For neighbours and shop owners around the building he lived in, an unpainted and unplastered storey building, David Erubure is a web developer and IT expert.
The house, which has about four flats, is in Izomo Idum Area of Warri, Udu Local Government Area of Delta State, southern Nigeria.
Many of Mr Erubure’s social media followers probably believe that he runs a “successful” web hosting company.
However, some of his actions became a subject of international investigation when many of the websites he hosted appeared in multiple fraudulent schemes.
The Norwegian Broadcasting Corporation (NRK), in partnership with PREMIUM TIMES, carried out a months-long investigation into a multi-million dollar fraudulent scheme, including Mr Erubure’s role in it.
We found that Mr Erubure’s neighbours, shop owners and social media followers are not wrong about him. But there is more they probably do not know about him.
From Norway to Nigeria
In Norway, a Northern European country, investment advice and “genius” tricks for making money are everywhere on TikTok: rental arbitrage, house flipping, and stocks you “should” buy.
Mi Le Hagen, an influencer, likes to offer investment advice. The influencer has made tens of thousands in the stock market and regularly shares tips on how her followers can succeed.
Between September and November last year, Ms Hagen started sharing investment advice with followers in direct messages.
“Right now I’m investing in Bitcoin and making good money from it. I can actually give you a good insight into how you can make money through Bitcoin,” she said.
Ms Hagen recommended using a secure investment website for virtual currencies, which were the cryptocurrencies she claimed to have made a lot of money from. The most popular in Norway are Bitcoin and Ethereum.
Meanwhile, there was 247autobot.com, one of the many fake investment websites operated as part of a large scam network.
People who invested money on the website watched their supposed returns grow on the screen. But the returns were not real. The money had never been invested. The scammers had simply stolen it.
“Oh my God. I was scammed out of 23,000 NOK (approx. $2,100),” said a victim who did not want to disclose their real name. That’s about N3.3 million using the current exchange rate of N1,344.45 per US dollar.
NOK stands for Norsk Krone, which translates to Norwegian krone in English. It is the official currency in Norway
This is the story of a sophisticated fraud network that has deceived people around the world, and the hunt for the ones who make it possible.
Mii versus Mi
Mi Le Hagen understands that her followers are hungry for quick money. So, she desires to give them sensible guidance on saving and index funds. But someone, a scammer, was busy doing the opposite.
The person, posing as Ms Hagen, had copied her TikTok profile and was sending direct messages to her followers, some of whom unfortunately fell for the scam.
When she realised at first, she expressed surprise that she was famous enough for people to be copying her on TikTok. The followers contacted her – either to complain they had lost money or wanted to warn her about the fake accounts.
The fake profile created by the scammers was almost indistinguishable from the real one. In fact, the scammers copied many photos and posts from Ms Hagen’s real account. Some of the fake accounts even had more followers than hers.
“It affects my good name and reputation. I give guidance on long-term saving, not speculative tips meant to deliver short-term profit,” Ms Hagen told NRK.
The influencer was devastated. The fake profiles blocked her, so they were only visible to her followers.
She didn’t know how to stop them. All the while, new copy accounts kept appearing, and her followers were at risk of being deceived.
The investor wolf in sheep’s clothing
To unmask the identity of the scammer, the NRK was helped by Daniel Christensen, an ethical hacker who likes to hunt cybercriminals and expose fraud.
Mr Christensen had helped comedian Johan Golden to discover who was using his face and identity to scam people. During the time, he discovered clues that led him to a group of scammers operating on TikTok.
The scammers thought they had tricked another person into investing money on the website they had set up. They did not know that Mr Christensen was the wolf, and not the sheep.
“I could see immediately that the website (247autobot) was not legitimate,” Mr Christensen told NRK.
The scammers believed that they had convinced a new person to invest money through their fake website. But they did not know they were dealing with a man who was secretly looking for coding flaws – weaknesses in the scammers’ websites that could help to expose them.
It did not take Mr Christensen much time to get to the back-end of the website. What he saw as the site’s purpose was unmistakably clear: to scam people out of as much money as possible.
As he investigated the scam websites, more and more kept appearing. All with lists of unwitting investors. All with the same coding flaw.
The woman on the list
One of the people on the list was a nurse from the United States. Mr Christensen noticed that she had recently deposited money into the website.
“She was about to deposit more, so I called her,” Mr Christensen recalled.
He warned her that the website was a scam, but it took several calls before she was convinced. He stopped her from transferring another 3,200 NOK (about $320), using the exchange rate at the time.
However, she had already lost about 20,000 NOK (about $2,000) at the time, according to her. Mr Christensen quickly understood that he could not call everyone on the list.
He thought of another idea: Changing the payment address on the websites. That way, the money would come to him rather than to the unknown scammers who had created the sites.
Mr Christensen’s plan was to send the money back to the people who had been scammed. At first, the plan worked. But it did not last long. The scammers soon stopped his attempt. After that, all the websites showed the same blank white page where the payment addresses had been.
Determined to uncover the scammers, Mr Christensen looked at the investor lists again. One name caught his attention. The person called himself “Eagleworker” and had an investor profile on many of the websites.
Later on, Mr Christensen shared all his findings with NRK: He had found 100 fraudulent investment websites. But NRK subsequently found over 200 more of such websites.
The websites shared several features, making it clear that they were part of the same scam network and the same origin. Sixty of the websites had a security flaw that made it easy to access their back-end systems. Fifty-five contained a Norwegian phone number, while some users had uploaded their passports to verify their identities.
When contacted for comments, several victims – who lack hope of possible recovery of the funds – refused to speak. They were ashamed to give the details of the scam. A few, however, were ready to speak on the basis of anonymity.
Most of them narrated that they created investment accounts at the urging of Norwegian TikTok profiles they followed — including the one that imitated the influencer, Ms Hagen.
Others described long online conversations with friendly people who eventually recommended investing in cryptocurrency. They hoped for quick returns.
But the returns would turn out to be impossible to cash out, because every time they tried to withdraw their money, they were told to pay another fee or tax first.
“I was trusting and I was manipulated. The money I handed over, I will never get back,” one Norwegian victim said.
N86 billion lost to scammers
NRK has identified over 140 payment addresses on the scam websites. Together, these addresses had received more than 12 million NOK (about $1.2 million at the time). This is about N1.6 billion, using the current exchange rate.
The payment addresses are changed regularly and the scammers send the money onward as soon as it is received. This makes it difficult to trace where the money goes.
However, while working for NRK, crypto analyst Arild Møller-Holst from KPMG Norway followed the trail of the money.
Mr Møller-Holst found that the money was sent to at least 54 different crypto addresses linked to cryptocurrency exchanges. These accounts had received around 700 million NOK (about $74 million). The sum is approximately NI00 billion using the current exchange rate.
Mr Møller-Holst told NRK that there are two possibilities: either the people behind these accounts are directly involved in the scam, or they are professional money launderers who help criminals move and hide stolen money.
Connecting the scam network to Erubure
For most people, a website is simply what they see on the screen— text, images, and videos. But for ethical hackers like Mr Christensen, a website is much more than that.
While examining the hidden parts of a scam website, Mr Christensen found something unusual: a function that could create an online store through the domain “storevase.com.”
More than 20,000 online stores were said to have been created through StoreVase, according to the website.
The platform claims that its goal is to make e-commerce accessible to businesses across Africa.
Driven by increased curiosity, Mr Christensen decided to dig deeper. What he found was revealing: A scam investment website, firstapexpips.org, shares parts of its code with storevase.com.
StoreVase was eventually linked to iSkySoftic, Mr Erubure’s company. The iSkySoftic’s name appeared on the login page of the scam website.
The scam hotel
Mr Erubure is listed as the managing director and technical director of the IT company iSkySoftic LTD. The company claims to be offering website templates and a place to host them, which is known as web hosting.
On his personal Facebook profile in 2020, he shared two posts showing that iSkySoftic was offering templates for investment websites.
Business appears to have been going well. On two occasions, Mr Erubure enticed job seekers by promising a mouth-watering salary.
However, the hosting provider was also full of fraudulent websites.
We tracked down old websites and digital accounts linked to Mr Erubure. In 2017, a website registered in his name published the blog post “How to start your own Ponzi scheme in Nigeria”.
He has created many accounts online and used many nicknames. A recurring one has been variations of “eagle.” In 2018, Mr Erubure used this eagle as his Banner photo on Facebook.
On Mr Erubure’s web host, “Eagleworker” was the name that most often appeared on the websites as an investor. On more than 25 fake investment websites, “Eagleworker” has registered a user account.
These user accounts were apparently used to test that the fake investment websites were functioning as intended.
We found that Crypto addresses linked to the websites have received at least $1.2 million (about N1.6 billion). But the crypto addresses are part of a much larger revenue of $74 million (approximately N100.02 billion), according to an analysis performed by the consulting firm KPMG Norway on behalf of NRK.
What our investigation shows
Our investigation suggests that Mr Erubure is behind the Eagleworker identity. Could he also have been involved in running fraudulent websites linked to his web hosting?
NRK found two instances where these identities appear together. On a crypto platform, there was an account with the username “eagleworker” linked to Mr Erubure’s phone number and name.
The scam hunt
For two days, a PREMIUM TIMES reporter attempted to contact Mr Erubure for a response. He rejected all the calls without returning them, even though he did not know who was calling at the time.
Meanwhile, before then, we had obtained, through our investigations, a mobile phone number said to belong to a likely family member of Mr Erubure. Truecaller recognised the number as belonging to “Jennifer Hassan.”
On 3 July, a PREMIUM TIMES reporter identified and visited Mr Erubure’s former house in Warri, Delta State.
The building is a multi-family residential structure, which appears to be under renovation, with some ground-floor windows open and unfinished. One flat was being occupied by an unidentified person, said to be a family member.
Based on interactions with several neighbours and shop owners around the area, we established that Mr Erubure was staying at the apartment until recently, when he got married and moved to an undisclosed location in the same Warri.
During interviews with neighbours and shop owners around the area, PREMIUM TIMES encountered Jennifer. Her apparent anxiety at first when she was shown Mr Erubure’s photograph and when she heard his name mentioned did not immediately send a message until much later. Even when she identified herself as Jennifer, there was no inkling that she was the person we had earlier identified as Mr Erubure’s likely family member.
“I hope there is no problem?” a visibly anxious Jennifer repeatedly asked our reporter after acknowledging that she has known Mr Erubure for a long time. But she was unwilling to share any information about him.
The reporter then posed as an official of a Nigerian bank who had come to find out why he had not delivered a supposed web development contract he had facilitated for him on behalf of the bank.
Jennnifer, feeling relieved, confirmed that Mr Erubure had moved out of the family house after getting married. She excused herself to get Mr Erubure’s wife’s mobile phone number from a shop owner nearby, but returned minutes later, claiming she could not get it.
We observed that Jennifer contacted someone over the telephone, suspected to be Mr Erubure. On her return, she appeared to have taken the journalist’s photograph with her phone.
Our reporter asked her for her phone number for a potential follow-up and immediately checked it on Truecaller when she provided it. When the app identified her as Jennifer Hassan, the reporter was left dumbfounded.
“I’ll keep you updated,” she assured the reporter before parting ways.
Curiously, barely 30 minutes later, Mr Erubure began calling the PREMIUM TIMES reporter. The journalist then texted him, promising to call him back after an “ongoing meeting” in the office.
“Ok,” Mr Erubure responded.
He did not respond to subsequent calls on his phone line. On 3 August, the journalist forwarded a long text message to him, asking for his comment on the outcome of our investigation, which found that several fraudulent websites were linked to his web hosting. He did not respond either.
Mr Erubure later contacted the journalist with another mobile number, which Truecaller confirmed as his.
“Hello. I know I am speaking with David. Let’s….” the journalist said upon hearing Mr Erubure’s faint “hello.” But he immediately ended the call and refused to pick up subsequent calls on the line.
The same day, we contacted Jennifer and confronted her with our findings. She denied involvement in any fraudulent investment website and claimed she does not know Mr Erubure, despite admitting knowing him before.
Under the knife
On 10 August, NRK sent a 1,100-word email with allegations and questions to Mr Erubure. He replied after 37 minutes.
“Hello, I’m glad to hear from you and I believe there may be errors in your investigations,” he tells NRK.
The 32-year-old confirmed that the web host belongs to his company, but says he and iSkySoftic are not involved in any form of fraud.
If it turns out that his customers are involved in fraud, he will take the appropriate measures, he said.
When asked to respond to our position that over 300 websites linked to his web host can be tied to various forms of fraud, he said:
“OK, I can’t certainly tell which are engaged in fraud though, but I believe if the investigation proves they are into fraud then the right steps should be taken. But from this list, although long, I notably can pin one that is a printing company.”
On selling website templates for investment websites, Mr Erubure admitted that his company previously sold website facades, but not full websites.
This was discontinued a few years ago, he said.
But on 21 August, he said:
“We didn’t say we sell investment templates, we sell scripts generally and code snippets which most likely buyers converted into investment templates.”
He argued that the website templates themselves can be used for good or harmful purposes. That is up to the buyer.
“Knife used for cooking can create joy, but it can also be used for wrong purposes,” Mr Erubure said in writing to NRK.
When asked what he would say to those who have lost their money to websites hosted by him, he said: “I am deeply sorry and understand what it means for someone to lose money as I have been a victim too.
“I learnt something from our conversations this past week. What I am sure to do from hence forth is to do a follow up check on websites hosted on our infrastructure.”
The Eagle behind the curtain
Recall that on a crypto platform, there has been an account with the “eagleworker” associated with Mr Erubure’s phone number and name.
When interrogated on that, he replied: “It must have been someone who knows me who set up an account in hopes of recruiting me.”
He has also published a YouTube video with a recording of his own screen. In the video, the browser suggests five previously used email addresses. One is used by eagleworker, and two of them belong to Mr Erubure.
The browser’s autofill reveals email addresses linked both to Mr Erubure and to the “Eagleworker” username.
“I don’t operate that email, but I might know the person that does,” he said.
He continued: “The video was recorded on a publicly available computer when I was training to become a web developer many years ago. Eagleworker must have used the same machine and browser.”
NRK has repeatedly asked Mr Erubure who he thinks Eagleworker could be if it is not him. He has yet to get back on that.
We found that Mr Erubure deleted some images on his Facebook profiles on 8 August, barely 24 hours after PREMIUM TIMES contacted some individuals with investor accounts on the fraudulent websites hosted on his infrastructure.
Mr Erubure admitted removing the images, but defended his action.
“Well it’s normal once a while to delete items I believe you must have done same..,” he said.
Back to Norway
Back in Oslo, Norway’s capital, the content creator Ms Hagen was presented with the findings of this investigation.
“It is possible to follow the money to Nigeria,” she said.
She believes too little is being done and is calling for decisive action.
“I wish that at a higher political level, there would be international cooperation to stop the scammers more quickly,” she added.
Cyber fraud: What Nigerian laws say
There is no indication that Nigerian agencies are currently investigating Mr Erubure, nor has he been found guilty of any crime.
However, fraud of any kind is illegal in Nigeria.
Section 1(1) of the Advance Fee Fraud and Other Fraud Related Offences Act 2006, for instance, provides that a person who, by false pretence and with intent to defraud, obtains property from another person “in Nigeria or in any other country” commits an offence.
This also covers inducing a person in another country to deliver property or confer a benefit. The Act, under its Section 1(3), prescribes “imprisonment for a term of not more than 20 years and not less than seven years without the option of a fine” for convicted offenders.
Nigeria also has the Cybercrimes Act, originally enacted in 2015 and amended in 2024. This legislation deals with various forms of computer-related fraud.
Section 14(2) of the Act makes it a crime for a person, with intent to defraud, to send an electronic message that materially misrepresents facts, causing the recipient or another person to suffer damage or loss.
Offenders face at least five years’ imprisonment and a fine of at least N10 million, or both, according to the subsection of the Act.
But any computer-related fraud, such as fraud committed through scam investment websites, falls under the Cybercrimes Act 2024, a senior Nigerian lawyer, Monday Ubani, told PREMIUM TIMES.
Mr Ubani said that if the matter is investigated and culprits identified, they would be tried under the Cybercrime Act.
“The facts of the case will determine the charges to be filed against an offender, but it will generally come under the Cybercrimes Act (2024),” Mr Ubani, a Senior Advocate of Nigeria, says.
Discover more from Premium Times Nigeria
Subscribe to get the latest posts sent to your email.
