Vneshinvestbank

In the summer of 2013 specialists CERT-GIB (Group-IB) suspended activity of the vneshinvestbank.ru resource belonging to nonexistent Vneshinvestbank (the license is liquidated in 1999).

ATMs of this organization were located in shopping centers and Sheremetyevo Airport and Vnukovo (it early was reported by media). Swindlers used the confidential data entered by users for commission of plunders. The grandiose adventurous scheme looked as follows: the person interested to withdraw money the user inserted the card into the reader device in the ATM, entered the PIN code then received the failure message of a system and at the same time got to swindlers on a hook.

The resource belonging to pseudo-bank existed 170 days (the domain name was registered on January 23, 2013). It is also worth noting that this bank had the status "UNVERIFIED", so, its existence was simply illegitimate.

Alexander Kalinin, deputy manager of CERT-GIB (Group-IB): "Despite the Russian registrar, the resource was placed on servers of the Netherlands hosting provider LEASEWEB with the Russian resseler of http://reserver.ru/. Such scheme of business is rather distributed in network among swindlers and guards already with one existence".

So far to state the amount of damage caused by swindlers extremely difficult. For the last month the Group-IB company removed from delegation of 276 domain names. The greatest share of the detected domains violators is the share of resources using which there was a management a bot networks (58%), the smallest — of phishing resources (3%).