Table of Contents
Active domains all have
hidden content:
Domain registration -
Registrant details:
on-citi.com (at registrar ilovewww.com)
rbi2.org
rbibv.org
rbifn.org
rbiiv.org
rbijnd.org
rbij.org
rbillni.org
rbilnidi.org
rbilni.org
rbindv.org
rbi-n.org
rbirbin.org
rbirlndi.org
rbirlnd.org
rbivj.org
rbiv.org
rbivt.org
rbiw.org
rbl-ln.org
rbnkin.org
rbsind.net
rbsruk.com
rbsuk-b.com
rbijnd.org
rbiv.org
All the active domains have hidden content spoofing the Royal Bank of Scotland or the Reserve Bank of India. The hidden content can either be found in the subdirectory /home/ or /uk/ (note, we are noticing a pattern of abuse, apart from you being the sponsoring registrar)
Registrant ID: NS-123B5EEAAE58D
Registrant Name: Max Track
Registrant Organization:
Registrant Street: No. 23 Benson Rod
Registrant City: imc
Registrant State/Province: imc
Registrant Postal Code: 23454
Registrant Country: NG
Registrant Phone: +234.8098708469
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: maxtrackexpress@outlook.com
·
No city
called imc
exists in Nigeria, nor any such state/province.
· Nigerian postal codes are six digits long. As such these details are bogus.
Registrant ID: NS-324A8E3BDF613
Registrant Name: frenka Lorincial
Registrant Organization:
Registrant Street: 48 Amadi Cresent
Registrant City: imc
Registrant State/Province: imc
Registrant Postal Code: 23454
Registrant Country: NG
Registrant Phone: +234.7084086464
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: freeloinc2015@yahoo.com
·
No city
called imc
exists in Nigeria, nor any such state/province.
· Nigerian postal codes are six digits long. As such these details are bogus.
Registrant ID: NS-5B7525C4EE7F6
Registrant Name: Ruge Ben
Registrant Organization:
Registrant Street: No. aba Road
Registrant City: Lag
Registrant State/Province: Lag
Registrant Postal Code: 23401
Registrant Country: NG
Registrant Phone: +234.08092659282
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: rbl_ln@yahoo.com
·
Are we to
assume Lag means Lagos?
·
This is
problematic in that Aba Road is a town ~ 600 kms/ 375
miles from Lagos. (see map below).
·
Once again
we have a five digit postal code, it should be six digits.
·
Tel no. +234.08092659282
is too long and should be +234.8092659282 if
legitimate.
Registrant ID: NS-D9FEAB54856BF
Registrant Name: Regina Iven
Registrant Organization:
Registrant Street: No. 18 Obinze St
Registrant City: imc
Registrant State/Province: imc
Registrant Postal Code: 23454
Registrant Country: NG
Registrant Phone: +234.07084086464
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: rbiiv205@yahoo.com
·
No city called imc exists in Nigeria, nor any such state/province.
·
Nigerian postal codes are six digits
long. As such these details are bogus.
·
Tel no. +234.07084086464 is too long and should be +234.7084086464 if legitimate.
Registrant ID: NS-D04B8A443F205
Registrant Name: Rsinal Indana
Registrant Organization:
Registrant Street: No. 2 Obinze
Registrant City: Lag
Registrant State/Province: Lagos
Registrant Postal Code: 23401
Registrant Country: NG
Registrant Phone: +234.08092659282
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: rbsind@yahoo.com
·
Note the
city name Lag. Should this be Lagos?
·
Nigerian
postal codes are six digits long. As such these details are invalid.
·
Tel no.
+234. 08092659282 is too long and should be +234.
8092659282 - if legitimate?
Registrant ID: NS-0AC81D577EB41
Registrant Name: Ken Doro
Registrant Organization:
Registrant Street: No. 18 Clent avenue
Registrant City: imc
Registrant State/Province: imc
Registrant Postal Code: 23454
Registrant Country: NG
Registrant Phone: +234.7084086464
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: carnivaluk-careers@outlook.com
·
No city called imc exists in Nigeria, nor any such state/province.
·
Nigerian postal codes are six digits
long. As such these details are bogus.
Registrant ID: NS-0F03F1C21F47E
Registrant Name: ik inno
Registrant Organization:
Registrant Street: 18 udo cresent
Registrant City: imc
Registrant State/Province: imc
Registrant Postal Code: 23454
Registrant Country: NG
Registrant Phone: +234.08098708469
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: ikinno2015@yahoo.com
·
No city called imc exists in Nigeria, nor any such state/province.
·
Nigerian postal codes are six digits
long.
·
Tel no.
+234.08098708469 is too long and should be +234.8098708469
- if legitimate?
Registrant ID: NS-D899812511029
Registrant Name: Red Ben
Registrant Organization:
Registrant Street: No. 5 Omo rd
Registrant City: imc
Registrant State/Province: imc
Registrant Postal Code: 23454
Registrant Country: NG
Registrant Phone: +234.08098708469
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: rbsvk20@yahoo.com
·
Note the
city name Lag. Should this be Lagos?
·
Nigerian
postal codes are six digits long. As such these details are invalid.
·
Tel no.
+234. 08092659282 is too long and should be +234.
8092659282 - if legitimate?
Registrant ID: NS-C0880497A5402
Registrant Name: Reginal Olina
Registrant Organization:
Registrant Street: No. 44 Rumuokuta
Registrant City: imc
Registrant State/Province: imc
Registrant Postal Code: 23454
Registrant Country: NG
Registrant Phone: +234.7084086464
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: rbiionline12@yahoo.com
•
No city
called imc exists in Nigeria, nor
any such state/province.
•
Nigerian
postal codes are six digits long.
Registrant ID: NS-D8074E9EC23E9
Registrant Name: frenka Lorincial
Registrant Organization:
Registrant Street: 48 Amadi Cresent
Registrant City: imc
Registrant State/Province: imc
Registrant Postal Code: 23454
Registrant Country: NG
Registrant Phone: +234.7084086464
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: freeloinc2015@yahoo.com
•
No city
called imc exists in Nigeria, nor
any such state/province.
•
Nigerian
postal codes are six digits long.
Registrant ID: NS-45597F4969CD6
Registrant Name: Ben Read
Registrant Organization:
Registrant Street: No. 2 Nasara Road
Registrant City: imc
Registrant State/Province: imc
Registrant Postal Code: 23454
Registrant Country: NG
Registrant Phone: +234.07084086464
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: rbivn11@yahoo.com
•
No city
called imc exists in Nigeria, nor
any such state/province.
•
Nigerian
postal codes are six digits long.
•
+234.07084086464
should be +234.07084086464 – if legitimate?
Registrant ID: NS-37CA3A34E5A60
Registrant Name: Rsinal Indana
Registrant Organization:
Registrant Street: No. 2 Obinze
Registrant City: Lag
Registrant State/Province: Lagos
Registrant Postal Code: 23401
Registrant Country: NG
Registrant Phone: +234.08092659282
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: rbsind@yahoo.com
• Note the city name Lag. Should this be Lagos?
• Nigerian postal codes are six digits long. As such these details are invalid.
• Tel no. +234. 08092659282 is too long and should be +234. 8092659282 - if legitimate?
Registrant ID: NS-8D00449EBA5E6
Registrant Name: frenka Lorincial
Registrant Organization:
Registrant Street: 48 Amadi Cresent
Registrant City: imc
Registrant State/Province: imc
Registrant Postal Code: 23454
Registrant Country: NG
Registrant Phone: +234.7084086464
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: freeloinc2015@yahoo.com
·
No city
called imc exists in Nigeria, nor
any such state/province.
·
Nigerian
postal codes are six digits long.
Registrant ID: NS-D95385D8971D8
Registrant Name: Red Indone
Registrant Organization:
Registrant Street: No. 21 Rumuokuta
Registrant City: imc
Registrant State/Province: imc
Registrant Postal Code: 23454
Registrant Country: NG
Registrant Phone: +234.7084086464
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: rbirlnd15@yahoo.com
•
No city
called imc exists in Nigeria, nor
any such state/province.
•
Nigerian
postal codes are six digits long.
Registrant ID: NS-DD191BDDFAEF7
Registrant Name: tracia Kint
Registrant Organization:
Registrant Street: No. 2 Vanisa
Registrant City: imc
Registrant State/Province: imc
Registrant Postal Code: 23454
Registrant Country: NG
Registrant Phone: +234.07084086464
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: tracklinkint@yahoo.com
•
No city
called imc exists in Nigeria, nor
any such state/province.
•
Nigerian
postal codes are six digits long.
•
Tel no. +234.07084086464
is too long and should be +234.7084086464 - if legitimate?
Registrant ID: NS-D90B0B0BF6C0D
Registrant Name: Chizy Serina
Registrant Organization:
Registrant Street: no. 1 ikeazu Street
Registrant City: imc
Registrant State/Province: imc
Registrant Postal Code: 23456
Registrant Country: NG
Registrant Phone: +234.07084086464
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: cp1_secure@yahoo.com
•
No city
called imc exists in Nigeria, nor
any such state/province.
•
Nigerian
postal codes are six digits long.
•
Tel no.
+234.07084086464 is too long and should be +234.7084086464
- if legitimate?
Registrant ID: NS-9380B8B35BF19
Registrant Name: Max Track
Registrant Organization:
Registrant Street: No. 23 Benson Rod
Registrant City: imc
Registrant State/Province: imc
Registrant Postal Code: 23454
Registrant Country: NG
Registrant Phone: +234.8098708469
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: maxtrackexpress@outlook.com
•
No city
called imc exists in Nigeria, nor
any such state/province.
•
Nigerian
postal codes are six digits long.
Registrant ID: NS-89B0316FDAE22
Registrant Name: Robin Williams
Registrant Organization:
Registrant Street: No.8 Chizu Cresent
Registrant City: imc
Registrant State/Province: imc
Registrant Postal Code: 23454
Registrant Country: NG
Registrant Phone: +234.08098708469
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: rbiw2015@yahoo.com
•
No city
called imc exists in Nigeria, nor
any such state/province.
•
Nigerian
postal codes are six digits long.
•
Tel no. +234.08098708469
is too long and should be +234.8098708469 - if legitimate?
Registrant ID: NS-fd4eaff54a3c6
Registrant Name: Ruge Ben
Registrant Organization:
Registrant Street: No. aba Road
Registrant City: Lag
Registrant State/Province: Lag
Registrant Postal Code: 23401
Registrant Country: NG
Registrant Phone: +234.08092659282
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: rbl_ln@yahoo.com
·
Are we to
assume Lag means Lagos?
·
This is
problematic in that Aba Road is a town ~ 600 kms/ 375
miles from Lagos. (see map below).
·
Once again
we have a five digit postal code, it should be six digits.
·
Tel no.
+234.08092659282 is too long and should be
+234.8092659282 if legitimate.
Registrant ID: NS-ba893a96710f3
Registrant Name: syield henry
Registrant Organization:
Registrant Street: No. 460 nadi cresent
Registrant City: imc
Registrant State/Province: imc
Registrant Postal Code: 23487
Registrant Country: NG
Registrant Phone: +234.08092659282
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: henrystevebenson011@gmail.com
•
No city
called imc exists in Nigeria, nor
any such state/province.
•
Nigerian
postal codes are six digits long.
•
Tel no. +234.08092659282 is
too long and should be +234.8092659282 -
if legitimate?
Registrant Name: Rbsina Kbina
Registrant Organization:
Registrant Street: No. 5 Emeneugo
Registrant City: imc
Registrant State/Province: imc
Registrant Postal Code: 23482
Registrant Country: NG
Registrant Phone: +234.07036603544
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: rbsukb@yahoo.com
•
No city
called imc exists in Nigeria, nor
any such state/province.
•
Nigerian
postal codes are six digits long.
•
Tel no. +234.07036603544 is
too long and should be +234.07036603544
- if legitimate?
Registrant Name: Ruben Slinka
Registrant Organization:
Registrant Street: no. 29 nadum Street
Registrant City: imc
Registrant State/Province: imc
Registrant Postal Code: 23456
Registrant Country: NG
Registrant Phone: +234.7084086464
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: rbsln2015@yahoo.com
•
No city
called imc exists in Nigeria, nor
any such state/province.
•
Nigerian
postal codes are six digits long.
•
Tel no.
+234.07084086464 is too long and should be +234.7084086464
- if legitimate?
Registrant Name: John Steve
Registrant Organization: Not Acceptable
Registrant Street: No. 12 Cent Ave
Registrant City: imc
Registrant State/Province: imc
Registrant Postal Code: 23454
Registrant Country: NG
Registrant Phone: +234.8098708469
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: rbsukb@yahoo.com
•
No city
called imc exists in Nigeria, nor
any such state/province.
•
Nigerian
postal codes are six digits long.
Here we take a logical look at the registrant’s registration data supplied. It’s an accepted the registrar would not have visibility on all these issues unless such a registrar deliberately seeks out such details. This is not expected from a registrar, unless serial abuse is attributed to a registrant.
For the purposes of the exercise, the malicious domain names are sorted by the corrected telephone number.
Domain |
Registrar |
Created |
Registrant Name |
Email |
Tel |
Status |
Address |
DNS rname |
rbsind.net |
NAMESILO, LLC |
2015-01-17 |
RBSINA KBINA |
rbsukb@yahoo.com |
+2347036603544 |
active |
NO. 5 EMENEUGO |
poweredhosting.hotmail.com |
IMC |
||||||||
IMC |
||||||||
23482 |
||||||||
NG |
||||||||
rbij.org |
NAMESILO, LLC |
2015-11-24 |
KEN DORO |
carnivaluk-careers@outlook.com |
+2347084086464 |
active |
NO. 18 CLENT AVENUE |
poweredhosting.hotmail.com |
IMC |
||||||||
IMC |
||||||||
23454 |
||||||||
NG |
||||||||
rbiv.org |
NAMESILO, LLC |
2015-05-25 |
CHIZY SERINA |
cp1_secure@yahoo.com |
+2347084086464 |
hold |
NO. 1 IKEAZU STREET |
poweredhosting.hotmail.com |
IMC |
||||||||
IMC |
||||||||
23456 |
||||||||
NG |
||||||||
rbibv.org |
NAMESILO, LLC |
2015-11-04 |
FRENKA LORINCIAL |
freeloinc2015@yahoo.com |
+2347084086464 |
active |
48 AMADI CRESENT |
poweredhosting.hotmail.com |
IMC |
||||||||
IMC |
||||||||
23454 |
||||||||
NG |
||||||||
rbindv.org |
NAMESILO, LLC |
2015-11-04 |
FRENKA LORINCIAL |
freeloinc2015@yahoo.com |
+2347084086464 |
active |
48 AMADI CRESENT |
poweredhosting.hotmail.com |
IMC |
||||||||
IMC |
||||||||
23454 |
||||||||
NG |
||||||||
rbirlndi.org |
NAMESILO, LLC |
2015-04-10 |
FRENKA LORINCIAL |
freeloinc2015@yahoo.com |
+2347084086464 |
active |
48 AMADI CRESENT |
icbghg.yahoo.com |
IMC |
||||||||
IMC |
||||||||
23454 |
||||||||
NG |
||||||||
rbilni.org |
NAMESILO, LLC |
2016-02-06 |
REGINAL OLINA |
rbiionline12@yahoo.com |
+2347084086464 |
active |
NO. 44 RUMUOKUTA |
poweredhosting.hotmail.com |
IMC |
||||||||
IMC |
||||||||
23454 |
||||||||
NG |
||||||||
rbiiv.org |
NAMESILO, LLC |
2015-07-29 |
REGINA IVEN |
rbiiv205@yahoo.com |
+2347084086464 |
active |
NO. 18 OBINZE ST |
poweredhosting.hotmail.com |
IMC |
||||||||
IMC |
||||||||
23454 |
||||||||
NG |
||||||||
rbirlnd.org |
NAMESILO, LLC |
2015-04-10 |
RED INDONE |
rbirlnd15@yahoo.com |
+2347084086464 |
active |
NO. 21 RUMUOKUTA |
poweredhosting.hotmail.com |
IMC |
||||||||
IMC |
||||||||
23454 |
||||||||
NG |
||||||||
rbi-n.org |
NAMESILO, LLC |
2015-05-20 |
BEN READ |
rbivn11@yahoo.com |
+2347084086464 |
active |
NO. 2 NASARA ROAD |
poweredhosting.hotmail.com |
IMC |
||||||||
IMC |
||||||||
23454 |
||||||||
NG |
||||||||
rbsruk.com |
NAMESILO, LLC |
2015-04-29 |
RUBEN SLINKA |
rbsln2015@yahoo.com |
+2347084086464 |
active |
NO. 29 NADUM STREET |
icbghg.yahoo.com |
IMC |
||||||||
IMC |
||||||||
23456 |
||||||||
NG |
||||||||
rbivj.org |
NAMESILO, LLC |
2016-03-21 |
TRACIA KINT |
tracklinkint@yahoo.com |
+2347084086464 |
active |
NO. 2 VANISA |
poweredhosting.hotmail.com |
IMC |
||||||||
IMC |
||||||||
23454 |
||||||||
NG |
||||||||
rbnkin.org |
NAMESILO, LLC |
2014-10-13 |
SYIELD HENRY |
henrystevebenson011@gmail.com |
+2348092659282 |
active |
NO. 460 NADI CRESENT |
poweredhosting.hotmail.com |
IMC |
||||||||
IMC |
||||||||
23487 |
||||||||
NG |
||||||||
rbifn.org |
NAMESILO, LLC |
2015-12-30 |
RUGE BEN |
rbl_ln@yahoo.com |
+2348092659282 |
active |
NO. ABA ROAD |
icbghg.yahoo.com |
LAG |
||||||||
LAG |
||||||||
23401 |
||||||||
NG |
||||||||
rbl-ln.org |
NAMESILO, LLC |
2014-12-04 |
RUGE BEN |
rbl_ln@yahoo.com |
+2348092659282 |
active |
NO. ABA ROAD |
poweredhosting.hotmail.com |
LAG |
||||||||
LAG |
||||||||
23401 |
||||||||
NG |
||||||||
rbijnd.org |
NAMESILO, LLC |
2016-04-16 |
RSINAL INDANA |
rbsind@yahoo.com |
+2348092659282 |
hold |
NO. 2 OBINZE |
icbghg.yahoo.com |
LAG |
||||||||
LAGOS |
||||||||
23401 |
||||||||
NG |
||||||||
rbirbin.org |
NAMESILO, LLC |
2015-01-17 |
RSINAL INDANA |
rbsind@yahoo.com |
+2348092659282 |
active |
NO. 2 OBINZE |
icbghg.yahoo.com |
LAG |
||||||||
LAGOS |
||||||||
23401 |
||||||||
NG |
||||||||
rbillni.org |
NAMESILO, LLC |
2015-06-09 |
IK INNO |
ikinno2015@yahoo.com |
+2348098708469 |
active |
18 UDO CRESENT |
icbghg.yahoo.com |
IMC |
||||||||
IMC |
||||||||
23454 |
||||||||
NG |
||||||||
rbi2.org |
NAMESILO, LLC |
2015-11-17 |
MAX TRACK |
maxtrackexpress@outlook.com |
+2348098708469 |
active |
NO. 23 BENSON ROD |
icbghg.yahoo.com |
IMC |
||||||||
IMC |
||||||||
23454 |
||||||||
NG |
||||||||
rbivt.org |
NAMESILO, LLC |
2015-11-17 |
MAX TRACK |
maxtrackexpress@outlook.com |
+2348098708469 |
active |
NO. 23 BENSON ROD |
poweredhosting.hotmail.com |
IMC |
||||||||
IMC |
||||||||
23454 |
||||||||
NG |
||||||||
rbiw.org |
NAMESILO, LLC |
2015-06-16 |
ROBIN WILLIAMS |
rbiw2015@yahoo.com |
+2348098708469 |
active |
NO.8 CHIZU CRESENT |
poweredhosting.hotmail.com |
IMC |
||||||||
IMC |
||||||||
23454 |
||||||||
NG |
||||||||
rbilnidi.org |
NAMESILO, LLC |
2015-06-09 |
RED BEN |
rbsvk20@yahoo.com |
+2348098708469 |
active |
NO. 5 OMO RD |
poweredhosting.hotmail.com |
IMC |
||||||||
IMC |
||||||||
23454 |
||||||||
NG |
From the above table we can see the same telephone number links to numerous names and emails. This is a red flag and needs querying under normal circumstances. Based upon 22 domains being abused identically, we can safely assume we are looking at deliberately supplied invalid registrant data.
We notice the continuous usage of fake address details, but more to the point, the exact same types of invalid data is supplied forming a pattern:
· LAG and imc
· 5-digit postal code and not 6-digit.
· We notice a pattern of repeated usage of disposable email addresses at Yahoo and Microsoft Outlook addresses.
To drive the point home, we have included the DNS SOA rname value. We see all are either controlled by poweredhosting@hotmail.com or icbghg@yahoo.com .
icbghg@yahoo.com is no stranger to continued bogus domain registrations:
https://db.aa419.org/fakebanksview.php?key=111260 (Spoof of Bank of Israel)
Registrant ID: NS-1698A777BDB90 |
I doubt I need to point out that we once again see Lag, a 5-digit postal code and incidentally the same telephone number as used in the other spoof domain registrations?
While poweredhosting@hotmail.com may appear a bit more legitimate at first glance, do not be deceived. To date no legitimate domain can be found linked to it. It’s extremely difficult finding something that simply is not there.
Here is a summary of domains and scams this email address can be found linked to:
Whois says:
Registrant Name: Fastina Frank Registrant Organization: Registrant Street: No. 4 imc Road Registrant City: imc Registrant State/Province:
imc Registrant Postal Code:
23454 Registrant Country: NG Registrant Phone:
+234.07036602148 Registrant Phone Ext: Registrant Fax: Registrant Fax Ext: Registrant Email: fastwayfranchise@yahoo.com |
DNS SOA rname: poweredhosting.hotmail.com
This is a job scam spoofing the legitimate United States Seafoods, LLC. (http://www.unitedstatesseafoods.com/ )
The domain is being used to spam and lure victims to apply
for jobs at United States Seafoods, LLC, using the
spoof email hr@unitedstatesseafoodllc.com
The legitimate United States Seafoods, LLC has a FaceBook page at https://www.facebook.com/unitedstatesseafoods/ where they are being swamped with requests to know if hr@unitedstatesseafoodllc.com is legitimate. We have to go a bit back to see United States Seafoods, LLC saying they only recruit via their web and do not “send out applications”:.
These fraudsters appear to be targeting the Philippines.
Whois says:
Registrant Name: Regi Benson Registrant Organization: Registrant Street: No. 55 Inno Road Registrant City: imc Registrant State/Province: imc Registrant Postal Code: 23465 Registrant Country: NG Registrant Phone: +234.07036603544 Registrant Phone Ext: Registrant Fax: Registrant Fax Ext: Registrant Email: inrbi12@yahoo.com |
inrbi12@yahoo.com appears earlier in this report as the registrant of RBIINDN.ORG. The lacking domain registrations statement details holds true.
Ditto a previous spoof of Yorkshire Bank:
https://db.aa419.org/fakebanksview.php?key=111275
The content is once again hidden.
DNS SOA rname: poweredhosting@hotmail.com
Whois says:
Registrant Name: Reanal Benard Registrant Organization: Registrant Street: n0 11 osundu Road Registrant City: imc Registrant State/Province: imc Registrant Postal Code: 23454 Registrant Country: NG Registrant Phone: +234.07084086464 Registrant Phone Ext: Registrant Fax: Registrant Fax Ext: Registrant Email: rrbin21@yahoo.com |
The registration details are junk once again.
Once again the fake RBS contentment is hidden.
DNS SOA rname: poweredhosting@hotmail.com
Whois says:
Registrant Name: Jen BB Registrant Organization: Registrant Street: No. 4 Benji Avenue Registrant City: imc Registrant State/Province: imc Registrant Postal Code: 23456 Registrant Country: NG Registrant Phone: +234.08092659282 Registrant Phone Ext: Registrant Fax: Registrant Fax Ext: Registrant Email: jen4me20@yahoo.com |
Once again we have junk registration data. The telephone number is a familiar one, but now linked to Jen BB.
Email address jen4me20@yahoo.com is extremely well linked ot previous frauds:
Satander spoof: http://db.aa419.org/fakebanksview.php?key=94781
Fake financial institution: http://db.aa419.org/fakebanksview.php?key=87689 (note the registrant details)
http://scamsurvivors.com/forum/viewtopic.php?f=6&t=21804&p=53811 (revious Reserve Bank of India spoof)
http://419advancefeefraud.blogspot.co.za/2013/06/canadian-fishing-company-fake-job-scam.html (job scam in the fishing industry) Déjà vu?
DNS SOA rname: poweredhosting@hotmail.com
Registrant Organization: Not Acceptable Registrant Street: No. 18 Jeffery ave Registrant City: imc Registrant State/Province: imc Registrant Postal Code: 23454 Registrant Country: NG Registrant Phone: +234.7084086464 Registrant Phone Ext: Registrant Fax: Registrant Fax Ext: Registrant Email: citibecards@yahoo.com |
Associated website suspended.
DNS SOA rname: poweredhosting@hotmail.com
However equally concerning is a proxy registration:
Registry Registrant ID: Registrant Name: Domain Administrator Registrant Organization: See PrivacyGuardian.org Registrant Street: 1928 E. Highland Ave. Ste F104 PMB# 255 Registrant City: Phoenix Registrant State/Province: AZ Registrant Postal Code: 85016 Registrant Country: US Registrant Phone: +1.3478717726 Registrant Phone Ext: Registrant Fax: Registrant Fax Ext: Registrant Email: pw-1c683fe4873867f00fabc8a274d384bc@privacyguardian.org |
DNS SOA rname says: poweredhosting@hotmail.com
This website associated with this domain has been suspended.
Considering the total junk registration seen thus far associated with anything poweredhosting@hotmail.com , it would be fair to assume equally junk registration data is hidden behind the proxy protection.
One specific hosting provider in Nigeria regularly registrars scam domains for his clients. His usage of 5-digit postal codes and the “imc” is a kind of fingerprint. We have all reasons to believe this is true again and these domains belong to him. As such the reseller channel is suspect in this case.
The can be seen by searching for “imc” in the Artists Against 419 database at http://db.aa419.org
Interpol has been made aware of this incident and how it ties to larger issues pertaining to this party.
---000---
Derek Smythe
Artists Against 419
http://www.aa419.org
2016-04-28