This is extremely suspicious (Job scam)

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Not quite a Newb Joined: 14 May 2009 Posts: 62

Here is the message:

Hello,

I have reviewed over 15 applications (Your resume was my last resume
for the day) and we have narrowed our selection down to five. Good
news, You are one of the applicants we would like to interview by the
end of next week!

Qualifications: Excellent written and oral communication skills to
perform general administrative duties including answering phones and
taking messages, preparing mailings, and ordering supplies. We will
give more specific details at the interview.
Hours: 9:00 AM - 5:00 PM
Pay: $13 - $16 an hour
Benefits Package: Medical, dental, disability/life insurance, flex
medical spending plan, vacation/sick days and 401K

The position will require you to work in a high financial environment
so it's our corporate policy that we do a financial verification check
on all employees to verify applicant registration info. Its corporate
policy that we have applicants sent through our link so we are
compliant with the U.S employment standards act. Please copy and paste
this link Hello,

I have reviewed over 15 applications (Your resume was my last resume
for the day) and we have narrowed our selection down to five. Good
news, You are one of the applicants we would like to interview by the
end of next week!

Qualifications: Excellent written and oral communication skills to
perform general administrative duties including answering phones and
taking messages, preparing mailings, and ordering supplies. We will
give more specific details at the interview.
Hours: 9:00 AM - 5:00 PM
Pay: $13 - $16 an hour
Benefits Package: Medical, dental, disability/life insurance, flex
medical spending plan, vacation/sick days and 401K

The position will require you to work in a high financial environment
so it's our corporate policy that we do a financial verification check
on all employees to verify applicant registration info. Its corporate
policy that we have applicants sent through our link so we are
compliant with the U.S employment standards act. Please copy and paste
this link http://forwardingone.co.uk/redLink/redirect.php?link=1574adfffa2f46ff72d8d2aea763ddf0
into your browser and complete the official application and free report now (You
have 5 hours to complete the necessary requirements):Fill out the form
and indicate that you want the free report. PLEASE DO NOT email us
your report. Instead print it out and bring a copy to the interview as
we will need to have it on file. Since this is just a pre-screen
formality your actual score will not affect your chances of being
hired. Please take a few minutes to do this now.
After completing the score report please reply stating:
-The best time for us to hold the interview. Morning (8-12) or evening (1-5)
-The account reference number you received after you completed the
credit check (we will cross-check with our records at the interview).

I will call and confirm your interview tomorrow morning, upon
completion of the above.
If you have any problems please send a email message to our HR
assistant at [email protected]

Hmmm....duplicated content, suspicious. Link to a UK website when I'm replying to want ads in the US, suspicious. The original job posting wasn't fishy--the advertised pay rate is in line for that kind of work in my area. But this raises some red flags.

I'd like to go check out that link, but I'm afraid it'll install a virus if I do. Anyone know if that site is safe? If so, I'd like to bait these pieces of scum.

Here are the headers:

x-store-info:4r51+eLowCe79NzwdU2kR3P+ctWZsO+J
Authentication-Results: hotmail.com; sender-id=softfail (sender IP is 208.115.198.23) [email protected]; dkim=none header.d=hotmail.com; x-hmca=fail
X-SID-PRA: [email protected]
X-SID-Result: SoftFail
X-DKIM-Result: None
X-Message-Status: n:0:n
X-AUTH-Result: FAIL
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtHRD0yO1NDTD02
X-Message-Info: 2etWe3f/w1fJkxTdcIBPoNPXNkXvarvqazP29pxegqUTnmihY4jOcKxCp7j2MjRUWvKQ4jw+nkqk56Obmx9KL4USHRlByVEGA5iXkXuLMxXLc+Crv4fz51xL5tDY1FmbTZCov7T9NR1yykWqW+0IQA==
Received: from entregasvirtuais.com ([208.115.198.23]) by SNT0-MC2-F19.Snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900);
Fri, 10 Aug 2012 13:53:36 -0700
Received: from Likhon-PC (fip8c235.banglalionwimax.com [180.149.8.235])
by entregasvirtuais.com (Postfix) with ESMTP id E425F1EE12B0
for <[email protected]>; Sat, 11 Aug 2012 08:54:46 +0400 (MSD)
MIME-Version: 1.0
X-Unsent: 1
Date: Sat, 11 Aug 2012 02:14:40 +0600
Content-Type: multipart/alternative;
boundary="------------070703060503020705010302"
Reply-To: [email protected]
X-Priority: Normal
Subject: WE HAVE REVIEWED YOUR RESUME
X-Mailer: Rapid Email Sender
From: "Lisa Lewis" <[email protected]>
To: [email protected]
Message-ID: <5339287056A905A56836C2ABAF084C781A39FA81@Likhon-PC>
Return-Path: [email protected]
X-OriginalArrivalTime: 10 Aug 2012 20:53:36.0453 (UTC) FILETIME=[362FE750:01CD773A]

This is a multi-part message in MIME format.

--------------070703060503020705010302
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="iso-8859-1";format="flowed"

XXX'd out member's email addy. TS

Posted: Sat Aug 11, 2012 12:15 am

Hi Forest,

The first page (the UK website you mention):

Quote:

canonical name forwardingone.co.uk.
aliases
addresses 108.174.194.245
Domain Whois record

Queried whois.nic.uk with "forwardingone.co.uk"...

Domain name:
forwardingone.co.uk

Registrant:
Kim Pampena

Registrant type:
Non-UK Individual

Registrant's address:
The registrant is a non-trading individual who has opted to have their
address omitted from the WHOIS service.

Registrar:
Internet.bs Corp. t/a Internet.bs Corp. [Tag = INTERNET-BS]
URL: http://www.internetbs.net

Relevant dates:
Registered on: 08-May-2012
Expiry date: 08-May-2013
Last updated: 08-May-2012

Registration status:
Registered until expiry date.

Name servers:
bs5.hostwindsdns.com
bs6.hostwindsdns.com

WHOIS lookup made at 02:59:26 11-Aug-2012

Network Whois record

Queried rwhois.hostwinds.com with "108.174.194.245"...

%rwhois V-1.5:003eff:00 rwhois.hostwinds.com (by Network Solutions, Inc. V-1.5.9.5)
network:Class-Name:network
network:ID:Hostwinds Block-108.174.194.245/32
network:Auth-Area:108.174.194.245/32
network:Network-Name:Hostwinds Network
network:IP-Network:108.174.194.245/32
network:IP-Network-Block:108.174.194.245 - 108.174.194.245
network:Customer Organization:Hostwinds
network:Customer Address;I:1002 Reunion Center, 9 East 4th Street
network:Customer City;I:Tulsa
network:Customer State/Province;I:Oklahoma
network:Customer Postal Code;I:74103
network:Customer Country Code;I:US
network:Organization;I:Hostwinds
network:Tech-Contact;I:[email protected]
network:Admin-Contact;I:[email protected]
network:Abuse-Contact;I:[email protected]

-recent/short/registered from a different country, refers you on to a different URL - http://adiekiostaffing.com/application/survey/survey.php [USA] IP: 108.174.194.245

Quote:

canonical name adiekiostaffing.com.
aliases
addresses 108.174.194.245
Domain Whois record

Queried whois.internic.net with "dom adiekiostaffing.com"...

Domain Name: ADIEKIOSTAFFING.COM
Registrar: INTERNET.BS CORP.
Whois Server: whois.internet.bs
Referral URL: http://www.internet.bs
Name Server: BS5.HOSTWINDSDNS.COM
Name Server: BS6.HOSTWINDSDNS.COM
Status: clientTransferProhibited
Updated Date: 18-apr-2012
Creation Date: 18-apr-2012
Expiration Date: 18-apr-2013

>>> Last update of whois database: Sat, 11 Aug 2012 01:36:00 UTC <<<

Queried whois.internet.bs with "adiekiostaffing.com"...

Query error: TimedOut
Network Whois record

Queried rwhois.hostwinds.com with "108.174.194.245"...

%rwhois V-1.5:003eff:00 rwhois.hostwinds.com (by Network Solutions, Inc. V-1.5.9.5)
network:Class-Name:network
network:ID:Hostwinds Block-108.174.194.245/32
network:Auth-Area:108.174.194.245/32
network:Network-Name:Hostwinds Network
network:IP-Network:108.174.194.245/32
network:IP-Network-Block:108.174.194.245 - 108.174.194.245
network:Customer Organization:Hostwinds
network:Customer Address;I:1002 Reunion Center, 9 East 4th Street
network:Customer City;I:Tulsa
network:Customer State/Province;I:Oklahoma
network:Customer Postal Code;I:74103
network:Customer Country Code;I:US
network:Organization;I:Hostwinds
network:Tech-Contact;I:[email protected]
network:Admin-Contact;I:[email protected]
network:Abuse-Contact;I:[email protected]

- A short registration and quite recent, no corroboration on the web of it's existence.

Similar to a real company: Adecco
http://www.adecco.com/en-US/Pages/default.aspx

Where you complete the fairly innocuous online general app. form - seems innocuous enough, collects IP address of computer viewing the site, name address, email - standard public domain knowledge ( + generic stuff eg. "What do you consider to be your greatest strength" "... weakness" etc. - it then refers to a credit reference agency, (a legit one as far as I can tell, https cert is valid.) demanding you get "screened",https://credit.profinity.com/lp/6/index.asp?GUID=JL4YUJAQ8MJA&SID=219842&utm_expid=54827620-6

After you've got your credit check it asks you to mail [email protected] to continue.

Quote:

employeestaffingus.com

Address lookup
lookup failed employeestaffingus.com
Could not find an IP address for this domain name.
Domain Whois record

Queried whois.internic.net with "dom employeestaffingus.com"...

Domain Name: EMPLOYEESTAFFINGUS.COM
Registrar: GODADDY.COM, LLC
Whois Server: whois.godaddy.com
Referral URL: http://registrar.godaddy.com
Name Server: NS1.SUSPENDED-FOR.SPAM-AND-ABUSE.COM
Name Server: NS2.SUSPENDED-FOR.SPAM-AND-ABUSE.COM
Status: clientDeleteProhibited
Status: clientRenewProhibited
Status: clientTransferProhibited
Status: clientUpdateProhibited
Updated Date: 02-may-2012
Creation Date: 14-apr-2012
Expiration Date: 14-apr-2013

>>> Last update of whois database: Sat, 11 Aug 2012 01:48:46 UTC <<<

Queried whois.godaddy.com with "employeestaffingus.com"...

Registrant:
Media Leadia LLC
826 Travers St
Union, New Jersey 08520
United States

Registered through: GoDaddy.com, LLC (http://www.godaddy.com)
Domain Name: EMPLOYEESTAFFINGUS.COM
Created on: 14-Apr-12
Expires on: 14-Apr-13
Last Updated on: 18-Apr-12

Administrative Contact:
Lester, Derek [email protected]
Media Leadia LLC
826 Travers St
Union, New Jersey 08520
United States
+1.6095584472

Technical Contact:
Lester, Derek [email protected]
Media Leadia LLC
826 Travers St
Union, New Jersey 08520
United States
+1.6095584472

Domain servers in listed order:
NS1.SUSPENDED-FOR.SPAM-AND-ABUSE.COM
NS2.SUSPENDED-FOR.SPAM-AND-ABUSE.COM

SUSPENDED-FOR.SPAM-AND-ABUSE.COM Laughing

Apparently mail only - needs baiting to get evidence to close them down, and the other one.

To recap, couldn't find any malware, but:

1/ Referal page: forwardingone.co.uk - not sure if you'll get any evidence against this one to get it taken down, but if you do then it needs reporting whilst number 2/ is still visible.

2/ ADIEKIOSTAFFING.COM - Needs baiting.

3/ EMPLOYEESTAFFINGUS.COM - Needs baiting. (But may well have been suspended for spam and abuse.)

I don't mind having a go, but it'll have to be tomorrow as I've given half a dozen fake logins on this IP at the site, don't want to risk being flagged as a baiter, so I'll wait for my ISP to do it's daily thing to make me look to be from somewhere else, and will report back here.

Edited for data.

Not quite a Newb Joined: 14 May 2009 Posts: 62

Thanks for checking out the link!! I'll go ahead and bait them too.

I already decided to start by emailing them and saying I couldn't get their page to load, so I'll have to see if I hear back. Job scammers are the lowest of the low.

Hello I'm New here! Joined: 16 Aug 2012 Posts: 1

Yesterday I got the same email. are you located in jax fl?

Posted: Fri Aug 17, 2012 1:04 am

^^ Location won't matter if it's a scam (good chance). Job scam emails are sent out to hundreds of addresses at a clip. Not much to go on here, but my guess is the "high financial environment" bit will have to do with cashing (fake) checks or money orders, "keeping" a percentage for your commission and sending the bulk of it off somewhere via untraceable wire transfer. The check may clear, but sooner or later, it will be rejected and you will be responsible for the full amount.

There are other variants, of course, but they all end up more or less the same way: someone who needed a job ends up in debt, and most likely in a pile of legal trouble as well.

Hello I'm New here! Joined: 30 Aug 2012 Posts: 3

Got a couple of job emails as well, although they look professional, they made the mistake of duplicating Very Happy

This is the email:

Quote:

Hello to everyone who wants to improve their financial position!
We are an international company that is constantly on the lookout for active, dynamic, ambitious people willing to make better use of their free time. If you are looking for a part-time job that will allow you to utilize your professional and personal qualities and give you an opportunity of further career development - we will be happy to help you help yourself. You don't need to have any particular experience - all we require from you is your will to earn more money while doing an interesting and rewarding work.

If you are interested, please reply to our email: [email protected]

Thank you for your time and good luck!

I did a whois lookup on juno.com

Quote:

Domain Name: JUNO.COM
Registrar: CSC CORPORATE DOMAINS, INC.
Whois Server: whois.corporatedomains.com
Referral URL: http://www.cscglobal.com
Name Server: AUTHNS.DCA.UNTD.COM
Name Server: AUTHNS.IAD.UNTD.COM
Name Server: AUTHNS.VGS.UNTD.COM
Status: clientTransferProhibited
Updated Date: 17-jan-2012
Creation Date: 17-dec-1994
Expiration Date: 16-dec-2019

>>> Last update of whois database: Thu, 06 Sep 2012 10:07:38 UTC <<<

The two emails it came from are as follows, with the corresponding whois lookups, and headers.
Just so you know, the *** is where my email was, just blanked out for privacy reasons.

[email protected]

Quote:

Domain Name: DDPYLE.COM
Registrar: REGISTER.COM, INC.
Whois Server: whois.register.com
Referral URL: http://www.register.com
Name Server: DNS117.A.REGISTER.COM
Name Server: DNS197.B.REGISTER.COM
Name Server: DNS239.C.REGISTER.COM
Name Server: DNS249.D.REGISTER.COM
Status: clientTransferProhibited
Updated Date: 29-may-2009
Creation Date: 10-dec-2003
Expiration Date: 10-dec-2014

>>> Last update of whois database: Thu, 06 Sep 2012 10:34:20 UTC <<<

Quote:

From Katrine Lester Wed Sep 5 04:52:28 2012
X-Apparently-To: ***@yahoo.com.au via 98.138.85.22; Wed, 05 Sep 2012 04:53:25 -0700
Return-Path: <[email protected]>
X-YahooFilteredBulk: 114.24.67.179
Received-SPF: none (domain of ddpyle.com does not designate permitted sender hosts)
X-YMailISG: KM6QFRgWLDsRML3ysl5oJvqpEtimIefmlGUgqQUy8edEG2m1
ezjOkYaRRyBLPpJswb8PRAU7udT8ssR1m32KVRfs3DS7zSAYyq8mSgjBVKVw
p3vKVftLhs70WuMrkb6ByqP4oelIaEKq.3B9DeZ7d.hCaMmDKpjA_1PHeIhd
sjUItH2DQVRjgVL.1c1St0M0dZ24ZqW1ZqGx5EefT7jb6SCHK6gyRovLcrxZ
RV2MISu5RdjquM7iv.wggmyMKeWsb0.pp1NyyvtBEtjmkNuHFgeUYyZQphwO
KkD1soOWnk1NySkbwITm9eq6ZEmuPiZYf5vl21MBJ0.XFGOUMKJ6frRoG60x
kJUzj23PyYaILIvhfRwg2tVpL03_GiNtQInBIHkpm5BwyRxHqKH9dh3.7VG3
lE.T4C5lgnvJu0NhFz9eQBAAzRlnbBZIryZUDxXIDVAPw.j49tG.XD7xXXR_
gEt6TcjRdpbTmtx8HI92lfQkeQYW4w1pPgu7mjHy74wBS6mpDbQVwIHfW1A3
AanU7y2n06liPcNRftnU6ZAwJZiz_iArQ7jJQerUvc4iLH.vzTMLOvCYCnHQ
xKCvM_mjaYaXiK_q6QtSggNCuQBSK1pY1wRjGZcryPGh2BO0PbAgtGJut5VS
aIE9.z_uvE9R3hwELPc_uHba1qTqbsRsjMEWddvy11Z8B0XOmMcRdGqs3390
fhqm27EoyiMNTvQP_xhOgGs_XhH1K7KcPfLLjvuf831qQ74h4.6Xh8Y8iEUm
esCAb48KYHseLN0zkf6pfX27J8TO0O5DWoXWo6Ti9GlNLpJHCCuMqe2xWYs8
qAEUDXlwIsacyvJsqZNuTzpoVSrVOT2__hJhpWHze533UMCTIR0CjXaZYkfH
.jXRB1VVdwQPVxpZh5d0xjcz82fRpuZLPkm8XpjUhGR4ef.rcLxea6njHXER
QN_UeETDVkRqxW4hY84iBILVOcOqjYW58DeSrFA6o1R2eV3qWtnPL6aSQZaj
dvGxBXviMYzgKhThLFo6.kgyMrvV7rOQKLV3MsB2oSHhXjAoUIF3x_ko6Yav
SJkMt_04gDMTARBAQbxSPciBCQsERCz8wUwxs2.CzM3KSIevk2QfSIIk0RG2
ZspZR.KePtXGMHUMDGa9VHUEhGJPJw--
X-Originating-IP: [114.24.67.179]
Authentication-Results: mta1329.mail.bf1.yahoo.com from=ddpyle.com; domainkeys=neutral (no sig); from=ddpyle.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (HELO 114-24-67-179.dynamic.hinet.net) (114.24.67.179)
by mta1329.mail.bf1.yahoo.com with SMTP; Wed, 05 Sep 2012 04:53:25 -0700
Received: from unknown (HELO ski) ([96.191.36.117])
by 114-24-67-179.dynamic.hinet.net with ESMTP; Wed, 5 Sep 2012 19:58:15 +0800
Message-ID: <002401cd8b5d$0e19be80$60bf2475@userPCski>
From: "Katrine Lester" <[email protected]>
To: <***@yahoo.com.au>
Subject: Workplace and good stable salary for citizens of Australia
Date: Wed, 5 Sep 2012 19:52:28 +0800
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset="windows-1250";
reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1807
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1807
Content-Length: 701

[email protected]

whois lookup failed for that one.

Quote:

From Emmanuel Soto Wed Sep 5 15:33:10 2012
X-Apparently-To: ***@yahoo.com.au via 98.138.85.23; Wed, 05 Sep 2012 15:34:11 -0700
Return-Path: <[email protected]>
X-YahooFilteredBulk: 187.45.123.244
Received-SPF: none (domain of ml.com does not designate permitted sender hosts)
X-YMailISG: CyGMDNMWLDt54f5J_UeapXMIhJtYJuhTBeORdlWXAZgWpHOl
jHlC5vVF.48Cvn7GKuIr8_dJc2jWGaPCD_W2Yf23D8Fyi0gdhm3l92i1sYZX
qYn3oMvdWMNN4tZsZlEhgfmAjM88aQXx_H.8hN3JOgeJxxdWeN_LTvoYWaNB
AX4pV8AQwiKEhsgZtUGPsO1PRsjSlJCIeYAfn3OvNkhnasgcyGUGiqATjiZn
zOMhswi5EtNQVM7cuLA7G7tnNLbrdBSpSy.2E700_b.BcHZGrVg_EiSwQiAY
TnI7BmEwQ5l2Xfd3eKkVx7eEoh1pS_9DLVsr4.cRBB9AF2sijvOpdifRuo7E
NYYk7aw4rxPU31gNFFdqt7fRWfwdbX42SvPckDvqEPsG4v_uHJw4WWzoYY7D
mS5FusmxTdvRbSmr7ArIkY342d79T1jc1x.PzyHqCytpHmKbHGlMdXdQB9Hu
a_CR8ZP0yqhUTFFrUMJcM6TFPYNWtotOHNv1lK3ekCCh3RAtEn1IOUttSywR
oG4x0NyQSRUpwLp7zBSPfdHg3YbI219NIL8sF_Ok0s7oT7xBXjOuvGXtJnnc
_gDulbOOSgs_4K_8zYJSxBBZpvLcJiv9ktwtDjlJLikJd1_yF0V2kGuISccj
.bWddeOhCc60EU1jceQ71TwBO2LXQsdsBxD4Kcaw7F82qXhwO9_LZ4VkS5RS
GFIVQq0FqvFAJCZ5WCKM3HCwMKmE2YfTToOGGcKFbAQkKc6euzxtQa2.kYCO
QYJVpggVgOFqj6AoVf_Gi7ISECxFp97w1uvwd0OvFFD9qP6_Ap0342WMbNRp
Ztb9mwcKq6ELx60rn92AVhuw7Dx6.M0urOi5x3J4YgFcR6bL6jzmKWLTv8Sk
zH.UMawq2nbaQO3z4tfPm7JT1y7knMpjgkjMUv.PK.qzt3Ki6xVerbszW6W1
b0YPqkFqUKmZAof0AVjGZ12FkoSiiPVtiKf7z8dvAXezUQwTU2AFrTasmuT5
P6Un0OsiOUcrvLVqVNXT2U2ILBVrHWvPgKnkpJUklh82OBkbWKon0aIUdVJz
S9RLoes3tcY0r0QgXGvO6g--
X-Originating-IP: [187.45.123.244]
Authentication-Results: mta1278.mail.mud.yahoo.com from=ml.com; domainkeys=neutral (no sig); from=ml.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (HELO 187-45-123-244.mhnet.com.br) (187.45.123.244)
by mta1278.mail.mud.yahoo.com with SMTP; Wed, 05 Sep 2012 15:34:11 -0700
Received: from unknown (HELO i76) ([129.83.88.75])
by 187-45-123-244.mhnet.com.br with ESMTP; Wed, 5 Sep 2012 19:36:44 -0300
Message-ID: <002c01cd8bb6$90e11030$8153584b@ElenicePCi76>
From: "Emmanuel Soto" <[email protected]>
To: <***[email protected]>
Subject: IT Jobs in Australia
Date: Wed, 5 Sep 2012 19:33:10 -0300
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset="windows-1250";
reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1437
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1437
Content-Length: 701

Just wondering if anyone help.
Though that this would be a good place for this as it is a suspected "job scam"

This is extremely suspicious (Job scam)	View next topic View previous topic