Advert.

Do NOT tell your scammer he is posted here or report their account as it puts others at risk!

Decyber gang - Nigerian nest of fake sites

Report any emails with fake links attempting to steal your ID, and any fake sites used by scammers.

Decyber gang - Nigerian nest of fake sites

Unread postby firefly » Thu May 18, 2017 8:18 am

The group of fake sites makers presented here are active since 2010. So far, we managed to identify their leader and two of his "minions".

Today, their portfolio includes close to 500 fake sites. In the initial stage, they were impersonating banks and courier companies. Some of the fake banks created are using made up names, while others are impersonating real banks all over the world. In the more recent years, the fake sites makers part of this group expanded their activity from scamming only to phishing and also malware.

Email addresses used to register fake sites:

- decybersms@gmail.com
- de.cyber@gmail.com
- decyberconcepts@gmail.com
- vvvconcepts@yahoo.com
- tobidee14@gmail.com
- resingbay@yahoo.com
- jemumena@gmail.com
- salvatondan@gmail.com
- dnise_daniel@yahoo.com
- georgedyle@gmail.com

While registering the fake sites, the email addresses are used with various identities and locations. When they are not located in Nigeria, the fake sites makers from this group pretend to be in the USA, using as a telephone number the number given by a Registrar for the sites using its privacy protection. In other words, the fake sites are registered with fake details and the only way somebody notices, is usually only after victims are targeted or scammed.
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 42976
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

georgedyle@gmail.com

Unread postby firefly » Thu May 18, 2017 8:21 am

georgedyle@gmail.com is the email address used by the main associate in this nest. Back in 2013, he was active on Facebook, with a fake profile set up for romance scams. At that time he was posing as George Dyle, single, and pretending to be:

george.PNG


If that picture looks familiar it is because of viewtopic.php?f=11&t=614. Pictures from the same stolen gallery used in romance scams are reported online at least since 2012.

In the same period of time while he was busy professing his fake love to get his victims money, he was also registering fake sites meant to be used in scams. So far, 50 of those fake sites he created are or were reported. He started with a domain impersonating Reliance Bank back in 2013. The (still) active ones he created are:

- whitehousegov-us.org - impersonating The White House

- ubagroups-bn.com - impersonating United Bank for Africa

- sydneyinternationalairport-au.com - impersonating Sydney International Airport Australia

- nationwide-co.com - impersonating Nationwide Building Society UK

nationwide-co.PNG


- mitsubushi-bank.org - impersonating Mitsubishi Bank Japan

- lakeside-plc.com - impersonating Lakeside Bank USA

lakeside.PNG


- irs-usgov.org - impersonating Internal Revenue Service USA

- infs-ubngplc.com - impersonating Union Bank of Nigeria

- hsbc-investment.org - impersonating The Hongkong and Shanghai Banking Corporation

- harley-brandon.com - claiming to be Harley Brandon Law

harleybrandon.PNG
harleybrandon.PNG (243.71 KiB) Viewed 1491 times


- ghp-dev.org - claiming to be Ghana Project Development

- fininational.com - impersonating Fini National Bank

fini.PNG


- fedreservegov.org - impersonating The Federal Reserve Board of Governors USA

- fedcunion.com - impersonating Federal Credit Union

- falconexdelivery.com - claiming to be Falconex Shipping Service

falconex.PNG


- efcc-govt.org - impersonating the Economic and Financial Crimes Commission Nigeria

- deptofhomelandsecurity.org - impersonating the United States Department of Homeland Security

- cnbintl.com - impersonating Continental National Bank

cnbintl.PNG
cnbintl.PNG (141.98 KiB) Viewed 1491 times


- cbnig-gov.com and cbn-gov.com - impersonating Central Bank of Nigeria

- borderprotection-gov.org - impersonating the U.S. Customs and Border Protection

- bnkofhawaii.org - impersonating Bank of Hawaii

- benin-govt.com - impersonating the Benin Government.
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 42976
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

jemumena@gmail.com

Unread postby firefly » Thu May 18, 2017 8:32 am

jemumena@gmail.com is another associate of Decyber in this business.

The real one:

Joseph Emumena
Self-Employed
Studied at lagos state polytechnics
Went to oketa mixed grammar school ofagbe
Lives in Lagos, Nigeria
Single

jemumena.jpg

jemumena1.jpg

jemumena2.jpg

jemumena3.jpg
jemumena3.jpg (29.87 KiB) Viewed 1492 times


Some of his (still) active fake sites:

- americanlabs.org - impersonating American Lab & Systems

- bank-of-gh.com - impersonating Bank of Ghana

- bnkofeng.org - impersonating Bank of England

- db-groupng.com - Diamond Bank Plc; contact details used:
Diamond Bank PLC
Plot 4, Block 5, BIS Way, off Lekki-Epe Expressway, Lekki, Lagos
Telephone: +2347017923531
Fax: +234-7017923531
Diamond Bank PLC (Head Office Annex)
Plot 1261, Adeola Hopewell Street,
P. O. Box 70381, Victoria Island, Lagos
Telephone: +2347017923531
E-mail:
enquiries@dbgroup-ng.com
complaints@dbgroup-ng.com

db-groupng.PNG


- directornatnalintelligence.net - impersonating the Director of National Intelligence

- fidelitybnkplc.com - impersonating Fidelity Bank Nigeria

- indo-co-in.com - impersonating The Hongkong and Shanghai Banking Corporation

indo-co-in.PNG


- irs-gov-us.com - impersonating Internal Revenue Service USA

- newyork-fed.org & newyorkfrb.com - impersonating Federal Reserve Bank of New York . Also nyfrbonline.com for the same bank impersonation.

nyfrbonline.PNG
nyfrbonline.PNG (203.54 KiB) Viewed 1492 times


- unitedbankforafricas.com & ng-uba.com - impersonating United Bank for Africa.
Contact details used: info@unitedbankforafricas.com
and
customercare@ubaonline.org
Phone Number
+2348137819942
Fax
+2348137819942

ng-uba.PNG


- refinedbixgroup.top - doing phishing while impersonating DHL

- uptowninvestments.top - impersonating Uptown Investment Group; the domain is used for phishing and potential malware

uptowninvestments.PNG


- us53group.com - impersonating Fifth Third Bank

us53group.PNG


- usb-us.org - impersonating Universal Standard Bank;
Email address used for contact: info@usb-us.org

usb-us.PNG
usb-us.PNG (150.64 KiB) Viewed 1492 times
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 42976
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

decybersms.gmail.com

Unread postby firefly » Thu May 18, 2017 8:55 am

Meet Decyber... his friends and/or associates are calling him the "boss", "my oga", or "chairman"...

Obaojeh Osamudiame
Network Engineer at Dengabo Concepts GMBH
Studied at Olabisi Onabanjo University Ogun State
Went to Government Secondary School Ijanikin Lagos
Lives in Lagos, Nigeria
Married

decyber.jpg

decyber1.jpg

decyber2.jpg
decyber2.jpg (24.35 KiB) Viewed 1491 times


In August 2012, one of the fake domains he created - rbsukgroup.org - was disputed by the real owner of the name, The Royal Bank of Scotland Group. The final decision about the case can be found on http://www.wipo.int/amc/en/domains/deci ... -1731.html.

Excerpt from the decision:

Complainant has provided evidence that Respondent had previously used the disputed domain name to pass itself off as Complainant and “phish” for customers’ financial information. The screenshot provided by Complainant of the website at the disputed domain name, demonstrates that Respondent purports to be part of the “Royal Bank of Scotland Group” in order to phish personal and financial information of Internet users.


He acts as a legit internet company, Dengabo Creative Solutions - using decyberhost.com (between 2010 and 2014), decyberconcepts.com (between 2011 - 2014), dengabo.biz (2013 - 2014) and dengabo.info (2013 - 2014). Recently, he is using dengabohost.com (since Jun 13, 2014).

From a list of almost 500 domains he and his associates created, not a single one is real. Some domains got reported by victims and are suspended now without leaving a track online. Some were reported by the online anti-scam community and got removed. A huge amount of their fake sites are still very much alive.
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 42976
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

Binary options scams

Unread postby firefly » Thu May 18, 2017 10:41 am

365binaryconsulltant.com - 365binaryconsulltants.com - freemantrader.com - ipbinarytrade.com

The sites are spoofing a company from the USA having a very similar name.

Contact details used:

Email: trade@365binaryconsulltants.com
Telephone: : +1 979 258 6249

+19792586249 - TextPlus VoIP number

The company using 365binaryconsulltants.com and supposedly active in USA is, according to the fake site details - https://db.aa419.org/fakebanksview.php?key=123632 - in Nigeria. The domain was created in March 2017.

365binaryconsulltant.com looks to be suspended. The domain was created in June 2016 and the registrant was also in Nigeria.

In the second group of sites, for advertising, the scammers are using social media.

Fake profile on Facebook:

Binary trading option freeman trader
Business Details
Parking
Street, parking lot and valet parking

Started on October 28, 2012

Mission
At FreeMan Trader, our online trading business model is based on what is known as the pure exchange rule. It dictates that at any given moment and at any given price, there will be traders who are willing to buy and those who are willing to sell. Even though in one sense both parties are bound by price, on the other hand the price ultimately does not act as a barrier.

In an ideal world, the positions of both the buyers and the sellers would be equal, however in reality this is seldom the case.

FreeMan Trader acts a broker, selling options directly to traders. The trader must predict whether an option will increase or decrease in value within a fixed time frame, and place their money accordingly. There predictions are called put and call options. If they predict the price will increase, this is known as a call option; a decrease in price is known as a put option. (...)

CONTACT INFO

Binary trading option freeman trader

info@freemantrader.com

http:// freemantrader.com/en


About
Florida

General Information
info@freemantrader.com

Awards
binary expect trader

Products
binary trading
categories
Organization


freemantraderfb.PNG


There is more than one domain for this "freemantrader".

ipbinarytrade.com, using the contact details:

Email: trade@freemantrader.com
Website: www. freemantrader.com
Telephone: : +1 415 534 781

+1415534781 might look like a valid phone number, but is not.

According to the fake site details - https://db.aa419.org/fakebanksview.php?key=123669, Florida is, in this case in Nigeria...

ipbinarytrade.PNG


Then we have freemantrader.com. According to the fake site details - https://db.aa419.org/fakebanksview.php?key=123670 - the site is not active since 2012, since the "business" claims to work, but February 2017. Hard to tell where Florida is in this case, the registrant is using the privacy protection given by the registrar to hide his identity and real location.

freeman.PNG
freeman.PNG (173.76 KiB) Viewed 1489 times
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 42976
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

Fake couriers sites

Unread postby firefly » Thu May 18, 2017 11:33 am

- findexcourier.com - pretending to be Findex Courier Services

findex.PNG


- globalpostalexpress.com - pretending to be Global Postal Express Kenya

globalpostex.PNG
globalpostex.PNG (265.89 KiB) Viewed 1486 times


- globalspeedcourier.com, pretending to be GlobalSpeed Courier

Born and bred in the logistics industry more than 15 years ago, we pride ourselves in being one of United State’s largest and oldest supply chain management companies

Looking to the fake site details - https://db.aa419.org/fakebanksview.php?key=123654 - "more than 15 years ago" is a week, USA being in Nigeria...

globalspeedc.PNG
globalspeedc.PNG (158.7 KiB) Viewed 1486 times


- globalzonex.com - pretending to be GlobalZone Express on few pages and Speedex Courier Dubai on other pages of the same site.

Born and bred in the logistics industry more than 5 years ago, we pride ourselves in being one of Nigeria's largest supply chain management companies


According to the fake site details - https://db.aa419.org/fakebanksview.php?key=123576, "more than 5 years ago" was in September 2016.

globalzonex.PNG
globalzonex.PNG (187.32 KiB) Viewed 1486 times


- goldbergexpress.com - pretending to be Goldberg Express.
Contact details used:

11601 Van Nuys Boulevard Apt A, San Fernando Valley Maryland. United States
U.S Office,
+1 810-547-5281

+18105475281 - TextPlus VoIP number

Looking to the site details - https://db.aa419.org/fakebanksview.php?key=123653, San Fernando Valley Maryland is in Burlington, Maine... while the email address used to register the site is active from Nigeria more than once...

goldbergex.PNG
goldbergex.PNG (184.57 KiB) Viewed 1486 times


- milanoshippingcompany.com - pretending to be Milano Shipping Company

Milano Shipping Company is a U.K Courier company


From the fake site details - https://db.aa419.org/fakebanksview.php?key=123558 - we need to believe the UK is is Nigeria.

milanoshipping.PNG
milanoshipping.PNG (268.58 KiB) Viewed 1486 times


- pinanclexpress.com - pretending to be Pinacle Express International

Contact details used:
701 ANNAPOLIS RD GAMBRILLIS, MD 21054.

According to the fake site details - https://db.aa419.org/fakebanksview.php?key=123535 - Gambrills, Maryland is in Apapa, Nigeria.

pinnacleex.PNG
pinnacleex.PNG (268.1 KiB) Viewed 1486 times


- refinedbixgroup.top - pretending to be DHL Express Shipping and Mailing Service. They will not deliver much, but, while receiving an email from them, you might receive a phishing link.

Contact details on the site:
DHL Express Shipping and Mailing Service,
Springfield Gardens, NY. USA.

Looking to the fake site details - https://db.aa419.org/fakebanksview.php?key=123534, Springfield Gardens, NY is in Lekki, Lagos.

- speedy-postalplus.com - pretending to be Speedy PostalPlus Delivery

Contact details used:
Postal House
Dubai Office
+971556746386

From the fake site details - https://db.aa419.org/fakebanksview.php?key=123531, we may believe Dubai is in Maryland, but the email address used to register the fake site was previously used with a Nigerian location.

speedypostalplus.PNG
speedypostalplus.PNG (166.2 KiB) Viewed 1486 times


- speedypostplus.com - pretending to be SpeedPost Plus Courier

Contact details used on the site:
U.K Office +441274288304 ,
U.S Office +19202532140.

First one is a geographic number in the UK. The second one is a Twilio VoIP number.

Looking to the fake site details - https://db.aa419.org/fakebanksview.php?key=123530 - UK and US are both in Nigeria.

speedypostal.PNG
speedypostal.PNG (183.32 KiB) Viewed 1486 times


- unxpresscourier.com - pretending to be Unxpress Courier Delivery

Contact details:
Postal House
Dubai Office
+971556746386

Comparing with the fake site details - https://db.aa419.org/fakebanksview.php?key=123436 - Dubai is in Nigeria.

unxpress.PNG
unxpress.PNG (172.73 KiB) Viewed 1486 times
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 42976
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

Fake sites impersonating US authorities

Unread postby firefly » Thu May 18, 2017 11:50 am

- borderprotection-gov.org - impersonating the U.S. Customs and Border Protection

- deptofhomelandsecurity.org - impersonating the United States Department of Homeland Security

- directornatnalintelligence.net - impersonating the Director of National Intelligence

- fincenvaus.com - impersonating the Financial Crimes Enforcement Network (FinCEN)

- imf-gov.com, imf-uae.com, imfgroup.us, middiantech-kr.co - impersonating the International Monetary Fund

- irs-gov-us.com and irs-usgov.org - impersonating Internal Revenue Service

- justicedept-us-gov.com - impersonating the U.S. Department of Justice

- un-gov.com, unafrica-gov.com - impersonating the United Nations

- us-fedreservegov.org, fedreservegov.org - impersonating the Federal Reserve System

- us-treasurygov.org - impersonating the Department of the Treasury

- uscustoms-govt.com - impersonating the US Customs

- whitehousegov-us.org - impersonating The White House

They had even an fbi-group.org - now suspended.
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 42976
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

Fake sites impersonating other legal authorities

Unread postby firefly » Thu May 18, 2017 12:04 pm

- benin-govt.com - impersonating the Benin Government

- efcc-govt.org - impersonating the Economic and Financial Crimes Commission Nigeria

- gepd-gov.com, ghp-dev.org, ghpdevt.org - impersonating Ghana Economic Project Development

- nigeriaministryoffinance.com - impersonating the Nigerian Ministry of Finance

- nigeriapoliceforce-gov.com - impersonating the Nigeria Police

- sydneyinternationalairport-au.com - impersonating Sydney International Airport Australia

- taxoffice-uk.com - impersonating HM Revenue and Customs

- uk-visa.org - impersonating Visa4UK.
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 42976
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

Fake sites impersonating law companies

Unread postby firefly » Thu May 18, 2017 12:18 pm

ghana-lawyer.com, ghanalawfirms.com, ghanalawyer.com

-marktaylorgroupllc.com - impersonating Mark Taylor Law Group, LLC

Contact details:

Address: A34 Rosebery Avenue, Finsbury
London. EC1 UK
Phone: +441925320583
Email: info@marktaylorgroupllc.com

Fake site details: https://db.aa419.org/fakebanksview.php?key=123560

marktaylor.PNG
marktaylor.PNG (173.02 KiB) Viewed 1483 times


- richmondlekaveli.com - impersonating Richmond Lekaveli Law Office of Richmond

Contact details:

FLORIDA USA ......3125
PEACHTREE ST, SARASOTA FLORIDA 34231
Email: info@richmondlekaveli.com

Fake site details: https://db.aa419.org/fakebanksview.php?key=123533

richmond.PNG
richmond.PNG (92.33 KiB) Viewed 1483 times


The stolen picture of their CEO is also reported in viewtopic.php?t=28466, for being used in romance scams.

richmond1.PNG
richmond1.PNG (34.03 KiB) Viewed 1483 times
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 42976
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

Fake sites impersonating banks

Unread postby firefly » Thu May 18, 2017 1:42 pm

- bank-of-gh.com - impersonating Bank of Ghana

- bankof-africa.net - impersonating Bank of Africa Bénin
Contact details used:
Ms Anne Lynn
Foreign Payment Direct
Bank of Africa Bénin (BOA), Benin
Email: lynnanne@bankof-africa.net; annlynne201@yandex.com
Phone: +22998507881

- bnkofeng.org - impersonating Bank of England

- boagroupus.com - impersonating Bank of America ; boa-direct.com, boa-groupus.com, boa-online.org, boagroup-us.com and boaus-us.com are no more active

- boc-hk.org - impersonating Bank of China (Hong Kong)

- bond-plc.com - impersonating Bond Bank - https://db.aa419.org/fakebanksview.php?key=123696

bondbank.PNG
bondbank.PNG (202.23 KiB) Viewed 1472 times


- caja-de-banco.com - impersonating Caja de Banco Spain; a previous fake site impersonating the same bank, cajadebanco.com, is no more active.

cajadebanco.PNG
cajadebanco.PNG (140.64 KiB) Viewed 1472 times


- cb-ukgroup.com - impersonating Clydesdale Bank
Phone number used for contact: +441702680292

cb-ukgroup.PNG
cb-ukgroup.PNG (216.91 KiB) Viewed 1472 times


- cbn-gov.com - impersonating Central Bank of Nigeria

- cbnig-gov.com - for the same; email address used: governoroffice@cbnig-gov.com

- citigr-ae.com, citigroup-ae.com - impersonating CitiGroup Saudi Arabia

- citigr-us.com - impersonating CitiGroup USA

Contact details:
Citibank Client Services
Citi Inquiries: 100 Citibank Drive, San Antonio, TX 78245
Tel: +1-941-613-9057, +1-951-394-1533

+19416139057 is an Ymax Communications Corp. landline. +19513941533 is a Google VoIP number.

Fake site details: https://db.aa419.org/fakebanksview.php?key=123617

citigr-us.PNG
citigr-us.PNG (161.3 KiB) Viewed 1472 times


- cnbgroups.com - impersonating Continental National Bank

Contact details used:

USA +1 786 310 4394 and
South Africa +27813249263
Email Support@cnbgroups.com

+17863104394 is a Bandwidth SMSEnabled VoIP number. +27813249263 - is a mobile number.

Fake site details: https://db.aa419.org/fakebanksview.php?key=123616

cnbgroups.PNG
cnbgroups.PNG (143.09 KiB) Viewed 1472 times


continentalbanks.com is another fake site impersonating the same Continental National Bank.

Contact details:

US Line:
Phone: (305) 624-2440
Fax: (305) 634-0164
UK Line:
+44 741846 9997
West Africa Line
+234 1 748 1788
Mailing Address
Continental National Bank
800 3rd Ave, New York,
NY 10022, USA.
Email
Support@continentalbanks.com

+13056242440 - BellSouth landline
+447418469997 - mobile number
+23417481788 - Nigerian geographic number

Fake site details: https://db.aa419.org/fakebanksview.php?key=123614

cnbgroups.PNG
cnbgroups.PNG (143.09 KiB) Viewed 1472 times


continentalbgroup.com is a fake domain impersonating the same Continental National Bank and sharing the same contact details with the previous one, except the email address: Support@continentalbgroup.corn

Fake site details: https://db.aa419.org/fakebanksview.php?key=123613

continentalbgroup.PNG
continentalbgroup.PNG (142.28 KiB) Viewed 1472 times
Help yourself by helping others - report your scammer here.
Google can be your best friend;use it if you have doubts about someone met online. If someone met online only asks for money, no matter what reason, it´s 100% scam.
viewtopic.php?f=11&t=26504
Image
User avatar
firefly
"Nut job" admin.
 
Posts: 42976
Joined: Sun Apr 22, 2012 12:27 am
Location: in a parallel universe

Next

Return to Fake sites/Phishing sites.

Who is online

Users browsing this forum: No registered users and 5 guests