On November 28, 2022, I was contacted by someone  (From Guinea – Conakry) who invested a lot of money in a financial investment website. During a couple of time, the money raised up to thousands of US dollars, the person decided to take the money into his account, unfortunately no success. The service provider said that they will take 30% of the money raised, the person accepted the condition, but the service provider said that the person needs first to send the 30% then he can get access to the rest of money. I was contacted by the person and explained to me the situation. As an OSINT lover, I decided to take my responsibility.

I asked the person to share the details so i can start the investigation.  

I got following details:

Website name: Goldmaneur{.}om

“The person also shared the name and pictures of some people from Telegram who talk to him about the website (For privacy reason, we won’t share these information)”

After collecting all the details, I started my investigation.

Investigation:

Goldmaneur{.}com

First of all, I started to check the domain via Google search

goldmaneur.com Reviews | check if site is scam or legit| Scamadviser

From scamadviser.com, I got the following information:

The score is quite low

People comments about the website.

The comments are quite interesting , almost the same details that i got from the person who contacted me.

(The website owners are taking money from people and forcing them to pay 30% in order to get back the money raised).

At this point, the investigation started to become more interesting, the comments from others third parties were very helpful.

 I found out another  comment on LinkedIn:  

I clicked on the link and found the message below:

Again, another person saying the same thing. From this point I was sure about 80% that the website is a fake investment.  

But i wanted to check deeper to find others connection with the website, i checked VirusTotal, Riskiq, Security trails, i did not find more information. I got an idea, Censys, i checked it and found some interesting details:

https://search.censys.io/certificates?q=goldmaneur.com

I found more domains using the same certificates.

I clicked on one domain and  I found the following domains related to it.

https://www.entrust.com/blog/2019/03/what-is-a-san-and-how-is-it-used/

I started to check the domains above if i can find more information, the following information were found:

Goldmanusd{.}com 

Comment from Twitter

Another indicator found.

I checked the domain  via Who si lookup and found the following details:

The domain is created 140 days ago, using Cloudflare to hide the real IP address and to target more people around the world. Which could be a sign of world wide scam. 

goldman-global{.}com

Riskiq RiskIQ | Digital Risk | Cyber Threat Intelligence | Incident Response | RiskIQ

Some subdomains related to the domain

I decided to checked URLSCAN to see how the website goldmaneur{.}com looks like and perform further investigation on the website:

goldmaneur.com – urlscan.io

One important think I found was that the website is using a fake logo of Goldman ( a leading global financial institution) to trick people to to trust the website.

Another important information I found on the website was the online logo

I clicked on it and found the chat online available but at the time of writing, the chat is not working. 

I went on Telegram to check if i can find some information about the owner, i found the following picture with no specific details such as number, email address, picture and others.

I found also the download version of the application

https://goldmaneur{.}com/download/

I checked if others domains are using the same websites from URLSCAN, I found the following details:

First I connect to goldmanneur[.]com , clicked on the Hash to find all the website that use the same image.

goldmaneur{.}com – urlscan.io

I found:

Search – urlscan.io

We can see Goldmanusd{.}com, which means that the website site used the same logo. Another evidence that they operate together.

NB: One important thing to mention here is that, the website does not have any specific information such as information about the project, the creation of the website, the owner, the contact and others. Which is very strange. A normal financial website should have more details and the contact should be available for people who wish to contact.

We stop here our investigation as with all the information collected, we can assume that the website is used by scammers and operate around the world.

Before using any similar website, check always the information about it as we did. Many scammers used the same technics to trick people. When you face with such issue, report to the police as fast as possible to stop the scam and help other people to not get scam.

Bangaly Koita

Bangaly Koita is a SOC Analyst and  Cyber Security researcher . As a passionate in cyber security,  he spends most of the time  writing articles and making videos online to share his knowledge and experience to the vast community of IT but in general Cyber Security. Feel free to contact me in case.

osintafrica.net

The post Goldman website scamming people in Guinea-Conakry and around the world. first appeared on osintafrica.