ikennachi@hotmail.com - 123rave.com

[firefly]

split from viewtopic.php?f=11&t=53312, where the scam using the fake site freddymillerconstructions.com is reported.

The fake site maker is using the email address ikennachi@hotmail.com. His strategy was a simple one. He created a main domain - 123rave.com, using emails from that domain to register the rest of his fake sites. Some of those fake sites are deleted now. Some are still active.

Before moving to the nest of fake sites created this way, a short look to his online activity...

The fake site maker was active on Facebook as:

Tony Angs
Gender Male

Stolen picture used:

Comments from the fake profile:

Wow this rain in Abuja is vicious.

[firefly]

According to the site:

What we do. Mobile App Development. Web Design. Software Development. Strategic Business Initiatives for Long-Term Growth Globally

No 8 Lola Close, Luanda Crescent,Wuse II · Abuja, Nigeria
P: +234(80)57161154
info@eoilimited.eu

Email addresses associated with this site are used online to register fake sites and spoof domains impersonating everything - from banks to construction companies. Many domains have been used not only in classical online frauds, but also in phishing and using these patterns, we have been able to locate phishing not previously known about. Many domains have no online content, but the names have been deliberately chosen to target legitimate businesses. Linked to the numerous LinkedIn phishing pages, it is reasonably safe to assume this is used in impersonation and a fore-runner to business email compromise (BEC).

Websites with no content but spoofing real companies:

emiratesbk.com -> emirates.com (Emirates Bank)
havecocn.com -> haveco.com.cn
jenniferbz.com -> jennifer.bz
socomce.com -> socomec.com
superbtant.com -> superbtent.com
terzekou-paris.com -> terzakou-paris.com
tthyssenkrupp.com -> thyssenkrupp.com
yongmoaholding.com -> yongmaoholdings.com

From the fake site details - http://db.aa419.org/fakebanksview.php?key=118734:
Domain Name: 123rave.com
Update Date: 2016-10-11
Creation Date: 2015-09-29
Registrar Registration Expiration Date: 2017-09-29
Registrar: GoDaddy.com, LLC

Registry Registrant ID: Not Available From Registry
Registrant Name: Majid Ashi
Registrant Street: (941) 538-6941 4283 Express Lane
Registrant Street: FL
Registrant City: Sarasota
Registrant State/Province: Florida
Registrant Postal Code: 34238
Registrant Country: US
Registrant Phone: +1.9415386941
Registrant Email: ikennachi@hotmail.com

+19415386941 - landline number provided by Vonage Network with an area code in Bradenton, FL.

This is what the site is looking like:

[firefly]

Fake delivery company.

According to their site:

AGS Logistics and Shipping Limited was established in 1995, and has developed into one of the most innovative and efficient carriers in the global shipping industry.

AGS’s global reach extends to over 120 countries operating from Cyprus and South Africa, with a network of global and regional shipping services that connects your business to strategic ports around the world. When working with AGS, you are assured comprehensive geographical coverage via a complex feeder network operating from hub ports on all major international trade routes.

Contact Associated Global Services Ltd now on +27 10 500 8225

Contact Us
Africa Office
LMI House
111 High Road
Bredell, kempton Park
Johannesburg
South Africa
Tel: +(27) 10 500 8225
Fax: +(27) 10 500 8224
Email: info@agshippings.com

Europe Office
69 Franklin Roosevelt Avenue
P.O.B. 50230, 3602 Limassol,
Cyprus
Tel: (357) 220 22540
Fax: (357) 220 22538
Email: cyprus@agshippings.com

"established in 1995" is a lie - the site is active since May 2016. The offices in Johannesburg and Limassol are in fact in Abuja.

From the fake site details - http://db.aa419.org/fakebanksview.php?key=118737:
Domain Name: AGGSHIPPING.COM
Updated Date: 2016-11-13
Creation Date: 2016-11-13
Registrar Registration Expiration Date: 2017-11-13
Registrar: Domain.com, LLC
Reseller: FatCow

Registry Registrant ID:
Registrant Name: Majid Ashi
Registrant Organization: Majid Ashi
Registrant Street: No 135 Ahmad Bello, Beside Cub
Registrant City: Wuse 2
Registrant State/Province: NA
Registrant Postal Code: 900001
Registrant Country: NG
Registrant Phone: +1.8180339312
Registrant Email: bod@123rave.com

This is what the fake site is looking like:

+1.8180339312 is an invalid phone number and sure it is not a Nigerian phone number.

+27105008225 / +27105008224
Number billable as geographic number
Country or destination South Africa
City or exchange location Johannesburg

+35722022540 / +35722022538
Number billable as geographic number
Country or destination Cyprus
City or exchange location Nicosia district (Lefkosia)

[firefly]

A single letter missing - same content.

From the fake site details - http://db.aa419.org/fakebanksview.php?key=118738:
Domain Name: agshippings.com
Update Date: 2016-05-03
Creation Date: 2016-05-03
Registrar Registration Expiration Date: 2017-05-03
Registrar: GoDaddy.com, LLC

Registry Registrant ID: Not Available From Registry
Registrant Name: Majid Ashi
Registrant Organization: Expression Of Interest Nigeria Ltd.
Registrant Street: No 135 Ahmad Bello, Beside Cubana Club,
Registrant City: Wuse 2
Registrant State/Province: Abuja
Registrant Postal Code: 90001
Registrant Country: NG
Registrant Phone: +234.8180339312
Registrant Email: majiddeveloper9@gmail.com

This is what the fake site is looking like:

[firefly]

This is the real person behind those registration details:

Emeka Awa
Chief Operating Officer (COO) at EOI Limited
Self-Employed
Lives in Abuja, Nigeria
From Abia, Nigeria

Pictures:

[firefly]

Tel: +(27) 10 500 8225

The phone number is used online with another domain - zeushc.com.

According to their site:

ZEUS HOLDINGS ATTORNEYS

Our focus is primarily (but not limited to) the following practice areas: Zeus Holdings Attorneys is a young, dynamic law firm based in Kempton Park, Johannesburg. We believe in building close business partnerships with our clients so as to fully understand the environment, climate and industry within which they operate. In this way we are able to partner with our clients in pursuing and achieving their strategic goals while assisting them in avoiding legal challenges encountered in the ordinary course of business. We understand that the delivery of our expert services must function within the context of generating, promoting and protecting their mode of business. For that reason we focus proactively on the needs, aspirations and threats facing clients who operate in extremely competitive and even hostile environments. An attorney should thoroughly understand a client's business needs, strategic objectives and risk management profile in order to assist and advise accordingly. We are focused on developing a culture of excellent client service.

Contact details:

info@zeushc.com
+27105008225
Aston Manor, 1630 Kempton Park

From the fake site details:
Domain Name: zeushc.com
Updated Date: 2016-07-18
Creation Date: 2016-07-18
Registrar Registration Expiration Date: 2019-07-18
Registrar: Register.com, Inc.
The registrant is using the privacy protection given by the registrar to hide his details and location.

[firefly]

From their fake site:

Alvan Courier's (Shipping) International Inc. since 1985, is a shipping company in Hyattsville Maryland, that strives to give customers that personal touch. We value the relationships that we build with every customer and follow up on them once the service has been rendered. Such dedication to customer satisfaction has given us plenty of repeat businesses.

Contact details:

PHONE: 301-927-9710
410-982-6564
EMAIL: info@alvancouriercompany.com
ADDRESS:
907 Somerset Place,
Hyattsville, MD 20783

London Branch
Units A,B &D, Building 251 Ely Rd,
Hounslow, TW6 2RF,
Heathrow Airport

From the fake site details - http://db.aa419.org/fakebanksview.php?key=118739:

Domain Name: alvancouriercompany.com
Update Date: 2016-08-29
Creation Date: 2016-08-29
Registrar Registration Expiration Date: 2017-08-29
Registrar: GoDaddy.com, LLC

Registry Registrant ID: Not Available From Registry
Registrant Name: Majid Ashi
Registrant Organization:
Registrant Street: 6 gwagwalada close
Registrant City: calwin
Registrant State/Province: Alabama
Registrant Postal Code: 90001
Registrant Country: US
Registrant Phone: +1.8180339312
Registrant Email: bank2@123rave.com

This time Majid Ashi, previously in Nigeria, is in US. There is no Calwin city in Alabama. Gwagwalada in an area in Nigeria.
+1.8180339312 is again the same invalid phone number.

This is what the fake site is looking like:

[firefly]

According to their site:

Future home of something quite cool.

The domain is used only for the email address... and for phishing (being already listed on VirusTotal).

From the fake site details - http://db.aa419.org/fakebanksview.php?key=118742:

Domain Name: amenbearing.com
Update Date: 2016-07-13
Creation Date: 2016-07-13
Registrar Registration Expiration Date: 2017-07-13
Registrar: GoDaddy.com, LLC

Registry Registrant ID: Not Available From Registry
Registrant Name: Majid Ashi
Registrant Organization:
Registrant Street: No 6 gwagwalada close
Registrant City: Area 7
Registrant State/Province: Abuja
Registrant Postal Code: 90001
Registrant Country: NG
Registrant Phone: +234.8180339312
Registrant Email: joe@123rave.com

[firefly]

The content of the fake site is stolen from a genuine South African company - even their directors and their phone numbers.

From their site:

Founded in 1992 as a pioneering black-owned company, Axis Investment Corporation is one of Kenya’s leading investment companies, managing assets of over KSh6 Billion. Axis is a unique entrepreneurial company that does not exist only to make a profit, but is driven by a commitment to serve the broader interests of communities at large.

Tel: +27 11 447 7800
Fax: +27 11 447 5502
Physical Address
Axis House
Rahimutullah Towers, P.O Box 10730,
Nairobi
Kenya, 2196
Postal Address
P.O. Box 3308
Parklands
Kenya,
2121

The Kenyan company is supposedly using the real South African company phone numbers.
"Founded in 1992" is a lie - the site was registered last month. Same Majid Ashi is back in Nigeria, using for registering the site an US phone number that does not exist.

From the fake site details - http://db.aa419.org/fakebanksview.php?key=118740:
Domain Name: AXISINVESTS.COM
Updated Date: 2016-11-25
Creation Date: 2016-11-25
Registrar Registration Expiration Date: 2017-11-25
Registrar: Domain.com, LLC
Reseller: FatCow

Registry Registrant ID:
Registrant Name: Majid Ashi
Registrant Organization: Majid Ashi
Registrant Street: No 135 Ahmad Bello, Beside Cub
Registrant City: Wuse 2
Registrant State/Province: NA
Registrant Postal Code: 900001
Registrant Country: NG
Registrant Phone: +1.8180339312
Registrant Email: gol@123rave.com

This is what the fake site is looking like:

[firefly]

From their site - the content is stolen from another genuine site:

Since 1978, A-Z Express Services has been the premier Dallas based courier service, and has employed its delivery and logistics experience to serve a wide range of clients and industries. With state-of-the-art technology, skilled professionals and efficient delivery service, Hot Shot is the solution to all your delivery and logistics challenges.

4231 Concho St | Dallas, Texas 77018 | ‎855.204.6365

ADMINISTRATIVE OFFICE
4231 Concho St
Dallas, Texas77018
Email: customercare@azexpressservices.com
Hours: 7:00 a.m. – 6:00 p.m.
Phone: ‎855.204.6365
MAILING ADDRESS
P.O. Box 701189
Dallas, Texas 77270-1189
AIR COURIER (NEXT FLIGHT OUT)
‎855.204.6365
EMERGENCY CONTACT
‎855.204.6365

+1‎8552046365 - toll-free number


"Since 1978" is a lie - the domain was created in September 2016. Dallas, Texas is located in a non-existent city in Alabama, having a street named after a Nigerian area and using a phone number that does not exist.

From the fake site details - http://db.aa419.org/fakebanksview.php?key=118761:
Domain Name: azexpressservices.com
Update Date: 2016-09-15
Creation Date: 2016-09-15
Registrar Registration Expiration Date: 2017-09-15
Registrar: GoDaddy.com, LLC

Registry Registrant ID: Not Available From Registry
Registrant Name: Majid Ashi
Registrant Organization:
Registrant Street: 6 gwagwalada close
Registrant City: calwin
Registrant State/Province: Alabama
Registrant Postal Code: 90001
Registrant Country: US
Registrant Phone: +1.8180339312
Registrant Email: bank2@123rave.com

This is what the fake site is looking like: