Table of Contents

Domains names abused: 3

Domains on hold: 3

Active domains all have hidden content: 3

Domain registration - Registrant details: 14

rbi2.org. 14

rbibv.org. 15

rbifn.org. 15

rbiiv.org. 16

rbijnd.org. 17

rbij.org. 17

rbillni.org. 18

rbilnidi.org. 19

rbilni.org. 19

rbindv.org. 20

rbi-n.org. 20

rbirbin.org. 21

rbirlndi.org. 22

rbirlnd.org. 22

rbivj.org. 23

rbiv.org. 23

rbivt.org. 24

rbiw.org. 25

rbl-ln.org. 25

rbnkin.org. 26

rbsind.net. 27

rbsruk.com.. 27

rbsuk-b.com.. 28

Registrant Details Analysis: 29

DNS SOA rname observations: 33

unitedstatesseafoodllc.com.. 34

ozfia.com.. 35

rbsukgroup.com.. 36

orchardpharmaceuticals.com.. 36

on-citi.com (at registrar ilovewww.com). 37

heritagpharmaceuticals.com.. 38

General Observations: 38

Escalation: 38

 


 

 

Domains names abused:

rbi2.org
rbibv.org
rbifn.org
rbiiv.org
rbijnd.org
rbij.org
rbillni.org
rbilnidi.org
rbilni.org
rbindv.org
rbi-n.org
rbirbin.org
rbirlndi.org
rbirlnd.org
rbivj.org
rbiv.org
rbivt.org
rbiw.org
rbl-ln.org
rbnkin.org
rbsind.net
rbsruk.com
rbsuk-b.com

Domains on hold:

rbijnd.org
rbiv.org

Active domains all have hidden content:

All the active domains have hidden content spoofing the Royal Bank of Scotland or the Reserve Bank of India.  The hidden content can either be found in the subdirectory /home/ or /uk/ (note, we are noticing a pattern of abuse, apart from you being the sponsoring registrar)


http://www.rbi2.org/home

http://www.rbibv.org/home

http://www.rbifn.org/home

http://www.rbiiv.org/home

 

http://www.rbij.org/home

http://www.rbillni.org/home


 

http://www.rbilnidi.org/home

http://www.rbilni.org/home

http://www.rbindv.org/home

http://www.rbi-n.org/home

http://www.rbirbin.org/home

http://www.rbirlndi.org/home

http://www.rbirlnd.org/home

http://www.rbivj.org/home

http://www.rbivt.org/home

http://www.rbiw.org/home

http://www.rbl-ln.org/home

http://www.rbnkin.org/home

http://www.rbsind.net/home

http://www.rbsruk.com/uk

http://www.rbsuk-b.com/home

 

Domain registration - Registrant details:

rbi2.org

 

Registrant ID: NS-123B5EEAAE58D

Registrant Name: Max Track

Registrant Organization:

Registrant Street: No. 23 Benson Rod

Registrant City: imc

Registrant State/Province: imc

Registrant Postal Code: 23454

Registrant Country: NG

Registrant Phone: +234.8098708469

Registrant Phone Ext:

Registrant Fax:

Registrant Fax Ext:

Registrant Email: maxtrackexpress@outlook.com

·         No city called imc exists in Nigeria, nor any such state/province. 

·         Nigerian postal codes are six digits long. As such these details are bogus.

rbibv.org

 

Registrant ID: NS-324A8E3BDF613

Registrant Name: frenka Lorincial

Registrant Organization:

Registrant Street: 48 Amadi Cresent

Registrant City: imc

Registrant State/Province: imc

Registrant Postal Code: 23454

Registrant Country: NG

Registrant Phone: +234.7084086464

Registrant Phone Ext:

Registrant Fax:

Registrant Fax Ext:

Registrant Email: freeloinc2015@yahoo.com

 

·         No city called imc exists in Nigeria, nor any such state/province. 

·         Nigerian postal codes are six digits long. As such these details are bogus.

rbifn.org

 

Registrant ID: NS-5B7525C4EE7F6

Registrant Name: Ruge Ben

Registrant Organization:

Registrant Street: No. aba Road

Registrant City: Lag

Registrant State/Province: Lag

Registrant Postal Code: 23401

Registrant Country: NG

Registrant Phone: +234.08092659282

Registrant Phone Ext:

Registrant Fax:

Registrant Fax Ext:

Registrant Email: rbl_ln@yahoo.com

·         Are we to assume Lag means Lagos?

·         This is problematic in that Aba Road is a town ~ 600 kms/ 375 miles from Lagos. (see map below).

·         Once again we have a five digit postal code, it should be six digits.

·         Tel no. +234.08092659282 is too long and should be +234.8092659282 if legitimate.

rbiiv.org

 

Registrant ID: NS-D9FEAB54856BF

Registrant Name: Regina Iven

Registrant Organization:

Registrant Street: No. 18 Obinze St

Registrant City: imc

Registrant State/Province: imc

Registrant Postal Code: 23454

Registrant Country: NG

Registrant Phone: +234.07084086464

Registrant Phone Ext:

Registrant Fax:

Registrant Fax Ext:

Registrant Email: rbiiv205@yahoo.com

·         No city called imc exists in Nigeria, nor any such state/province.

·         Nigerian postal codes are six digits long. As such these details are bogus.

·         Tel no. +234.07084086464 is too long and should be +234.7084086464 if legitimate.

rbijnd.org

 

Registrant ID: NS-D04B8A443F205

Registrant Name: Rsinal Indana

Registrant Organization:

Registrant Street: No. 2 Obinze

Registrant City: Lag

Registrant State/Province: Lagos

Registrant Postal Code: 23401

Registrant Country: NG

Registrant Phone: +234.08092659282

Registrant Phone Ext:

Registrant Fax:

Registrant Fax Ext:

Registrant Email: rbsind@yahoo.com

·         Note the city name Lag. Should this be Lagos?  

·         Nigerian postal codes are six digits long. As such these details are invalid.

·         Tel no. +234. 08092659282 is too long and should be +234. 8092659282 - if legitimate?

rbij.org

 

Registrant ID: NS-0AC81D577EB41

Registrant Name: Ken Doro

Registrant Organization:

Registrant Street: No. 18 Clent avenue

Registrant City: imc

Registrant State/Province: imc

Registrant Postal Code: 23454

Registrant Country: NG

Registrant Phone: +234.7084086464

Registrant Phone Ext:

Registrant Fax:

Registrant Fax Ext:

Registrant Email: carnivaluk-careers@outlook.com

·         No city called imc exists in Nigeria, nor any such state/province. 

·         Nigerian postal codes are six digits long. As such these details are bogus.

rbillni.org

 

Registrant ID: NS-0F03F1C21F47E

Registrant Name: ik inno

Registrant Organization:

Registrant Street: 18 udo cresent

Registrant City: imc

Registrant State/Province: imc

Registrant Postal Code: 23454

Registrant Country: NG

Registrant Phone: +234.08098708469

Registrant Phone Ext:

Registrant Fax:

Registrant Fax Ext:

Registrant Email: ikinno2015@yahoo.com

·         No city called imc exists in Nigeria, nor any such state/province. 

·         Nigerian postal codes are six digits long.

·         Tel no. +234.08098708469 is too long and should be +234.8098708469 - if legitimate?

rbilnidi.org

 

Registrant ID: NS-D899812511029

Registrant Name: Red Ben

Registrant Organization:

Registrant Street: No. 5 Omo rd

Registrant City: imc

Registrant State/Province: imc

Registrant Postal Code: 23454

Registrant Country: NG

Registrant Phone: +234.08098708469

Registrant Phone Ext:

Registrant Fax:

Registrant Fax Ext:

Registrant Email: rbsvk20@yahoo.com

·         Note the city name Lag. Should this be Lagos? 

·         Nigerian postal codes are six digits long. As such these details are invalid.

·         Tel no. +234. 08092659282 is too long and should be +234. 8092659282 - if legitimate?

rbilni.org

 

Registrant ID: NS-C0880497A5402

Registrant Name: Reginal Olina

Registrant Organization:

Registrant Street: No. 44 Rumuokuta

Registrant City: imc

Registrant State/Province: imc

Registrant Postal Code: 23454

Registrant Country: NG

Registrant Phone: +234.7084086464

Registrant Phone Ext:

Registrant Fax:

Registrant Fax Ext:

Registrant Email: rbiionline12@yahoo.com

                    No city called imc exists in Nigeria, nor any such state/province. 

                    Nigerian postal codes are six digits long.

 

rbindv.org

 

Registrant ID: NS-D8074E9EC23E9

Registrant Name: frenka Lorincial

Registrant Organization:

Registrant Street: 48 Amadi Cresent

Registrant City: imc

Registrant State/Province: imc

Registrant Postal Code: 23454

Registrant Country: NG

Registrant Phone: +234.7084086464

Registrant Phone Ext:

Registrant Fax:

Registrant Fax Ext:

Registrant Email: freeloinc2015@yahoo.com

                    No city called imc exists in Nigeria, nor any such state/province. 

                    Nigerian postal codes are six digits long.

 

rbi-n.org

 

Registrant ID: NS-45597F4969CD6

Registrant Name: Ben Read

Registrant Organization:

Registrant Street: No. 2 Nasara Road

Registrant City: imc

Registrant State/Province: imc

Registrant Postal Code: 23454

Registrant Country: NG

Registrant Phone: +234.07084086464

Registrant Phone Ext:

Registrant Fax:

Registrant Fax Ext:

Registrant Email: rbivn11@yahoo.com

                    No city called imc exists in Nigeria, nor any such state/province. 

                    Nigerian postal codes are six digits long.

                    +234.07084086464 should be +234.07084086464 – if legitimate?

 

rbirbin.org

 

Registrant ID: NS-37CA3A34E5A60

Registrant Name: Rsinal Indana

Registrant Organization:

Registrant Street: No. 2 Obinze

Registrant City: Lag

Registrant State/Province: Lagos

Registrant Postal Code: 23401

Registrant Country: NG

Registrant Phone: +234.08092659282

Registrant Phone Ext:

Registrant Fax:

Registrant Fax Ext:

Registrant Email: rbsind@yahoo.com

                    Note the city name Lag. Should this be Lagos?

                    Nigerian postal codes are six digits long. As such these details are invalid.

                    Tel no. +234. 08092659282 is too long and should be +234. 8092659282 - if legitimate?

rbirlndi.org

 

Registrant ID: NS-8D00449EBA5E6

Registrant Name: frenka Lorincial

Registrant Organization:

Registrant Street: 48 Amadi Cresent

Registrant City: imc

Registrant State/Province: imc

Registrant Postal Code: 23454

Registrant Country: NG

Registrant Phone: +234.7084086464

Registrant Phone Ext:

Registrant Fax:

Registrant Fax Ext:

Registrant Email: freeloinc2015@yahoo.com

·                     No city called imc exists in Nigeria, nor any such state/province. 

·                     Nigerian postal codes are six digits long.

rbirlnd.org

 

Registrant ID: NS-D95385D8971D8

Registrant Name: Red Indone

Registrant Organization:

Registrant Street: No. 21 Rumuokuta

Registrant City: imc

Registrant State/Province: imc

Registrant Postal Code: 23454

Registrant Country: NG

Registrant Phone: +234.7084086464

Registrant Phone Ext:

Registrant Fax:

Registrant Fax Ext:

Registrant Email: rbirlnd15@yahoo.com

        No city called imc exists in Nigeria, nor any such state/province. 

        Nigerian postal codes are six digits long.

 

rbivj.org

 

Registrant ID: NS-DD191BDDFAEF7

Registrant Name: tracia Kint

Registrant Organization:

Registrant Street: No. 2 Vanisa

Registrant City: imc

Registrant State/Province: imc

Registrant Postal Code: 23454

Registrant Country: NG

Registrant Phone: +234.07084086464

Registrant Phone Ext:

Registrant Fax:

Registrant Fax Ext:

Registrant Email: tracklinkint@yahoo.com

        No city called imc exists in Nigeria, nor any such state/province. 

        Nigerian postal codes are six digits long.

        Tel no. +234.07084086464 is too long and should be +234.7084086464 - if legitimate?

rbiv.org

 

Registrant ID: NS-D90B0B0BF6C0D

Registrant Name: Chizy Serina

Registrant Organization:

Registrant Street: no. 1 ikeazu Street

Registrant City: imc

Registrant State/Province: imc

Registrant Postal Code: 23456

Registrant Country: NG

Registrant Phone: +234.07084086464

Registrant Phone Ext:

Registrant Fax:

Registrant Fax Ext:

Registrant Email: cp1_secure@yahoo.com

        No city called imc exists in Nigeria, nor any such state/province. 

        Nigerian postal codes are six digits long.

        Tel no. +234.07084086464 is too long and should be +234.7084086464 - if legitimate?

rbivt.org

 

Registrant ID: NS-9380B8B35BF19

Registrant Name: Max Track

Registrant Organization:

Registrant Street: No. 23 Benson Rod

Registrant City: imc

Registrant State/Province: imc

Registrant Postal Code: 23454

Registrant Country: NG

Registrant Phone: +234.8098708469

Registrant Phone Ext:

Registrant Fax:

Registrant Fax Ext:

Registrant Email: maxtrackexpress@outlook.com

        No city called imc exists in Nigeria, nor any such state/province. 

        Nigerian postal codes are six digits long.

 

rbiw.org

 

Registrant ID: NS-89B0316FDAE22

Registrant Name: Robin Williams

Registrant Organization:

Registrant Street: No.8 Chizu Cresent

Registrant City: imc

Registrant State/Province: imc

Registrant Postal Code: 23454

Registrant Country: NG

Registrant Phone: +234.08098708469

Registrant Phone Ext:

Registrant Fax:

Registrant Fax Ext:

Registrant Email: rbiw2015@yahoo.com

        No city called imc exists in Nigeria, nor any such state/province. 

        Nigerian postal codes are six digits long.

        Tel no. +234.08098708469 is too long and should be +234.8098708469 - if legitimate?

 

rbl-ln.org

 

Registrant ID: NS-fd4eaff54a3c6

Registrant Name: Ruge Ben

Registrant Organization:

Registrant Street: No. aba Road

Registrant City: Lag

Registrant State/Province: Lag

Registrant Postal Code: 23401

Registrant Country: NG

Registrant Phone: +234.08092659282

Registrant Phone Ext:

Registrant Fax:

Registrant Fax Ext:

Registrant Email: rbl_ln@yahoo.com

·         Are we to assume Lag means Lagos?

·         This is problematic in that Aba Road is a town ~ 600 kms/ 375 miles from Lagos. (see map below).

·         Once again we have a five digit postal code, it should be six digits.

·         Tel no. +234.08092659282 is too long and should be +234.8092659282 if legitimate.

 

rbnkin.org

 

Registrant ID: NS-ba893a96710f3

Registrant Name: syield henry

Registrant Organization:

Registrant Street: No. 460 nadi cresent

Registrant City: imc

Registrant State/Province: imc

Registrant Postal Code: 23487

Registrant Country: NG

Registrant Phone: +234.08092659282

Registrant Phone Ext:

Registrant Fax:

Registrant Fax Ext:

Registrant Email: henrystevebenson011@gmail.com

        No city called imc exists in Nigeria, nor any such state/province. 

        Nigerian postal codes are six digits long.

        Tel no. +234.08092659282  is too long and should be +234.8092659282  - if legitimate?

rbsind.net

 

Registrant Name: Rbsina Kbina

Registrant Organization:

Registrant Street: No. 5 Emeneugo

Registrant City: imc

Registrant State/Province: imc

Registrant Postal Code: 23482

Registrant Country: NG

Registrant Phone: +234.07036603544

Registrant Phone Ext:

Registrant Fax:

Registrant Fax Ext:

Registrant Email: rbsukb@yahoo.com

        No city called imc exists in Nigeria, nor any such state/province. 

        Nigerian postal codes are six digits long.

        Tel no. +234.07036603544  is too long and should be +234.07036603544  - if legitimate?

 

rbsruk.com

 

Registrant Name: Ruben Slinka

Registrant Organization:

Registrant Street: no. 29 nadum Street

Registrant City: imc

Registrant State/Province: imc

Registrant Postal Code: 23456

Registrant Country: NG

Registrant Phone: +234.7084086464

Registrant Phone Ext:

Registrant Fax:

Registrant Fax Ext:

Registrant Email: rbsln2015@yahoo.com

        No city called imc exists in Nigeria, nor any such state/province. 

        Nigerian postal codes are six digits long.

        Tel no. +234.07084086464 is too long and should be +234.7084086464 - if legitimate?

rbsuk-b.com

 

Registrant Name: John Steve

Registrant Organization: Not Acceptable

Registrant Street: No. 12 Cent Ave

Registrant City: imc

Registrant State/Province: imc

Registrant Postal Code: 23454

Registrant Country: NG

Registrant Phone: +234.8098708469

Registrant Phone Ext:

Registrant Fax:

Registrant Fax Ext:

Registrant Email: rbsukb@yahoo.com

        No city called imc exists in Nigeria, nor any such state/province. 

        Nigerian postal codes are six digits long.


Registrant Details Analysis:

 

Here we take a logical look at the registrant’s registration data supplied. It’s an accepted the registrar would not have visibility on all these issues unless such a registrar deliberately seeks out such details. This is not expected from a registrar, unless serial abuse is attributed to a registrant.

For the purposes of the exercise, the malicious domain names are sorted by the corrected telephone number.

 

Domain

Registrar

Created

Registrant Name

Email

Tel

Status

Address

DNS rname

rbsind.net

NAMESILO, LLC

2015-01-17

RBSINA KBINA

rbsukb@yahoo.com

+2347036603544

active

NO. 5 EMENEUGO

poweredhosting.hotmail.com

IMC

IMC

23482

NG

rbij.org

NAMESILO, LLC

2015-11-24

KEN DORO

carnivaluk-careers@outlook.com

+2347084086464

active

NO. 18 CLENT AVENUE

poweredhosting.hotmail.com

IMC

IMC

23454

NG

rbiv.org

NAMESILO, LLC

2015-05-25

CHIZY SERINA

cp1_secure@yahoo.com

+2347084086464

hold

NO. 1 IKEAZU STREET

poweredhosting.hotmail.com

IMC

IMC

23456

NG

rbibv.org

NAMESILO, LLC

2015-11-04

FRENKA LORINCIAL

freeloinc2015@yahoo.com

+2347084086464

active

48 AMADI CRESENT

poweredhosting.hotmail.com

IMC

IMC

23454

NG

rbindv.org

NAMESILO, LLC

2015-11-04

FRENKA LORINCIAL

freeloinc2015@yahoo.com

+2347084086464

active

48 AMADI CRESENT

poweredhosting.hotmail.com

IMC

IMC

23454

NG

rbirlndi.org

NAMESILO, LLC

2015-04-10

FRENKA LORINCIAL

freeloinc2015@yahoo.com

+2347084086464

active

48 AMADI CRESENT

icbghg.yahoo.com

IMC

IMC

23454

NG

rbilni.org

NAMESILO, LLC

2016-02-06

REGINAL OLINA

rbiionline12@yahoo.com

+2347084086464

active

NO. 44 RUMUOKUTA

poweredhosting.hotmail.com

IMC

IMC

23454

NG

rbiiv.org

NAMESILO, LLC

2015-07-29

REGINA IVEN

rbiiv205@yahoo.com

+2347084086464

active

NO. 18 OBINZE ST

poweredhosting.hotmail.com

IMC

IMC

23454

NG

rbirlnd.org

NAMESILO, LLC

2015-04-10

RED INDONE

rbirlnd15@yahoo.com

+2347084086464

active

NO. 21 RUMUOKUTA

poweredhosting.hotmail.com

IMC

IMC

23454

NG

rbi-n.org

NAMESILO, LLC

2015-05-20

BEN READ

rbivn11@yahoo.com

+2347084086464

active

NO. 2 NASARA ROAD

poweredhosting.hotmail.com

IMC

IMC

23454

NG

rbsruk.com

NAMESILO, LLC

2015-04-29

RUBEN SLINKA

rbsln2015@yahoo.com

+2347084086464

active

NO. 29 NADUM STREET

icbghg.yahoo.com

IMC

IMC

23456

NG

rbivj.org

NAMESILO, LLC

2016-03-21

TRACIA KINT

tracklinkint@yahoo.com

+2347084086464

active

NO. 2 VANISA

poweredhosting.hotmail.com

IMC

IMC

23454

NG

rbnkin.org

NAMESILO, LLC

2014-10-13

SYIELD HENRY

henrystevebenson011@gmail.com

+2348092659282

active

NO. 460 NADI CRESENT

poweredhosting.hotmail.com

IMC

IMC

23487

NG

rbifn.org

NAMESILO, LLC

2015-12-30

RUGE BEN

rbl_ln@yahoo.com

+2348092659282

active

NO. ABA ROAD

icbghg.yahoo.com

LAG

LAG

23401

NG

rbl-ln.org

NAMESILO, LLC

2014-12-04

RUGE BEN

rbl_ln@yahoo.com

+2348092659282

active

NO. ABA ROAD

poweredhosting.hotmail.com

LAG

LAG

23401

NG

rbijnd.org

NAMESILO, LLC

2016-04-16

RSINAL INDANA

rbsind@yahoo.com

+2348092659282

hold

NO. 2 OBINZE

icbghg.yahoo.com

LAG

LAGOS

23401

NG

rbirbin.org

NAMESILO, LLC

2015-01-17

RSINAL INDANA

rbsind@yahoo.com

+2348092659282

active

NO. 2 OBINZE

icbghg.yahoo.com

LAG

LAGOS

23401

NG

rbillni.org

NAMESILO, LLC

2015-06-09

IK INNO

ikinno2015@yahoo.com

+2348098708469

active

18 UDO CRESENT

icbghg.yahoo.com

IMC

IMC

23454

NG

rbi2.org

NAMESILO, LLC

2015-11-17

MAX TRACK

maxtrackexpress@outlook.com

+2348098708469

active

NO. 23 BENSON ROD

icbghg.yahoo.com

IMC

IMC

23454

NG

rbivt.org

NAMESILO, LLC

2015-11-17

MAX TRACK

maxtrackexpress@outlook.com

+2348098708469

active

NO. 23 BENSON ROD

poweredhosting.hotmail.com

IMC

IMC

23454

NG

rbiw.org

NAMESILO, LLC

2015-06-16

ROBIN WILLIAMS

rbiw2015@yahoo.com

+2348098708469

active

NO.8 CHIZU CRESENT

poweredhosting.hotmail.com

IMC

IMC

23454

NG

rbilnidi.org

NAMESILO, LLC

2015-06-09

RED BEN

rbsvk20@yahoo.com

+2348098708469

active

NO. 5 OMO RD

poweredhosting.hotmail.com

IMC

IMC

23454

NG

 


 


From the above table we can see the same telephone number links to numerous names and emails. This is a red flag and needs querying under normal circumstances.  Based upon 22 domains being abused identically, we can safely assume we are looking at deliberately supplied invalid registrant data.

We notice the continuous usage of fake address details, but more to the point, the exact same types of invalid data is supplied forming a pattern:

·         LAG and imc

·         5-digit postal code and not 6-digit.

·         We notice a pattern of repeated usage of disposable email addresses at Yahoo and Microsoft Outlook addresses.

 

DNS SOA rname observations:

 

To drive the point home, we have included the DNS SOA rname value.  We see all are either controlled by poweredhosting@hotmail.com  or icbghg@yahoo.com .

 

icbghg@yahoo.com  is no stranger to continued bogus domain registrations:

https://db.aa419.org/fakebanksview.php?key=111260 (Spoof of Bank of Israel)

Registrant ID: NS-1698A777BDB90
Registrant Name: Icb Ggbe
Registrant Organization:
Registrant Street: 10 Jubilee Avenue
Registrant City: Lag
Registrant State/Province: Lag
Registrant Postal Code: 23401
Registrant Country: NG
Registrant Phone: +234.08092659282
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: icbghg@yahoo.com

 

I doubt I need to point out that we once again see Lag, a 5-digit postal code and incidentally the same telephone number as used in the other spoof domain registrations?

 

While poweredhosting@hotmail.com may appear a bit more legitimate at first glance, do not be deceived.  To date no legitimate domain can be found linked to it. It’s extremely difficult finding something that simply is not there.

Here is a summary of domains and scams this email address can be found linked to:

 

unitedstatesseafoodllc.com

 

Whois says:

Registrant Name: Fastina Frank

Registrant Organization:

Registrant Street: No. 4 imc Road 

Registrant City: imc

Registrant State/Province: imc

Registrant Postal Code: 23454

Registrant Country: NG

Registrant Phone: +234.07036602148

Registrant Phone Ext:

Registrant Fax:

Registrant Fax Ext:

Registrant Email: fastwayfranchise@yahoo.com


DNS SOA rname:  poweredhosting.hotmail.com

This is a job scam spoofing the legitimate United States Seafoods, LLC. (http://www.unitedstatesseafoods.com/ )

The domain is being used to spam and lure victims to apply for jobs at United States Seafoods, LLC, using the spoof email hr@unitedstatesseafoodllc.com

The legitimate United States Seafoods, LLC has a FaceBook page at   https://www.facebook.com/unitedstatesseafoods/ where they are being swamped with requests to know if hr@unitedstatesseafoodllc.com is legitimate.  We have to go a bit back to see United States Seafoods, LLC saying they only recruit via their web and do not “send out applications”:.



 

These fraudsters appear to be targeting the Philippines.

 

ozfia.com

 

Whois says:

Registrant Name: Regi Benson

Registrant Organization:

Registrant Street: No. 55 Inno Road

Registrant City: imc

Registrant State/Province: imc

Registrant Postal Code: 23465

Registrant Country: NG

Registrant Phone: +234.07036603544

Registrant Phone Ext:

Registrant Fax:

Registrant Fax Ext:

Registrant Email: inrbi12@yahoo.com

 

inrbi12@yahoo.com appears earlier in this report as the registrant of RBIINDN.ORG. The lacking domain registrations statement details holds true.

Ditto a previous spoof of Yorkshire Bank:
https://db.aa419.org/fakebanksview.php?key=111275

The content is once again hidden.

DNS SOA rname: poweredhosting@hotmail.com

rbsukgroup.com

 

Whois says:

Registrant Name: Reanal Benard

Registrant Organization:

Registrant Street: n0 11 osundu Road

Registrant City: imc

Registrant State/Province: imc

Registrant Postal Code: 23454

Registrant Country: NG

Registrant Phone: +234.07084086464

Registrant Phone Ext:

Registrant Fax:

Registrant Fax Ext:

Registrant Email: rrbin21@yahoo.com

 

The registration details are junk once again.

Once again the fake RBS contentment is hidden.

DNS SOA rname:  poweredhosting@hotmail.com

 

orchardpharmaceuticals.com

 

Whois says:

Registrant Name: Jen BB

Registrant Organization:

Registrant Street: No. 4 Benji Avenue

Registrant City: imc

Registrant State/Province: imc

Registrant Postal Code: 23456

Registrant Country: NG

Registrant Phone: +234.08092659282

Registrant Phone Ext:

Registrant Fax:

Registrant Fax Ext:

Registrant Email: jen4me20@yahoo.com

 

Once again we have junk registration data. The telephone number is a familiar one, but now linked to Jen BB.

Email address jen4me20@yahoo.com is extremely well linked ot previous frauds:

Satander spoof: http://db.aa419.org/fakebanksview.php?key=94781

Fake financial institution: http://db.aa419.org/fakebanksview.php?key=87689 (note the registrant details)

http://scamsurvivors.com/forum/viewtopic.php?f=6&t=21804&p=53811 (revious Reserve Bank of India spoof)

http://419advancefeefraud.blogspot.co.za/2013/06/canadian-fishing-company-fake-job-scam.html (job scam in the fishing industry)  Déjà vu?

DNS SOA rname: poweredhosting@hotmail.com

on-citi.com (at registrar ilovewww.com)

 

Registrant Organization: Not Acceptable

Registrant Street: No. 18 Jeffery ave  

Registrant City: imc

Registrant State/Province: imc

Registrant Postal Code: 23454

Registrant Country: NG

Registrant Phone: +234.7084086464

Registrant Phone Ext:

Registrant Fax:

Registrant Fax Ext:

Registrant Email: citibecards@yahoo.com

 

Associated website suspended.

DNS SOA rname: poweredhosting@hotmail.com

 

 

 

 

heritagpharmaceuticals.com

 

However equally concerning is a proxy registration:

Registry Registrant ID:

Registrant Name: Domain Administrator

Registrant Organization: See PrivacyGuardian.org

Registrant Street: 1928 E. Highland Ave. Ste F104 PMB# 255

Registrant City: Phoenix

Registrant State/Province: AZ

Registrant Postal Code: 85016

Registrant Country: US

Registrant Phone: +1.3478717726

Registrant Phone Ext:

Registrant Fax:

Registrant Fax Ext:

Registrant Email: pw-1c683fe4873867f00fabc8a274d384bc@privacyguardian.org

 

DNS SOA rname says: poweredhosting@hotmail.com

This website associated with this domain has been suspended.

Considering the total junk registration seen thus far associated with anything poweredhosting@hotmail.com , it would be fair to assume equally junk registration data is hidden behind the proxy protection.

General Observations:

 

One specific hosting provider in Nigeria regularly registrars scam domains for his clients. His usage of 5-digit postal codes and the “imc” is a kind of fingerprint.  We have all reasons to believe this is true again and these domains belong to him. As such the reseller channel is suspect in this case.

The can be seen by searching for “imc” in the Artists Against 419 database at http://db.aa419.org

Escalation:

Interpol has been made aware of this incident and how it ties to larger issues pertaining to this party.

---000---

 

Derek Smythe
Artists Against 419
http://www.aa419.org

2016-04-28