M&T Bank scammers now using SCHOOL DOMAINS

Popup - https://montesori.edu.rs/M&T

Registered by the Montesori Elementary School in Beograd, Serbia via DHH SRB d.o.o.

Associated Phone Number - [email protected] (+682 (265) 767-266)

Popup redirects to Log in to M&T Online Banking or Commercial Treasury Center (bpsres.edu.np)

Registered by Shree Bakhan Multipurpose Co-operative Ltd. under the guise of the Bhu Pu Sainik Rising English School in Rampur-5, Palpa, Nepal.

Requires users to “sign into” their M&T Bank account, then provide the following information before being redirected to Welcome to Online Banking | M&T Bank (mtb.com):

  • Email Login information
  • Name
  • Home Address (Address line 2 MUST be completed
  • Phone Number
  • SOCIAL SECURITY NUMBER
  • Credit Card information

Associated Facebook Accounts:

Associated Phone Numbers:
+977 75400169

+977 (0)56 592483

+381 60630354

Associated Email Addresses:
[email protected]
[email protected]
[email protected]

Associated Physical Addresses:
Žanke Stokić 11, Beograd, Serbia

VW72+MJ8, Rampur Hwy, Rampur 32500, Nepal

Associated IP Addresses:
194.146.59.194 (Also hosts www.user.maxiketering.com)

148.66.135.69

NEW POPUP - http://cascanuecesbaq.edu.co/MTB

Registered by the Cascanueces Preschool in Colombia via .CO Internet S.A.S. on May 30, 2019 (Updated June 11, 2020) - Whois cascanuecesbaq.edu.co

Associated Phone Number - [email protected]

Popup redirects users to Sign in (saudiacademy.edu.sa)

Registered by the Saudi Academy in the Kingdom of Saudi Arabia - Whois saudiacademy.edu.sa

Associated Phone Numbers:
tel: 00966548651762
tel: 00966563630861

Associated Email Address - [email protected]

NEW POPUP - https://christcet.edu.in/M&T

Registered by the Christ College of Engineering and Technology in Pondicherry, India via ERNET India on December 3, 2012 (Updated December 21, 2021) - Whois christcet.edu.in

Associated Phone Number - [email protected]

Popup redirects to Log in to M&T Online Banking or Commercial Treasury Center (phi.edu.eg)

Registered by the Pyramids Higher Institute for Engineering and Technology in Giza, Egypt.

Guess who’s back, back again?

Popup - http://ibobber.grgprod.com/MM.php

Registered by Jeffrey Grace of GRG L.P. in Easton, Connecticut via FastDomain on January 13, 2009 (Updated December 31, 2022 - Whois grgprod.com

Associated Phone Number - [email protected]

Registered via NBCUniversal Media, LLC in Eaglewood Cliffs, New Jersey on February 21, 2000 (Updated January 20, 2023) - Whois accessonline.com

Popup redirects to Sign in (pfhmarkets.com)

Registered via GoDaddy on October 8, 2019 (Updated November 18, 2022) - Whois pfhmarkets.com

Popup - smilescreator.com/inc.php

Registered by Afshin of AA Tech Design in Los Angeles, California via NetEarth on 4/20, 2002 (Updated June 11, 2018) - Whois smilescreator.com

Associated Phone Number - [email protected]

Popup redirects to https://mi.mteambr.com/jss.php/?verify

Registered in Brazil via eNom, LLC on April 1, 2013 (Updated February 27, 2023) - Whois mteambr.com