Hot part-time job-opening for you IT PITSTOP LIMITED

Firstly, as a quick introduction, I'm the company director of IT Pitstop Limited, which is a small IT support company working with schools in the south east of England. The scammers have used my company name and registered company address on their website, completely fraudulently and certainly without permission.

I'd like to say a massive thank you to the people that managed to pull down their website with the job opportunity on it, and I hope that no-one has lost any money in this scam. I did contact the police last week to report the website after someone forwarded one of the emails to me (however I've not heard anything back since), and a few more people have been in contact with me via my website (www.itpitstop.com) over the weekend inquiring about the job, all of whom I've responded to warning them to cease any communication.

I've asked my web hosters to add a message to the top of my website to warn people that there is a scam going around with my company name against it, so hopefully if the site does reappear somewhere, further people won't get caught up.

I'll admit to my ignorance in not knowing how to get a website pulled down, and I've just come across this site today, so my thanks again, and please keep up the good work of warning people about these scams, and also getting the sites pulled down.

Regards,

Paul Hartnett
Director
IT Pitstop Limited (Not offering any job positions!)

Welcome to Scamwarners!

The fake site was put into Client Hold state yesterday. This means, hopefully, that it won't pop up again by that name. (Client Hold is also used when a domain has been registered but not assigned an address, to keep others from using the name. Techam Limited, the fake site's previous name, had the Client Hold removed after being reported for fraud, which is pretty unusual.) Probably the scammers are hard at work finding yet another name for the site.

Hi guys. I just received email from this known scammer:


Delivered-To: *******@gmail.com
Received: by 10.229.157.212 with SMTP id c20csp248988qcx;
Wed, 30 May 2012 04:05:39 -0700 (PDT)
Received: by 10.50.203.41 with SMTP id kn9mr6365058igc.72.1338375938803;
Wed, 30 May 2012 04:05:38 -0700 (PDT)
Return-Path: <[email protected]>
Received: from rs1.justhost.com (rs1.justhost.com. [69.175.61.130])
by mx.google.com with ESMTPS id wo6si14647050igc.57.2012.05.30.04.05.38
(version=TLSv1/SSLv3 cipher=OTHER);
Wed, 30 May 2012 04:05:38 -0700 (PDT)
Received-SPF: pass (google.com: best guess record for domain of [email protected] designates 69.175.61.130 as permitted sender) client-ip=69.175.61.130;
Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of [email protected] designates 69.175.61.130 as permitted sender) [email protected]
Received: from freetest by rs1.justhost.com with local (Exim 4.69)
(envelope-from <[email protected]>)
id 1SZgig-0004lF-6C
for [email protected]; Wed, 30 May 2012 06:05:38 -0500
To: <removed> <********@gmail.com>
Subject: New chances to achieve your goals - Jerzy Wach - May 30, 2012 2:07:32 PM
MIME-Version: 1.0
Message-ID: <[email protected]>
From: Mr Mark Shepherd <[email protected]>
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
Date: Wed, 30 May 2012 06:05:38 -0500
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - rs1.justhost.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [990 32003] / [47 12]
X-AntiAbuse: Sender Address Domain - rs1.justhost.com
X-Source: /usr/bin/php
X-Source-Args: /usr/bin/php /home/freetest/public_html/fwconfig.php
X-Source-Dir: test.freen1.com:/public_html

Hello <removed>,

All the changes that have come about in the past 10 years, from environmental policy to emerging technologies to the recession, have contributed to the creation of careers that never could have existed before.

My name is Mr Mark Shepherd and I'm with staffing of one of the biggest outsourcing company in UK. I have found your CV on jobsite.co.uk with the belief that you could potentially be a good fit for our job.

A small and reputable, highly professional outsourcing enterprise established in the UK. Our main direction is creating outsourcing for numerous companies nationwide, helping to facilitate those services delivery internationally.

Financial Forwarding Coordinator is a part-time position. If you are just re-entering the workforce or are a recent college grad, this can be your opportunity to start a solid career with a leading outsourcing company. We provide one month paid training period. During your training you receive online training and support. A personal supervisor guides your training. At the end of your trial period the personal supervisor makes the final decision to extend a permanent offer or not. Your training is critical to your success!

Completing tasks in timely manner is of the most importance to us and our clients. Salary depends on your efficiency! The basic salary for this position starts at 1,500 GBP per month plus an 8% commission for every task that you complete.

We believe that money saved due to outsourcing can be effectively and successfully utilized to focus more on strategic and core businesses functions.

If this position is a fit for you, please feel free to reply to this email at [email protected]. Thank you for your time, and I hope you'll contact me to discuss this opportunity.

Our HR staff will contact you within 48 hours. We would like to thank you beforehand and we’re looking forward to a fruitful cooperation.

Best regards,
HR Assistant
Mr Mark Shepherd


I hope you can use it to block his account or something. Thanks

Welcome PaulHartnett,

I'm glad to hear that you are taking what action you can to alert people of the scammers using your company name.

While there's not much to be done about free email addresses (they can be opened in less than a minute, and they don't cost the scammer anything), domain names and websites are a different story. If you encounter any additional bogus websites or domains being used to scam people, please feel free to stop back here and let us know, and we will be more than happy to help to take care of them.

^^Looks like the scammers haven't caught wind of their domain's death yet The nameservers are still responding with the domain's IP address (which is different than when it first appeared), and apparently the root nameserver's entry for the domain is still in the scammers' cache. When it expires, the scammers will panic. Meanwhile, they send out ads all they want, but any potential victims see that the domain doesn't exist.

Help i have been a victim in this i thought i was being offered a job and i have sent money what should i do??
please help

help i have been a victim in this and i have sent money to a different country what can i do? please help me i thought i was doing a job

Welcome to Scamwarners, dappy148!

I'm really sorry that you've lost money to this scammer. Would you please post the emails that you were sent, including the headers? Especially the one that gave you instructions on where to send money.

Well, they certainly seem to like my company name , and they've set up the site again, this time under:

http://www.it-pitstop-ltd.net/

Dotti or vonpaso xlura or anyone else, could you tell me how to get their new domain on Client Hold before more people fall foul?

I've been receiving about 5-10 emails a day asking if this job, and those people have contacted me through my actual website, which has the warning message at the top of the page. I've been replying to people warning off, but as we've seen from this forum, that some haven't been so lucky.

I'd really like to meet the people behind this one, as I'm sure would some others. As this is a new domain, I'm going to call the police about it again, but they're lack of communication and the fact these people could be anywhere, sadly doesn't fill me with confidence.

Thank you again for your help, and keep up the good work.

Regards,

Paul Hartnett
Director
IT Pitstop Limited

Unfortunately, it's not uncommon for scammers to continue with the same company name like these scammers did.

While reporting to the police is advisable, they don't actually take any action against fake sites (in fact, most don't know how) and since the scammers are almost always in another country, they have no jurisdiction over the scammers. Often the report is literally the only outcome.

I have already flagged this for our site killers, but if you are interested in learning more about taking these sites down, you can go to our scambaiting site, 419eater.com

There you can find our forum dedicated to the killing of fake websites, and if you are interested in learning how to do it yourself, some of our members will get you started. One note, though--the fake sites forum is actually a members-only forum, so it's invisible until you sign up and login (it's free, we just need to keep scammers out of certain areas).

Hi Dotti,

Thanks for the quick reply, and thanks in advance to the site killers.

I did contact the police, the department that did look into couldn't get to the original website, as it had been killed by then, so I've logged the latest, which will hopefully also be killed by the time they get back into work on Wednesday after the long bank holiday. The one hope is that the site is still listing a Oxford based telephone number, so someone hopefully in the UK is paying for it and is part of the whole scam.

I completely agree about the juristiction issue, and I know unless your surname is Madoff then it's unlikely that international borders are likely to be crossed by the authorities, which is a shame, as these people can keep on operating with almost immunity.

Thanks again and keep up the good work. As an upgrade to this site, can I suggest a donation link. I'd like to buy you guys a drink for your help, and I'm not exactly going to ask for your bank account details so I can wire the money!!

Regards and have a good weekend,

Paul

One of the other site killers told me about the new domain, which is the eighth we've heard of by the same gang.

If you join Eater, you can not only see how we kill sites, but also donate there, which also supports Scamwarners.

This flea is hard to kill! It jumped from France to Germany to Latvia.

The scam continues via email, even when the scammers don't have a website...

> Date: Tue, 5 Jun 2012 10:39:26 +0200
> To:xxx
> Subject: xxx
> From: [email protected]
>
> Good day xxx,
>
> We are wanted to propose you work at IT PITSTOP LIMITED. We feel that your education and background will be beneficial asset to our team.
>
> Job requires:
>
> -Citizenship of United Kingdom;
> -Be a competent PC user with 24/5 Internet access;
> -Availability by phone during the day, starting at 9 a.m. your local time.
> -Current Bank Account
>
> We would be happy to start working with you as soon as possible. Please reply to Mark Shepherd as soon as you receive this offer, for documentation and orientation.
>
> If you choose to accept this offer, please fill out and send us the form below with your Contact information to verify your identity and interest in this position.
>
> ---------------------F O R M _________F O R M------------------
> Full Name:
> Address:
> Phone:
> Preferred call time:
> ---------------------F O R M _________F O R M------------------
>
> Hope that you will contact us soon.
>
> Best regards,
> Mark Shepherd
> HR department

>

And somehow people are still ignoring the website being and the warning on my web site, and sending me their cv's via my website.

Sadly I can see why these crooks are so persistent, people are desperate, sometimes naive, and fall for it.

By the way, I read through one of the past communications on the 419 site with the priest turned clown....haven't laugh that much in ages!!

Once again, thanks for your continued help.

Regards,

Paul Hartnett
Director
ITPitstop