charles.i1@outlook.com

[firefly]

This Nigerian faker maker was recently reported in https://www.scamsurvivors.com/forum/vie ... =6&t=38897. He likes to use free subdomains for the stolen content and fake login pages and domain names for the email addresses associated with the fraudulent content showed on the free subdomains. He mostly impersonates banks and delivery companies.

The domain names used only for the email address are all resoving to Zoho, while being registered with NameCheap. Weird that the registrar mist noticing the same email address and phone number being used with different names in different locations...

Since May 25, 2018, the way ICANN decides to implement the General Data Protection Regulation (GDPR) strips the registrant details. For domain names registered before that date, there are alternate options to find those details. Here is an example of what we cannot officially see anymore. We did not expose the identity of a real European resident. The details are entirely fake and were used to register the fraudulent domains reported in this topic.

Fake WHOIS details:

Registrant Name: Charles Igwe
Registrant Organization:
Registrant Street: 78 Calmag Avenue
Registrant City: Ikeja
Registrant State/Province: Lagos
Registrant Postal Code: 234001
Registrant Country: NG
Registrant Phone: +234.9055327590
Registrant Email: charles.i1@outlook.com

and:

Registrant Name: Ella Aroyo
Registrant Organization:
Registrant Street: 78 Calmag Avenue
Registrant City: Abaji
Registrant State/Province: Abuja
Registrant Postal Code: 234001
Registrant Country: NG
Registrant Phone: +234.9055327590
Registrant Email: charles.i1@outlook.com

There is no Calmag Avenue anywhere in Nigeria. Cal-Mag is a custom plant supplement. Still, we see that street name in two different cities in the same time. Those cities are not even close; distance from Ikeja to Abaji is over 600 km or 10 hours drive. Charles Igwe and Ella Aroyo are as real as their location is.

[firefly]

The fake sites claims to be Alpha Group Bank.

Alpha Group is one of Russia's largest privately owned investment groups, founded in 1989. Alfa-Banking Group includes Alfa-Bank Russia, Alfa-Bank Ukraine, banks in the Netherlands (Amsterdam Trade Bank), Belarus and Kazakhstan as well as financial subsidiaries in Cyprus, United Kingdom and the United States.

The fake one is active from a free subdomain, while pretending to be located in Brazil. From the fake site:

Alpha Group commence operation decades ago and has over the years recorded a massive investment and improvement, starting from the managerial team to the operational team work.

Contact details:

R. Lydia Ferrari Magnoli, Conjunto 304, 108 - Jardim Avelino,
São Paulo - SP, 03227-085, Brazil
Email: info@alphaagroup.com

They have an insecure page for opening an account, where the victim is asked to file his/her details in, and also an insecure login page.

This is what the fake site looks like:

There is also alphaagroup.com, used only for the email address. In the meantime, Charles changed his name and gender, while using the same email address and phone number. For the fake site details: https://db.aa419.org/fakebanksview.php?key=133823.

Domain name: alphaagroup.com
Updated Date: 2018-08-09
Creation Date: 2017-08-08
Registrar Registration Expiration Date: 2019-08-08
Registrar: NAMECHEAP INC
Reseller: NAMECHEAP INC

Registry Registrant ID:
Registrant Name: Ella Aroyo
Registrant Organization:
Registrant Street: 78 Calmag Avenue
Registrant City: Abaji
Registrant State/Province: Abuja
Registrant Postal Code: 234001
Registrant Country: NG
Registrant Phone: +234.9055327590
Registrant Email: charles.i1@outlook.com

There is also an alphasplc.com also used only for the email address. For the fake site details: https://db.aa419.org/fakebanksview.php?key=133822.

From the fake site details:

Domain name: alphasplc.com
Updated Date: 2017-10-05
Creation Date: 2017-10-05
Registrar Registration Expiration Date: 2018-10-05
Registrar: NAMECHEAP INC
Reseller: NAMECHEAP INC

Domain Status: addPeriod
Registry Registrant ID:
Registrant Name: Ella Aroyo
Registrant Organization:
Registrant Street: 78 Calmag Avenue
Registrant City: Abaji
Registrant State/Province: Abuja
Registrant Postal Code: 234001
Registrant Country: NG
Registrant Phone: +234.9055327590
Registrant Email: charles.i1@outlook.com

And there was alphafinanceplc.com, impersonating the same Alpha Bank, registered with the same name, but different email address and location, and suspended by the Registrar after being reported for fraudulent activities:

Domain Name: ALPHAFINANCEPLC.COM
Updated Date: 2018-02-23
Creation Date: 2018-02-23
Registrar Registration Expiration Date: 2019-02-23
Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com

Registry Registrant ID: Not Available From Registry
Registrant Name: Ella Aroyo
Registrant Organization: Aroyo GmbH
Registrant Street: 48 Boulevard Jourdan, 75014 Paris, France.
Registrant City: Paris
Registrant State/Province: Paris
Registrant Postal Code: 75020
Registrant Country: FR
Registrant Phone: +33.755416543
Registrant Email: aroyoella@yahoo.com

Same details of "Ella Aroyo" were also reported in https://www.scamsurvivors.com/forum/vie ... =6&t=66105 with zenithnigltd.com, domain name used to impersonate Zenith Bank, also suspended now for fraudulent activities.

[firefly]

The fake site claims to be Blink Link Express Delivery on a page and World Linked Express Shipping on another page..

We’re Blink Link Express Shipping. Every day our 600 delivery experts deliver more than 300,000 parcels across the world's largest road network and beyond. Every relationship we build along the way matters to us. Our ambition is to be the best delivery partner to work with. So we’re continuously evolving our customer experience to deliver brilliantly simple solutions that make sending and receiving parcels easier and more flexible.

From their "Contuct Us" page:

9th Fl, Green Tower, 3546/22-24 Rama IV Road, Bangkok, Thailand.
support@blink-linkexpress.com

The same location was previously reported in viewtopic.php?f=17&t=48478 in 2016, with blinkglobalservices.com, another fake site pretending to be the same Blink...

For the fake site details: https://db.aa419.org/fakebanksview.php?key=133823.

From the fake site details:

Domain name: blink-linkexpress.com
Updated Date: 2018-03-25
Creation Date: 2018-03-16
Registrar Registration Expiration Date: 2019-03-16
Registrar: NAMECHEAP INC
Reseller: NAMECHEAP INC

Registry Registrant ID:
Registrant Name: Ella Aroyo
Registrant Organization:
Registrant Street: 78 Calmag Avenue
Registrant City: Abaji
Registrant State/Province: Abuja
Registrant Postal Code: 234001
Registrant Country: NG
Registrant Phone: +234.9055327590
Registrant Email: charles.i1@outlook.com

This is what the fake site looks like:

[firefly]

The fake site claims to be Bank of China. The real financial institution with this name was founded in 1912 in Bejing.

The fake one was created on July 13, 2018 in Nigeria. There is no content; the domain name is used only for the email address, abusing a Zoho account.

From the fake site details: https://db.aa419.org/fakebanksview.php?key=133824.

From the fake site details:

Domain name: boc-cns.com
Updated Date: 2018-07-13
Creation Date: 2018-07-13
Registrar Registration Expiration Date: 2019-07-13
Registrar: NAMECHEAP INC
Reseller: NAMECHEAP INC

Registry Registrant ID:
Registrant Name: Ella Aroyo
Registrant Organization:
Registrant Street: 78 Calmag Avenue
Registrant City: Abaji
Registrant State/Province: Abuja
Registrant Postal Code: 234001
Registrant Country: NG
Registrant Phone: +234.9055327590
Registrant Email: charles.i1@outlook.com

[firefly]

The fake site claims to be Federal Reserve Bank. There is no content, the fraudulent domain name is used only for the email address, abusing a Zoho account.

For the fake site details: https://db.aa419.org/fakebanksview.php?key=133825.

From the fake site details:

Domain name: us-reserve.com
Updated Date: 2018-07-05
Creation Date: 2018-07-05
Registrar Registration Expiration Date: 2019-07-05
Registrar: NAMECHEAP INC
Reseller: NAMECHEAP INC

Registry Registrant ID:
Registrant Name: Ella Aroyo
Registrant Organization:
Registrant Street: 78 Calmag Avenue
Registrant City: Abaji
Registrant State/Province: Abuja
Registrant Postal Code: 234001
Registrant Country: NG
Registrant Phone: +234.9055327590
Registrant Email: charles.i1@outlook.com

[firefly]

The fake site claims to be D & A Filtration Group. The domain name is likely used in procurement scams.

From the fake site:

D & A Filtration has been a leader in fuel and oil conditioning for more than 2 years.Our company, however, began its impressive growth more than 2 years ago with a single solution – the invention of a water pump.

According to a press release posted on the fake site:

Press Release: D & A Filtration Joins Filtration Group Corporation
Jul 01, 2015

Indeed, there is a Filtration Group Corporation, active since 1942.

The domain name was registered in January 2018. The content is stolen from one of the real company subsidiaries websites.

There is no location on the fake site and no phone number:

Complete the form below and you will be contacted by a Solutions Expert to explore the opportunities of engineering a solution for you!
Email us today at filtration@dandafiltration.com.

There is no form either.

For the fake site details: https://db.aa419.org/fakebanksview.php?key=133826.

From the fake site details:

Domain name: dandafiltration.com
Updated Date: 2018-01-26
Creation Date: 2018-01-25
Registrar Registration Expiration Date: 2019-01-25
Registrar: NAMECHEAP INC
Reseller: NAMECHEAP INC

Domain Status: addPeriod
Registry Registrant ID:
Registrant Name: Ella Aroyo
Registrant Organization:
Registrant Street: 78 Calmag Avenue
Registrant City: Abaji
Registrant State/Province: Abuja
Registrant Postal Code: 234001
Registrant Country: NG
Registrant Phone: +234.9055327590
Registrant Email: charles.i1@outlook.com

This is what the fake site is looking like:

[firefly]

The fake site claims to be Empire Trust Finance. The fake site is used in recovery scams.

Scam format used:

Loomis UK Limited.
Loomis is the UK's Cash,Bond industry financials.
RC: Registered number 3200432

Dear Valued Customer

With confirmed report before us now, your account has been credited with the sum of US$15M being your long awaited inheritance fund.

The successful transferred of the second batch of approved sum of (US$15M) which was transmitted into your bank account as requested from our Apex Bank in Brazil.
As the matter of urgency,contact your bank for the telex confirmation and update us accordingly to enable us close your payment file.
The Fund was Transferred from the desk of:

The Account Officer:MARIO DOS SANTOS (International Transfers Unit)
The Fund is coming from": EMPIRE TRUST FINANCE - BRAZIL
BANK NAME: EMPIRE TRUST FINANCE
ADDRESS: São Paulo - SP, 01310-200, Brazil.
Tel: +55(119)4829-1607 | Fax: +55(113)958-0449

You can contact the account officer directly if you have any delay pls.
lastly,right now check your mobile number for the transfer signal alert of successful transferred sum of US$15M from our Affiliated paying Bank (Empire Trust Bank) in Brazil.

Lets know if you have received the transfer alert from the paying Bank in favour.

Thanks and awaiting your reply,Reply-to address: feedback-olaf@yandex.com

Yours Faithfully,

Engr. Joel Raymond (Director)
Foreign Reserve Escrow Account Officer
Loomis Groups - UK .
1 Alder Court, Rennie Hogg Road, Nottingham, NG2 1RX.

From the fake site:

Empire Trust Investment has been in existence for years. It started from a small scale business daily contribution and grew rapitly to a multi-national financial firm, with a reliable stronghold ranging from multi-millions corporations and partnership with a strong level of influence in the stock market. Empire Trust Finance has recorded a massive report in business investment over the years

Contact details:

Empire Trust Finance
1802 Avenida Paulista,
Sao Paulo,
Brasil
Tel: +55(119)4829-1607
Fax: +55(113)958-0449
Email: info@empiretrusts.com

+5511948291607
Number billable as mobile number
Country or destination Brazil
City or exchange location São Paulo
Original network provider* TIM Celular S.A.

+551139580449
Number billable as geographic number
Country or destination Brazil
City or exchange location São Paulo, São Paulo
Original network provider* Global Crossing Comunicacoes do Brasil Ltda.

For each fee the fraudsters are asking for, the victim receives a code needing to be validated. There is a page for each and every one of these.

Money Laundering Clearance:

International Monetary Fund code:

Cost of transfer:

There was nor is any active bank in Brazil named Empire Trust Finance. Still, while searching for the company location online, Google will be able to provide a map and also show that a company with that name is located there:

How is that possible? Easy: scammers are abusing a loophole in the Maps API that allows for redirects to be put into Google Maps URLs. They chain the links to their fake sites within a link to Google Maps, essentially creating a more trustworthy URL that potential victims are more likely to follow.

"has been in existence for years" means since August 2018. The so called Brazilian bank is operated from Nigeria. For the fake site details: https://db.aa419.org/fakebanksview.php?key=133828.

From the fake site details:

Domain name: empiretrusts.com
Updated Date: 2018-08-09
Creation Date: 2018-08-09
Registrar Registration Expiration Date: 2019-08-09
Registrar: NAMECHEAP INC
Reseller: NAMECHEAP INC

Registry Registrant ID:
Registrant Name: Ella Aroyo
Registrant Organization:
Registrant Street: 78 Calmag Avenue
Registrant City: Abaji
Registrant State/Province: Abuja
Registrant Postal Code: 234001
Registrant Country: NG
Registrant Phone: +234.9055327590
Registrant Email: charles.i1@outlook.com

This is what the fake site looks like: