Advert.

Do NOT tell your scammer he is posted here, or report their accounts as it puts others at risk!

edegwaregift@rocketmail.com

Report any emails with fake links attempting to steal your ID, and any fake sites used by scammers.

edegwaregift@rocketmail.com

Unread postby firefly » Tue Oct 12, 2021 10:12 pm

We decided to investigate this case after few of his fake sites cropped up in recent scam attempts.

To get an idea, globaffairsfin.com and globalafairsfinance.com pretended to be a bank named Global Affairs Finance and are reported on our forum here: viewtopic.php?f=6&t=92350, while being used in a compensation scam allegedly provided by a bogus entity named the United Nation Compensation Commission.

Likewise we found deutschebnk.com impersonating Deutsche Bank in a recovery scam reported here: viewtopic.php?f=6&t=89899.

Then we also found firstpilarfinance.com & firstpillarfinance.com pretending to be First Pillar Finance, reported in a next of kin scam here: viewtopic.php?f=6&t=92152.
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70956
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

Re: edegwaregift@rocketmail.com

Unread postby firefly » Tue Oct 12, 2021 10:16 pm

The faker maker history goes back to 2016.

On his online social accounts, he claims to be:

Edegware Gift(Gsoft)
Entrepreneur | Android Developer | iOs Developer | Web Consultant
C.E.O. at Gsoft Interactive
Lives in Port Harcourt
From Warri, Nigeria


His business approach:

Boring websites get ignored; We will help you standout!
Focus on your business, while we focus on your website. You Run the business/Organization you know, we will build the website you need.
Take your business to it's next level with the help of our Experienced Web developers.
Call/WhatsApp now : 08161806959


This is what the faker maker looks like (images with his wife, children and friends not posted):

gsoft.JPG

gsoft1.JPG

gsoft2.JPG

gsoft3.JPG


Some of his creations he signed on were suspended:

- abnnamrro.com - pretending to be ABN Amro Bank
- americaninvestmentbnk.online - pretending to be American Investment Bank
- boa-group.online - pretending to be Bank of America
- creleobank.online - pretending to be Creleo Bank / Crest Investment Bank
- fargoeinvestmentbank.online - pretending to be Wells Fargo
- illoydslogin.online - pretending to be LLoyds Bank

Some died of natural causes (expired):
- usarmymil.online - pretending to be the US Army website
- militaryrescuebaseservice.online - pretending to be a Military Rescue Base Service
- unitednationscourierservice.xyz - pretending to be the United Nations Courier Service.
- lakecityarmyammunitionplant.org - pretending to be Lake City Army Ammunition Plant
- unitednationfinancesecuritycompany.online - pretending to be the United Nation Finance Security Company
- dhlbenin.com - pretending to be DHL Benin


Having the domain names he registered suspended, is proof he must be aware of the fraudulent use of his services.

The choice of domain names also shows clear intent to impersonate and could impossibly have been missed.

The entire list of his fraudulent domain names can be found here: https://db.aa419.org/fakebankslist.php? ... =giftguard.
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70956
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

Re: edegwaregift@rocketmail.com

Unread postby firefly » Tue Oct 12, 2021 10:17 pm

He was reported for the first time with a fake job agency site, pretending to be Spring World Recruitment Agency.

Type of message received by victims:

From: info.springworldrecruitment@yahoo.com
Sent: Wed, 27 Jul 2016
Subject: MANPOWER JOB VACANCY, UNITED KINGDOM

SPRING WORLD RECRUITMENT AGENCY, Victory Way, Admirals Park, Crossways, Dartford, DA2 United Kingdom Skype Id: info.springworldrecruitment REF: SWRA/FE/BATCHJ/89014 Date: 27/07/2016 Dear Sir/Madam MANPOWER JOB VACANCY, UNITED KINGDOM. Season greetings to you from SPRING WORLD RECRUITMENT AGENCY, My name is James Becker and I am the Director of Spring World Recruitment Agency located here in London, United Kingdom. We are currently recruiting Skilled and unskilled workers to work for Company here in the United Kingdom. We seek you to supply us workers according to the following conditions. Available Positions: (a) Food Packers Salary per hour: £17 (Seventeen Great Britain Pounds) Contract: 3 years and renewable (b) Cleaners Salary per hour: £20 (Twenty Great Britain Pounds) Contract: 3 years and renewable (c) Fish Packers Salary per hour: £17 (Seventeen Great Britain Pounds) Contract: 3 years and renewable (d) Domestic Maids Salary per hour: £15 (Fifteen Great Britain Pounds) Contract: 3 years and renewable (e) General Workers Salary per hour: £20 (Twenty Great Britain Pounds) Contract: 3 years and renewable (f) Drivers Salary per hour: £19 (Ninteen Great Britain Pounds) Contract: 3 years and renewable (g) Securities Salary per hour: £17 (Seventeen Great Britain Pounds) Contract: 3 years and renewable (i) Cashier/Secretary Salary per hour: £20 (Twenty Great Britain Pounds) Contract: 3 years and renewable (j) Supervisors Salary per hour: £30 (Thirty Great Britain Pounds) Contract: 3 years and renewable (k) Engineer Salary per hour: £30 (Thirty Great Britain Pounds) Contract: 3 years and renewable (l) Walter/Waitress Salary per hour: £17 (Seventeen Great Britain Pounds) Contract: 3 years and renewable Worker's benefit (free of Cost) (a) Accommodation (b) Medical/life insurance (c) Transportation (d) Air tickets (E-Tickets) (e) Feeding (f) Tier2 Visa (g) Education support programme. Other Benefits are according to United Kingdom's Labor Law and Employee's Benefit Plan. Type of workers needed: All workers must be above the age of 20 to apply.(Male and Female) Educational Qualification needed: No educational qualification or experience needed as workers will undergo 2 weeks compulsory paid job training and even freshers can apply. To further proceed, please quote how many workers you have at hand so that we can prepare all legal documents and attest it at the Consul office here in United Kingdom. Regards, James Becker Director, SPRING WORLD RECRUITMENT AGENCY Skype Id: info.springworldrecruitment


Contact details used on the fake website:

info@springworldrecruitment.com
+447045704116
Victory Way, Admirals Park, Crossways, Dartford, DA2 United Kingdom


Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=115364.
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70956
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

Playing between identities

Unread postby firefly » Tue Oct 12, 2021 10:19 pm

In 2016, the faker maker used his company details while registering the fake site:

Registrant Name: Gift Gsoft
Registrant Organization: Gsoft Interactive
Registrant Street: Flat 24, house of Assembly, Aluu Flat 24, house of Assembly, Aluu
Registrant City: Aluu
Registrant State/Province: Rivers state
Registrant Postal Code: 234
Registrant Country: NG
Registrant Phone: +234.08161806959
Registrant Email: edegwaregift@rocketmail.com

In the meantime, he learned to abuse the services of various Registrars, having his identity shielded by the privacy protection given by the Registrars. Still, nothing can be hidden forever.

His hew online "persona" for domain registrations is now:

Registrant Name: uptimehost uptimehost
Registrant Organization: uptimehost inc.
Registrant Street: 4042 Circle Drive , Houston
Registrant City: Houston
Registrant State/Province: TX
Registrant Postal Code: 77020
Registrant Country: US

There is no Circle Drive in Houston. There is a Timberside Cir Dr, but the Zip code is not 77020.

No business named Uptimehost is legally registered in the 77020 Houston Texas area (Harris County).

Also:

Registrant Name: uptimehost uptimehost
Registrant Organization: Uptimehost Inc.
Registrant Street: 525 Federal Street Bluefield
Registrant City: WV-Bluefield
Registrant State/Province: WV
Registrant Postal Code: 24701
Registrant Country: US

The location is stolen from Summit Community Bank.

In and between he is also:

Registrant Name: Gift Edegware
Registrant Organization: The Empire
Registrant Street: J. Innovations Plaza, Ekpan
Registrant City: Warri
Registrant State/Province: Delta
Registrant Postal Code: 234
Registrant Country: NG
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70956
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

Fake banks

Unread postby firefly » Tue Oct 12, 2021 10:20 pm

All the banks in his portfolio are either spoofs or bogus.

The reason for the bogus ones is simple: a fake bank not using a real bank identity or logo cannot be reported for spoofing that real bank and there are less chances of being suspended.

The fake sites are almost identical, with the single difference of color scheme, contact details and bogus names used.

We have identified 36 banks so far claiming:

(...) has stayed Over 36 years of existence and registered UK afflicted based financial institution that have been operating in so many countries with a high reputation. (...) authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and the Prudential Regulation Authority under registration number 293836.


(...) is the name of the bogus bank, replaced from a fake bank website to the next one.

Not a single one of them is real since the registration number 293836 doesn't exist on either Prudential Regulation Authority or Financial Conduct Authority registers.

- alliedcommercialbk.com - Allied Commercial Bank
- banktfi.online - TFI Bank (now suspended)
- citizenfinancegroup.com - CitizenFin Group
- commercialbnk.net - Commercial Bank
- crestfinancialbk.online - Crest Financial (now suspended)
- crestfinancialbnk.online - Crest Financial (now suspended)
- diamondfinancialbnk.online - Diamond Financial Bnk (now suspended)
- fibsocietebank.online - Fibsociete Bank (now suspended)
- fieldstonebks.com - Field Stone Bank
- firstcommercial.online - First Commercial Bank (now suspended)
- firstgulfweste.com - First Gulf West Bank
- firstpilarfinance.com - First Pilar Finance
- firstpillarfinance.com - First Pillar Finance
- globaffairsfin.com - Global Affairs Finance
- globalafairsfinance.com - Global Affairs Finance
- internationalbnk.com - International Bank of Asia
- islamicinvestmentsbc.com - Islamic Investment Bank
- mtloginaccess.online - Metro Bank Plc (now suspended)
- pamorisbk.com - Pamoris Bank
- pinaclecreditunion.online - Pinacle Credit Union (now suspended)
- pinaclecreditunion.xyz - Pinacle Credit Union
- royalimperialbnk.online - Royal Imperial Bank US (now suspended)
- sprintbk.com - Sprint Bank
- standardstrust.online - Outstanding Standards (now suspended)
- sterlingbkng.com - Sterling Bank Nigeria
- stonetrustbk.com - StoneTrust Bank
- swissfinsec.online - Swiss Finance
- tfi-bank.online - Trust Funds Investment Bank (now suspended)
- tfibnk.online - Trust Funds Investment Bank (now suspended)
- thecapitalcitybank.online - - The Capital City Bank
- thecapitalcitybnk.online - The Capital City Bank(now suspended)
- thecrestbnk.online - The Crest Bank (now suspended)
- thecrestfinancialbk.online - Crest Financial Bank (now suspended)
- thecrestglobalbank.online -Crest Global Bank (now suspended)
- trustaccess.online - Trust Access
- ubgroupbenin.com - United Bank of Africa
- unitedbkafric.com - United Bank of Africa
- unitybankingn.com - Unity Bank Nigeria
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70956
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

Additional fake banks

Unread postby firefly » Tue Oct 12, 2021 10:22 pm

The total number of fake sites created by this Nigerian faker maker to impersonate banks is 59.

The faker maker used again the same templates for all of them and sometimes even the same made-up locations:

- arinvsb.com - Al Rayyan Investment Bank (ARIB)
- boa-group.online - Bank of America (expired)
- cazenovetrustcapital.online - Cazenove Trust Capital (now suspended)
- cheesegroups.com - Cheese (the scammer's own version of Chase Bank)
- creleobank.online - Creleo Bank / Crest Investment Bank (now suspended)
- crestfinancialinc.online - Crest Financial Corp (now suspended)
- crestinvestmentbank.online - Crest Investment Bank (now suspended)
- cresttrustbnk.online - Crest Trust Bank (now suspended)
- deutschebnk.com - Deutsche Bank New York
- dimasinternational.com - Dimas Bank Intl
- firsttcreditus.com - First US Community Credit Union
- gtbaniks.com - Guaranti Trust Bank
- herthabank.online - Hertha Bank / Crest Investment Bank (now suspended)
- pyramidstandardbnk.online - Pyramid Standard Bank / Crest Investment Bank
- standardtb.online - Standard Trust Bank (now suspended)
- tfibanking.online - Trust Funds Investment Bank / Crest Investment Bank (now suspended)
- thecrestbank.xyz - Crest Bank
- usfirstbank.xyz - US First Bank
- vasqueinvestmentbank.online - Vasque Investment Bank (now suspended)
- wealthcapitalbnk.online - Wealth Capital Bank / Crest Financial Bank (now suspended).
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70956
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

Fake couriers

Unread postby firefly » Tue Oct 12, 2021 10:23 pm

We identified so far 16 fake couriers registered and maintained by the faker maker reported above:

- atlanticexpresscargodelivery.online - Atlantic Express Cargo Delivery
- capitalexpresscourierservice.online - Capital Express Courier Service
- easyshipcourierservices.online - Easy Ship Courier Services (now suspended)
- faroxtrack.com - Farox Track Delivery
- globaldcourierglogistics.online - Global D Courier G Logistics (now suspended)
- minikomsecurity.online - Minikom Security Company
- minikomsecurity.xyz - Minikom Security Company
- vast-expressdeliveryservices.online - Minikom Security Company (now suspended)
- skyroxpress.com - SkyroXpress
- superfastcourierservices.online -Superfast Courier Services
- swiftcourierdelivery.online- Swift Courier Delivery
- swiftcourierdeliveryltd.online - Swift Courier Delivery (now suspended)
- unitednationfinancecompany.online - United Nations Security Company (now suspended)
- waveportlogistics.com - WavePort Logistics Services
- westbestglobal.com - WestBest Global Delivery
- wosacs.com - Wosac's.
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70956
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

Crypto scams

Unread postby firefly » Tue Oct 12, 2021 10:25 pm

In most of the cases, the Nigerian crypto scams are done for two main reasons:
- stealing Bitcoin wallets credentials
or:
- encouraging victims to invest and asking for fees after fees when the victim tries to withdraw the money apparently earned.

A "specialty" of Nigerian scammers are crypto trading platforms, pretending to be UK registered and even using fake UK registration documents on their websites, despite of being located anywhere else.

For example, this was the registration certificate used with coinagefx.online - CoinageFx (now suspended), pretending to be active from 3015 Suit pagla road, Singapore.

Image

And this is what the registration certificate used with cryptowinningcoinsfx.com - Crypto Winning Coins Fx, allegedly active from 3144 Doctors Drive,Los Angeles, CA, USA 90017:

Image

From the fake crypto trading platforms identified so far, 3 are already suspended:

- coinagefx.online - CoinageFx
- coinancefx.online - CoinanceFx
- coinvoltfx.online - CoinVoltFx

Still active:

- cryptbithash.com - Official CryptBit Hash
- cryptechtrading.com - CrypTech Trading
- cryptohubmining.com - Official Cryptohub Mining
- cryptowinningcoinsfx.com - Crypto Winning Coins Fx
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70956
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

Al Rayyan Investment Bank - arinvsb.com

Unread postby firefly » Tue Oct 12, 2021 10:28 pm

Example of fake bank spoof.

The fake website is a spoof of the real Al Rayyan Investment Bank.

From the fake bank website:

Headquartered in Doha, Al Rayyan Investment Bank is a well-recognized financial institution focused on investment banking and asset management, in Qatar, UAE and across the Gulf region.
ARIB was established in 1995 with a fully paid-up capital of $100 million and was the first Shari’a compliant institution authorised by the Qatar Financial Centre Regulatory Authority (QFCRA) in the Qatar Financial Centre.


Contact details:

DUBAI OFFICE
7 Farouk Tower, El Fattan Hadaeq
Al Karamah Street , P.O Box 52093
Dubai, UAE
ABU DHABI OFFICE
Plot 230,Al Kazim Centre, 3rd Floor Suite 212
Building Al Saeed District, Al Khalid Plaza
Abu Dhabi, UAE.
Tel: +971 800 0320653


+9718000320653
Number billable as freephone number
Country or destination United Arab Emirates

Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=153204.

From the domain name registration:

Domain name: arinvsb.com
Updated Date: 2021-04-16
Creation Date: 2021-04-16
Registrar Registration Expiration Date: 2022-04-16
Registrar: NAMECHEAP INC
Reseller: NAMECHEAP INC

Registry Registrant ID:
Registrant Name: Withheld for Privacy Purposes
Registrant Organization: Privacy service provided by Withheld for Privacy ehf

This is what the fake website looks like:

arinvsb.JPG


Victims sent to arinvsb.com trying to log in were redirected to yet another fake Al Rayyan Investment Bank, active on the fraudulent domain name arinvestmentbk.com (now suspended).

arininvestment.JPG
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70956
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

Royal Imperial Bank - royalimperialbnk.online

Unread postby firefly » Tue Oct 12, 2021 10:32 pm

Example of bogus bank - Royal Imperial Bank.

From the fake website:

Royal Imperial Bank has stayed Over 36 years of existence and registered UK afflicted based financial institution that have been operating in so many countries with a high reputation. Royal Imperial Bank is authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and the Prudential Regulation Authority under registration number 293836.


Contact details:

3942 Medical Center Drive, Venice Floria, United States.
Email : support@royalimperialbnk.online


Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=153341.

From the domain name registration:

Domain Name: ROYALIMPERIALBNK.ONLINE
Updated Date: 2021-09-21
Creation Date: 2021-08-01
Registrar Registration Expiration Date: 2022-08-01
Registrar: Name.com, Inc.

Registry Registrant ID: Not Available From Registry
Registrant Name: uptimehost uptimehost
Registrant Organization: Uptimehost Inc.
Registrant Street: 525 Federal Street Bluefield
Registrant City: WV-Bluefield
Registrant State/Province: WV
Registrant Postal Code: 24701
Registrant Country: US
Registrant Phone: Non-Public Data

This is what the fake website looks like:

royalimperialbnk.JPG
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 70956
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

Next

Return to Fake sites/Phishing sites.

Who is online

Users browsing this forum: No registered users and 18 guests