fakebanksview.php?key=122075:

Domain Name: HSBCINDON.COM
Updated Date: 2016-10-21
Creation Date: 2016-10-21
Registrar Registration Expiration Date: 2017-10-21
Registrar: CRAZY DOMAINS FZ-LLC
Reseller: GLOBEHOST INDIA PRIVATE LIMITED
Registry Registrant ID: 21340313
Registrant Name: ARE GAB
Registrant Street: BLOCK 100, JAKANDE ESTATE,
Registrant City: ISOLO
Registrant State/Province: LAGOS
Registrant Postal Code: 23401
Registrant Country: NG
Registrant Phone: +234.48023323327
Registrant Email: gbegab2@yahoo.com

[firefly]

Same HSBC Bank, another fake site impersonating them:

From the fake site details - https://db.aa419.org/fakebanksview.php?key=122074:
Domain Name: HSBCMOBILEAPP-CLIENTS.COM
Updated Date: 2016-06-20
Creation Date: 2016-04-20
Registrar Registration Expiration Date: 2017-04-20
Registrar: Domainshype.com, Inc

Registry Registrant ID: Not Available From Registry
Registrant Name: peter james
Registrant Street: suite 100, white house abuja
Registrant City: abuja
Registrant State/Province: Other
Registrant Postal Code: 23409
Registrant Country: NG
Registrant Phone: +234.323384894
Registrant Email: fillscholar162@gmail.com

Initial registrant details:
Registrant Name: aremo gbenga
Registrant Street: suite 100, white house abuja
Registrant City: abuja
Registrant State/Province: Other
Registrant Postal Code: 23409
Registrant Country: NG
Registrant Phone: +234.323384894
Registrant Email: daremcommercial@yahoo.com

[firefly]

Subdomains of the site are used as login pages on various other fake sites created by the same fake sites maker(s).

From the fake site details - https://db.aa419.org/fakebanksview.php?key=122076:
Domain Name: IBNKCLIENTONLINELOGIN.COM
Updated Date: 2016-11-29
Creation Date: 2016-06-24
Registrar Registration Expiration Date: 2017-06-24
Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com

Registry Registrant ID: Not Available From Registry
Registrant Name: david bright
Registrant Organization: ibnkclientonlinelogin
Registrant Street: world visio uk 11 belgrave road
Registrant City: belgrave road
Registrant State/Province: London
Registrant Postal Code: SW1V 1RB
Registrant Country: GB
Registrant Phone: +44.447452265818
Registrant Email: davidbright587@yahoo.com

This is what the login generic page is looking like:

[firefly]

The domain icbnkccn.com was created only for the email address, while impersonating IC Bank. At the begin of 2017, the domain was used as a contact on another newly created fake site - bnkicbcstduk.com:

Bank Address:
6101 Waterford Blvd Ste 325
Oklahoma City, OK 73118
Tel : +1 405 561 1095
Email Address
Support : info@icbnkccn.com

+14055611095 - Google VoIP number

From the fake site details - https://db.aa419.org/fakebanksview.php?key=122078:
Domain Name: ICBNKCCN.COM
Updated Date: 2016-06-25
Creation Date: 2016-06-24
Registrar Registration Expiration Date: 2017-06-24
Registrar: CRAZY DOMAINS FZ-LLC
Reseller: GLOBEHOST INDIA PRIVATE LIMITED

Registry Registrant ID: 21048319
Registrant Name: ARE GAB
Registrant Street: BLOCK 100, JAKANDE ESTATE,
Registrant City: ISOLO
Registrant State/Province: LAGOS
Registrant Postal Code: 23401
Registrant Country: NG
Registrant Phone: +234.2348023323327
Registrant Email: gbegab2@yahoo.com

bnkicbcstduk.com

The brand new fake bank, initially using US location and phone number become, the very next day after being registered, an UK bank:

Bank Address: 20 Gresham Street London EC2V 7JE
+44-2033897849
icbcstandardb@gmail.com

+442033897849
Number billable as geographic number
Country or destination United Kingdom
City or exchange location London
Original network provider* Exa Networks Limited

The rest of the fake site remained the same.

Our banking services are available to all U.S. account holders.

From the fake site details - https://db.aa419.org/fakebanksview.php?key=122079:

Domain Name: BNKICBCSTDUK.COM
Updated Date: 2017-01-27
Creation Date: 2017-01-26
Registrar Registration Expiration Date: 2018-01-26
Registrar: CRAZY DOMAINS FZ-LLC
Reseller: GLOBEHOST INDIA PRIVATE LIMITED

Registry Registrant ID: 21558073
Registrant Name: JOHN BILLIE
Registrant Street: 15, TEJUOSHO STREET, LAGOS
Registrant City: LAGOS
Registrant State/Province: LAGOS
Registrant Postal Code: 23401
Registrant Country: NG
Registrant Phone: +234.2348044836729
Registrant Email: johnbillie13@yahoo.com

This is what the fake site is looking like:

The victims are directed to a login page using a subdomain of the previously reported portal:

[firefly]

icbcstandardb@gmail.com

The email address was used as a contact on another fake site pretending to be International Development Bank of Commerce:

Our Office
Bank Address:
20 Gresham Street London EC2V 7JE

Give Us A call
Tel : +44-2033897849

Email Address
Support : icbcstandardb@gmail.com

+442033897849
Number billable as geographic number
Country or destination United Kingdom
City or exchange location London
Original network provider* Exa Networks Limited

... and changed again a day after the fake site was registered; the Uk bank become, in 24 hours, an US bank:

Our Office

Bank Address:
350 5th Ave, New York, NY 10118
Give Us A call

Tel : +1 (414) 765 2250
Email Address

Support : support@idbnkoc.com
customercare@idbnkoc.com

+14147652250 - Bandwidth SMSEnabled VoIP number

From the fake site details - https://db.aa419.org/fakebanksview.php?key=122081:
Domain Name: IDBNKOC.COM
Updated Date: 2017-02-02
Creation Date: 2017-02-01
Registrar Registration Expiration Date: 2018-02-01
Registrar: CRAZY DOMAINS FZ-LLC
Reseller: GLOBEHOST INDIA PRIVATE LIMITED

Registry Registrant ID: 21575627
Registrant Name: FARWEST OCEAN
Registrant Street: 78, OBAFEMI AWOLOWO WAY
Registrant City: IKEJA
Registrant State/Province: LAGOS
Registrant Postal Code: 23401
Registrant Country: NG
Registrant Phone: +234.2347027739183
Registrant Email: farwestocean@outlook.com

This is what the fake site is looking like:

For their login page, the scammers are using a new domain: client7653-cgsdsc.com:

From the fake site details - https://db.aa419.org/fakebanksview.php?key=122082; the registrant is using the privacy protection given by the registrar to hide his identity:
Domain name: CLIENT7653-CGSDSC.COM
Creation Date: 2017-01-30
Updated Date: 2017-01-30
Registrar Registration Expiration Date: 2018-01-30
Registrar: NAMECHEAP INC
Reseller: NAMECHEAP INC
Domain Status: addPeriod
Registrant Name: WhoisGuard Protected

This is what the fake site is looking like:

[firefly]

+44-2033897849

Same trick about the phone number on another fake bank - myrhbnk.com, impersonating RHB Capital Bhd, founded in Malaysia in 1994 and using the present name since 1997.

Old contact details:

Our Office
Bank Address:
20 Gresham Street London EC2V 7JE

Give Us A call
Tel : +44-2033897849

Email Address
Support : info@myrhbank.com

A week after the domain got registered, the UK bank becomes a Malaysian one...

Email Address
Support : info@myrhbank.com

Bank Address: Lot Lc-C03, Concourse Floor, Suria KLCC, Kuala Lumpur city, Centre, 50088

03-9604816
0168263827

info@myrhbank.com

+6039604816 - geographic number in Selangor
+60168263827 - mobile number

And, of course...

Our banking services are available to all U.S. account holders.

From the main fake site details - https://db.aa419.org/fakebanksview.php?key=122083:
Domain Name: MYRHBNK.COM
Updated Date: 2017-02-02
Creation Date: 2017-02-01
Registrar Registration Expiration Date: 2018-02-01
Registrar: CRAZY DOMAINS FZ-LLC
Reseller: GLOBEHOST INDIA PRIVATE LIMITED

Registry Registrant ID: 21575631
Registrant Name: FARWEST OCEAN
Registrant Street: 78, OBAFEMI AWOLOWO WAY
Registrant City: IKEJA
Registrant State/Province: LAGOS
Registrant Postal Code: 23401
Registrant Country: NG
Registrant Phone: +234.2347027739183
Registrant Email: farwestocean@outlook.com

From the domain used as email address details - https://db.aa419.org/fakebanksview.php?key=122084:
Domain Name: MYRHBANK.COM
Updated Date: 2017-02-10
Creation Date: 2017-02-03
Registrar Registration Expiration Date: 2018-02-03
Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com

Registry Registrant ID: Not Available From Registry
Registrant Name: sam
Registrant Organization: alak
Registrant Street: 2, cemetry road
Registrant City: badagry
Registrant State/Province: Lagos
Registrant Postal Code: 23401
Registrant Country: NG
Registrant Phone: +234.7043952827
Registrant Email: farwestocean@outlook.com

This is what the fake site is looking like:

The login page prepared for the victims is using another subdomain of another fake site:

From the fake site details - https://db.aa419.org/fakebanksview.php?key=122085; the registrant is using the privacy protection given by the registrar to hide his identity:
Domain Name: MYLOGINFODATAHTM.INFO
Updated Date: 2017-02-01
Creation Date: 2017-02-01
Registry Expiry Date: 2018-02-01
Registrar: NameCheap, Inc
Registry Registrant ID: qvmrtpldbp16fu39
Registrant Name: WhoisGuard Protected

[firefly]

The fake site claimed to represent Idris Laval, former Central Bank of Nigeria governor. The domain was active for a year and it was deleted after that period of time.

From the fake site details - https://db.aa419.org/fakebanksview.php?key=122086:
Domain Name: IDRISLAWALCBNOFFICE.COM
Updated Date: 2015-10-03
Creation Date: 2014-10-03
Registrar Registration Expiration Date: 2015-10-03
Registrar: Instra Corporation Pty Ltd.
Reseller: Instra Corporation Pty Ltd
Registry Registrant ID:
Registrant Name: Aremo Gbenga
Registrant Organization: Darem Commercial Company
Registrant Street: Block 63 flat 3, jakande estate, mile 2
Registrant City: Mile 2
Registrant State/Province: Lagos
Registrant Postal Code: 23401
Registrant Country: NG
Registrant Phone: +234.8036435894
Registrant Email: daremcommercial@yahoo.com

[firefly]

Both fake sites are impersonating Immaculata Law Firm, LLC, attorney office in the US. Both domains were used only for the email address.

From the fake site details of the first one - https://db.aa419.org/fakebanksview.php?key=122087:
Domain Name: IMCCLAW.COM
Updated Date: 2016-06-15
Creation Date: 2016-04-15
Registrar Registration Expiration Date: 2017-04-15
Registrar: Domainshype.com, Inc
Registry Registrant ID: Not Available From Registry
Registrant Name: Jimi cage
Registrant Organization: jimidomains
Registrant Street: 25 River St, Apt 4
Registrant City: Hartford
Registrant State/Province: Connecticut
Registrant Postal Code: 06101
Registrant Country: US
Registrant Phone: +1.3024657326
Registrant Email: academyglobalxyz@gmail.com

The initial registrant:
Registrant Name: aremo gbenga
Registrant Organization: N/A
Registrant Street: suito100, amadu plaza, abuja
Registrant City: abuja
Registrant State/Province: Abuja Capital Tercltory
Registrant Postal Code: 23409
Registrant Country: NG
Registrant Phone: +234.8023131313
Registrant Email: gbegab2@yahoo.com

From the fake site details of the second one - https://db.aa419.org/fakebanksview.php?key=122088:
Domain Name: immaclaw.com
Update Date: 2016-03-18
Creation Date: 2016-03-18
Registrar Registration Expiration Date: 2017-03-18
Registrar: GoDaddy.com, LLC
Registry Registrant ID: Not Available From Registry
Registrant Name: Aremo gbenga
Registrant Organization:
Registrant Street: suite 100 abuja plaza
Registrant City: abuja
Registrant State/Province: abuja
Registrant Postal Code: 23409
Registrant Country: NG
Registrant Phone: +234.8096607530
Registrant Email: samlocoasp@yahoo.com