sabadellbanco.fr.cr - impersonating Banco de Sabadell Spain

[firefly]

Posted on the behalf of the victim:

The victim was contacted online, being advised to use http:/ /www. sabadellbanco.fr.cr/ - site supposedly belonging to a bank located in Colorado, USA.

Bank details provided to the victim:

SABADELL BANCO DE COLORADO
Toll Free: 800-473-4050
Tel: 719-289-7156
Fax: 725055733
Info@sabadellbanco.fr.cr
www. sabadellbanco.fr.cr/

+17192897156 - VoIP number provided by J2 Global with an area code in Pueblo, CO
+17205055733 - VoIP number provided by Pinger with an area code in Denver, CO

The real Banco de Sabadell, S.A. is a banking group headquartered in Sabadell, Spain. It is the fifth-largest Spanish banking group and it was founded in 1881.

The fake one contact details - according to their site:

7699 Dahlia St, Commerce City, CO 80022, USA
Toll Free: +1 800-473-4050, Tel: 719-289-7156
Fax: +1 720 505 5733
Email: info@sabadellbanco.fr.cr

The fake one was registered on a Russian host, using a free subdomain : http://db.aa419.org/fakebanksview.php?key=115707

This is what the fake site is looking like:

[firefly]

Clone of the above one, but this time pretending to be Citi Irish Bank:

26-31 Lower Stephen's St. Dublin City Centre, Ireland
Tel: +353 ( 0 ) 212 348 039
Fax : + 353 ( 0 ) 212 348 022
Email: customercare@icb-ie.com fundtransfer@icb-ie.com
Website: www. citiirishonline.com

+353212348039 / +353212348022
Number billable as geographic number
Country or destination Ireland
City or exchange location Cork
Original network provider* NTL Communications (Ireland) Ltd

The real Citi Irish Bank has had a presence in Ireland since 1965 when it was one of the first foreign banks to open an office in Dublin. The fake one is active since May:

Domain Name: CITIIRISHONLINE.COM
Registry Domain ID: 2026255186_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.publicdomainregistry.com
Registrar URL: http://www.publicdomainregistry.com
Updated Date: 2016-07-06T02:19:54Z
Creation Date: 2016-05-06T12:45:11Z
Registrar Registration Expiration Date: 2017-05-06T12:45:11Z
Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com

Looking to the site details, the Irish bank is operated by someone from Russia:

Registrant details:
Registrant Name: graham m ivan
Registrant Organization: N/A
Registrant Street: St. Petersburg, st. Sedova, d. 13, Apt. 19
Registrant City: N/A
Registrant State/Province:
Registrant Postal Code: 818828
Registrant Country: RU
Registrant Phone: +91.00299210
Registrant Email: 2carlos.rossi@gmail.com

But... looking to the email address they are using as a contact - fundtransfer@icb-ie.com, the same Irish bank is operated from Nigeria:

Domain Name: icb-ie.com
Registry Domain ID: 1968117253_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.godaddy.com
Registrar URL: http://www.godaddy.com
Update Date: 2015-10-12T22:26:28Z
Creation Date: 2015-10-12T22:26:28Z
Registrar Registration Expiration Date: 2016-10-12T22:26:28Z
Registrar: GoDaddy.com, LLC

Registrant Name: kevin uchenna
Registrant Organization:
Registrant Street: ikenegbu
Registrant City: owerri
Registrant State/Province: imo
Registrant Postal Code: 460221
Registrant Country: NG
Registrant Phone: +234.8030870144
Registrant Email: Urchito@gmail.com

This is what the fake site is looking like:

[firefly]

Now... let see how much of a Russian "graham m ivan" - 2carlos.rossi@gmail.com, from "St. Petersburg" is...

Ad online:

Date Posted :2016-08-06
Valid Until :2016-08-27
We are interested in buy JP54 and other LNG equipments
I have uploaded a Purchase order here,

http:/ /bit.do/ec21

please login and send me the best quotation and FOB price to Malaysia or send me email to 2carlos.rossi (@) gmail.com so i can forward the PO

Dan Graham
+61076627819

On nairaland:

dearele: 2:13pm On Jul 07

currently i am in Korea, i came with a business visa for 30days. I need help as quickly as anybody here can help me. How can i enrol for language school or best for my masters, i am a graduate of EE from a reputable university in Nigeria. I wish to remain here in south korea and study even after the language school. I don't know how possible it is as my 30days is almost half. PLEASE HELP send to my private email 2carlos.rossi at gmail dot com