ITP CONSULTING GROUP JOB OFFER SCAM

Website: itpconsultinggroup.com
Title: ITP Consulting Group

Domain Age: 39 Days
Website Speed: Average

Owner: Privacy Protection
Owner Address: PO Box 65
Owner City: Kiev
Owner Postcode: 04112
Phone Number: +380.443927433 [Ukraine]
Phone Type: geographic :Kyiv city
Email: [Ukraine]

Owner Country : Ukraine [Ukraine]
Website Location : United Kingdom [United Kingdom]

Probable website origin :-
78%; [Ukraine] Ukraine
14%; [United Kingdom] United Kingdom
6%; [Netherlands] Netherlands
3%; [France] France

Notes:-
[Alert Result] This website is 39 Days old
[Alert Result] The website expected life (364 days) is relatively short.
[Alert Result] The website appears to be less than six months old
[Alert Result] This website setup involves countries known to be high risk
[Alert Result] This website is likely to be operating from a high risk country

Analysis Details:-
This webite is very new , and as such doesn't have an online reputation yet. As with all new businesses , we suggest that you take care and if necessary get in contact with the owners before placing an order of value.
This site has a high risk country associated with it. This may be as you expect but care should be taken if purchasing an item from a site that you didn't expect to be associated with the countries listed above. Certain countries are listed as being high risk because of the high percentage of online fraud or tendency to send fake/replica items.

The website has been newly registered with a short life expectancy, which follows the pattern used by many fraudulent and fake selling websites. Please be vigilant and take extra care before providing any payment information.

The website is now pretending to be down for maintenance.

However if you look at the source (which no doubt their victims have been told to do)

DEAR VISITOR/CUSTOMER,
OUR WEB-SITE IS CURRENTLY UNDER MAINTENANCE.

We will be adding new interactive menus and features and will be back shortly. If you are a customer, please, dial your Personal Manager or call us at +41 021 826 10 23.
You can also email us at [email protected]
We do apologize for inconveniences!
The web-site opening is scheduled for 9/1/16 we will notify all our customers about the opening via e-mail!

I see the website is down now for "maintenence" that email address does not work my emails always get returned. I emailed every address they had on their page, it seems like the scammers are still at it and will be making the website even more legit looking. If I had international dialing I would try those numbers and see who it puts me to. The strange thing is there is a real itp consulting group based out of south carolina that was using the same domain , I went on their facebook page but they havent been active in about 2 years. Maybe the scammers realized this and capitalized off of it. I wonder how many people they got with this. This is one of the best employment scams I have seen and im sure people are falling for it. If you have more information please post. Hopefully someone sees this before its too late. These guys a very good with this and im sure its not their first rodeo, like I said I spoke to the guy "david scott" on the phone and he never missed a beat he was in his role and explained everything to me. I want to see what happens to someone who got the money transfered onto their card and then bought the cards.

The website is now pretending to be down for maintenance.

However if you look at the source (which no doubt their victims have been told to do)

DEAR VISITOR/CUSTOMER,
OUR WEB-SITE IS CURRENTLY UNDER MAINTENANCE.

We will be adding new interactive menus and features and will be back shortly. If you are a customer, please, dial your Personal Manager or call us at +41 021 826 10 23.
You can also email us at [email protected]
We do apologize for inconveniences!
The web-site opening is scheduled for 9/1/16 we will notify all our customers about the opening via e-mail!

I just tried to email the address on the site and this is what I got back, funny thing is they have it listed as a china office but it gets bounced back from ukraine. They're saying the site wont be back up until sept 1st lets see how many more people they get with this. Im sure its endless because they prey on people looking for jobs so all they have to do is goto the job boards and copy and paste the same email to about 200+ people and im sure all 200 respond then about 100 of them go through with the scam , if theyre asking everyone to get $10,000 USD worth of apple gift cards they are coming up. Im sure then they are doing some sort of drop scam shipment where they are buying computers from apple then having another fake company that does shipping. Then do a drop ship at someones house that thinks they are working a legit job who then forwards the package to the next person and then over to ukraine some where. Then the stuff is being sold online or across the world.

Delivery to the following recipient failed permanently:

[email protected]

Technical details of permanent failure:
Google tried to deliver your message, but it was rejected by the server for the recipient domain itpconsultinggroup.com by mx15.ukraine.com.ua. [2001:67c:2070::c].

The error that the other server returned was:
550 5.1.1 <[email protected]>: Recipient address rejected: User unknown

So I've done some more digging and there seems to be an ITP CONSULTING GROUP based out of Charlotte NC
that has the same website address and domain emials as the scammers " @itpconsultinggroup.com"

There is also a linkedin profile for them, which I believe is the real itp consulting group but is no longer in business :
https://www.linkedin.com/in/itp-consult ... p-923ab785

As you see the linkedin i looked to the right and saw the name of one of the scammers "Peter Zeier" from switzerland which is where the scammers itp consulting group is from. "Peter Zeier" Was the one who sent the banking instructions on how to get the money transferred to my account. These guys have gone as far as creating fake linkedin profiles and piggy backed off the real website.

There is also a facebook page, but the last post was back in 2014 but also has the same website listed. So either they started this scam back then or this was the real companies page and they are just piggy backing off of it. There is also a twitter page that hasnt been active in about 2 years as well. My guess is the original company went out of business and the scammers took the name and set up shop with it.
https://www.facebook.com/ITP-Consulting ... /timeline/

These are the other names that they are contacting people under
Names:

Ms. Daisy Watson, HR Assistant
ITP Consulting Group, HR Department
Ph: 020 3290 6061

Laura Mansell
Peter Zeier
Phones:

203-290-6061

646-893-8851

646-893-8853

Domain Name: ITPCONSULTINGGROUP.COM
Registry Domain ID:
Registrar WHOIS Server: whois.ukraine.com.ua
Registrar URL: https://www.ukraine.com.ua
Updated Date:
Creation Date: 2016-07-06T19:22:02Z
Registrar Registration Expiration Date: 2017-07-06T19:22:02Z
Registrar: HOSTING UKRAINE LLC.
Registrar IANA ID: 2374
Registrar Abuse Contact Email: [email protected]
Registrar Abuse Contact Phone: +380.443927433
Domain Status: ok http://www.icann.org/epp#ok
Registry Registrant ID:
Registrant Name: Privacy Protection
Registrant Organization:
Registrant Street: PO Box 65
Registrant City: Kiev
Registrant State/Province: Kiev Region
Registrant Postal Code: 04112
Registrant Country: UA
Registrant Phone: +380.443927433
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: [email protected]
Name Server: NS18.INHOSTEDNS.COM
Name Server: NS28.INHOSTEDNS.NET
Name Server: NS38.INHOSTEDNS.ORG
itpconsultinggroup.com has address 185.104.45.30
itpconsultinggroup.com has IPv6 address 2a06:6440:0:2d1e::1
itpconsultinggroup.com mail is handled by 15 mx15.ukraine.com.ua.

203-290-6061: Norwalk, Connecticut

646-893-8851: New York City

Some one needs to report the site as abuse before it gets even more people scammed. This scam is so complex and seems so legit its going to get a lot of people.
[email protected]

Could you post the headers of emails you've posted from the domain, or post emails from the domain with complete headers? Make sure we can tell which headers go with which body. That will help us kill the site.

Yes, sure no problem just explain to me how to do it and Ill post it because these guys need to be shut down ASAP , they are trying to re do the website to scam more people. They need to be stopped

Could you post the headers of emails you've posted from the domain, or post emails from the domain with complete headers? Make sure we can tell which headers go with which body. That will help us kill the site.

Try this link for headers:

How to extract email headers: http://www.iptrackeronline.com/how-to-e ... eaders.php

Make sure to remove your name/email address from the headers before posting.

I followed the steps and it seeems that the email is coming from someone in spain, so the headers say.
This where it points to a place called "calle padre espinosa marbella spain".
Here is the header analysis report.
Ip Address 3rd Party Info Provider City Flag Country
* 92.59.205.185 Check 92.59.205.185 at Senderbase.org Check 92.59.205.185 at Reputationauthority.org Orange Espana Marbella Spain
4.1.0.4 Check 4.1.0.4 at Senderbase.org Check 4.1.0.4 at Reputationauthority.org Level 3 Communications Englewood United States
74.91.89.9 Check 74.91.89.9 at Senderbase.org Check 74.91.89.9 at Reputationauthority.org Rackspace Hosting Manchester United States

Try this link for headers:

How to extract email headers: http://www.iptrackeronline.com/how-to-e ... eaders.php

Make sure to remove your name/email address from the headers before posting.

Could you post the full headers with your personal information removed? We need those in order to kill the site.

The originating IP address is not what we are after. We need the complete sequence of Received headers. We may also need a previous outgoing message, but I won't be able to tell until I see the headers of the message you got.

Also be sure to indicate clearly which message body corresponds to the headers.

Hopefully this is everything you need below to shut the site down.... .
Delivered-To:
Received: by 10.237.53.199 with SMTP id d7csp1192771qte;

X-Received: by 10.107.10.170 with SMTP id 42mr22255754iok.131.1469458344632;

Return-Path: <[email protected]>
Received: from mailer9.gate89.rs.smtp.com (mailer9.gate89.rs.smtp.com. [74.91.89.9])
by mx.google.com with ESMTPS id a7si18153202itd.38.2016.07.25.07.52.24

(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Mon, 25 Jul 2016 07:52:24 -0700 (PDT)
Received-SPF: neutral (google.com: 74.91.89.9 is neither permitted nor denied by best guess record for domain of [email protected]) client-ip=74.91.89.9;
Authentication-Results: mx.google.com;
dkim=pass [email protected];
spf=neutral (google.com: 74.91.89.9 is neither permitted nor denied by best guess record for domain of [email protected]) [email protected]
Return-Path: <[email protected]>
X-MSFBL: eyJyIjoiYWJpZGphbmxhd0BnbWFpbC5jb20iLCJnIjoibWFpbF9zaGFyZWRfcG9v
bCIsImIiOiI3NF85MV84OV85In0=
Received: from [192.168.80.22] ([192.168.80.22:54762] helo=rs-ord-mta02-2.smtp.com)
by rs-ord-mta03-3.smtp.com (envelope-from <[email protected]>)
(ecelerity 4.1.0.46749 r(Core:4.1.0.4)) with ESMTP
id C8/2F-15681-8A726975; Mon, 25 Jul 2016 14:52:24 +0000
DKIM-Signature: v=1; a=rsa-sha256; d=smtp.com; s=smtpcomcustomers; c=relaxed/simple;
q=dns/txt; [email protected]; t=1469458344;
h=From:Subject:To:Date:MIME-Version:Content-Type;
bh=8IsBwB+nQgMjaz1Rp0fMSsqxSiwfq9xbKj1B2hIvOmg=;
b=p+ASMcW73ENIynv4y+6JqY8Nl7VlyNLyBOU2iAPw139/ivF/9GiUypasRjVMTwty
MX2yyFOeTxm/zBymD0kvNbrV12i7deJGdqiR9i4zXnc1gkYG0j7u/PwcAdSxsrLf
knJ3SDspwPfDXmI0o1htW+0C3Mwely6+icSpRBpTsfk=;
Received: from [92.59.205.185] ([92.59.205.185:50009] helo=[10.10.4.19])
by rs-ord-mta02-2.smtp.com (envelope-from <[email protected]>)
(ecelerity 4.1.0.46749 r(Core:4.1.0.4)) with ESMTPA
id 40/9D-08096-D9726975; Mon, 25 Jul 2016 14:52:24 +0000
Date: Mon, 25 Jul 2016 10:30:40 -0400
From: David Scott <[email protected]>
X-Priority: 3 (Normal)
Message-ID: <[email protected]>

Subject: Training. Case #1.
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----------0491E62080ADA8429"
X-Report-Abuse: SMTP.com is an email service provider. Our abuse team cares about your feedback. Please contact [email protected] for further investigation.
X-SMTPCOM-Tracking-Number: 1f039684-d551-4546-b3f2-07072d75a8e8
X-SMTPCOM-Sender-ID: 5015191
Feedback-ID: 5015191:SMTPCOM

------------0491E62080ADA8429
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Dear xxxxxxxxxx,

How are you today?
My name is David Scott and I was appointed your Personal Training
Manager during the Assessment Program. We are very interested in your
candidacy and would like to start the Pre-Employment Assessment
Program with you.
As far as I know, you have already received the Description of our
Assessment Program and understand the process of recruitment. Today
is the first day of Assessment Program and I will be helping you with
cases and training materials during the Program.
The Assessment Program ends on August 31 and it will be your salary pay
day. Once you complete assessment, I will send a confirmation letter
to HR Department and they will be sending you additional documents
via regular mail, including Tax Form, invitation, and certificate.
Below are the main terms of the assessment program:
- there will be 5 cases to complete, 2 tests, 1 final test;
- each case may require different time but average amount of working
hours will not exceed 10 - 11 hours a week;
- after 4 weeks of Assessment Program you will be provided with final
test to complete;
- each case has it's own description, task/assignment and deadline.
Do not miss deadlines, otherwise you will get penalized.
- getting more than 1 penalty will eliminate you from Assessment
Program and you will not be paid for it. Therefore, if you need an
extension, let me know at least 2 hours in advance.
I'm sending you the first business case about Supply Chain Management,
the experience of Deloitte company. Please, read the case carefully
and here is the task for you: you have to make a list of the
definitions which are new for you. Deadline is XXXXXXXXXX . If
you complete the task earlier, let me know and send me the document in
.PDF or Word format. If you have any questions or need assistance,
please let me know. Thank you and please, confirm the receipt of
Case #1!




--
Best regards,
Mr. David Scott , HR Manager
ITP Consulting Group, US Branch
Phone: +1 (646) 893-8853

The information contained in this electronic message and any attachments to this message are intended for the exclusive
use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended
recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all
copies of this message and any attachments.
------------0491E62080ADA8429
Content-Type: APPLICATION/OCTET-STREAM;
name="Case #1.pdf"
Content-transfer-encoding: base64
Content-Disposition: attachment;
filename="Case #1.pdf"

Could you post the full headers with your personal information removed? We need those in order to kill the site.

The scammer is using a different outgoing mail server. Could you post a message you sent, with complete headers, and the reply, with complete headers?