Exxonmobil employment scam

Hello Andrés,
This is a fake offer of employment. The position does not exist and the best thing to do now is to ignore the emails.

Hello,

Could you please help me to identify is it scam or not?
Recently I got email with text below:
Attn:

This is to inform you that your application which was submitted has been evaluated kindly go through the attachments for details of the invitation.

Regards,
Engr. Stephan Minnaar
(Human Resource Relation Officer)
EXXON MOBIL UK

but email is very strange: [email protected]

For me it is seems like a scam mailbox.
Please advise.

Regards,

[AlanJones]

It's a definite scam. The email address is not a real Exxon Mobil one.

Gent's
i received this mail from this mail address :EXXONMOBIL MALAYSIA <[email protected]>

.
EXXONMOBIL MALAYSIA
Menara ExxonMobil, Kuala Lumpur City Center
50088 Kuala Lumpur P.O. Box 10857, 50728
Kuala Lumpur, Malaysia
Tel:(+60)162-992-209
Attention:Mohamed Rashad Mahmoud
We have tried to call but all effort went avail.If you receive this email kindly sign the contract and send it back to us if you are interested in the role.After screening and verification process of details contained in your resume and evaluation of our Employment Data Sheet.You have been selected as one of the candidate that will work with us here at ExxonMobil Malaysia.Our Attached Contract offer shall help you know what to expect after reading the terms and conditions of the contract offer.If the terms of contract are acceptable by you, indicate your acceptance by filling in your details on the CONTRACT ACCEPTANCE FORM signed send a copy back to us via email,You are requested to also send a signed copy of your contract letter to the Immigration Consultant along side with other Necessary Requirements Which Include A scanned copy of your International Passport recent photograph.
The below email and phone number belongs to the immigration consultant who will be in charge of your Malaysia visa and Residence Work Permit, once you agree to the terms and condition of this offer by signing your signature on the space provided,you are to immediately contact the below email address and let the immigration consultant know that you have accepted the job so he can start your Residence Work Permit Papers and Visa Application.
Chan Immigration Services Malaysia
Address Jalan Sultan,Persekutuan, 59100 Kuala Lumpur, Malaysia
Mr Chan Abdukareem
Email: [email protected]
Tel:(00)60-167-822-945
Please contact the Immigration Consultant once you signed the contract because you shall be required to furnish us with your valid Malaysia residence and work permits papers before the 25th of Feb 2019 as a proof of readiness to join ExxonMobil Malaysia Family and also to enable you receive your first monthly salary including your due entitlements/emoluments prior to your departure for services with the ExxonMobil Malaysia.All Malaysian based employees' are to report personally to our office with identification materials for signing and collection of hard copy of their contract documents.
This is in line with the expatriate statuary law of Malaysia in compliance with the U.N.Terrorism Act. Find attached a company of the contract.Congratulations on your appointment for Joining ExxonMobil Malaysia we wish you every success in your new duties and We hope that your professional association with us will be a rewarding and fulfilling experience.Note because of the time difference and in case you didn't get me on the phone please send all your queries via email i will deal with it once i get back to the office.Sign the contract and send it back to me also dont forget to contact our company immigration consultant to start your travel documents.
Best Regards
Ms Kim Anderson
(+60)162-992-209

[AlanJones]

Thanks for posting, exxonmobilasia.com is another fake domain that was registered by someone using fake details at the start of this month.

There is no job, the scammer just wants to charge you fees for non-existent documentation.

Hello, this what I got:

FROM: EXXONMOBIL ([email protected]) <[email protected]>

.......
Thanks for your interest in the Exxon Mobil UK Family, please note that your resume has been evaluated and you have been shortlisted for Job interview. Please go through the attachments for important details of the invitation.

We look forward to seeing you soon.

Regards,
Engr. Stephan Minnaar
(Human Resource Relation Officer)
EXXON MOBIL UK

3 PDF files attached

ctc-t.co.uk is an email-only domain being used in this scam and is not a legitimate Exxon-Mobil email address. Is it possible for you to post the header of the email you received?

How to extract email headers: http://www.iptrackeronline.com/how-to-e ... eaders.php

Make sure to remove your email address from the header before posting.

Domain name:
ctc-t.co.uk

Data validation:
Nominet was not able to match the registrant's name and/or address against a 3rd party source on 20-Nov-2015

Registrar:
PDR Ltd. d/b/a PublicDomainRegistry.com [Tag = PDR-IN]
URL: http://www.publicdomainregistry.com

Relevant dates:
Registered on: 20-Nov-2015
Expiry date: 20-Nov-2019
Last updated: 08-Dec-2018

Registration status:
Registered until expiry date.

Name servers:
admi180192.earth.orderbox-dns.com
admi180192.mars.orderbox-dns.com
admi180192.mercury.orderbox-dns.com
admi180192.venus.orderbox-dns.com

Hello,

I have just received an e-mail from "[email protected]" for an job interview.
You can see the details in the e-mail below.

There are also 2 pdf files in the attachment;
One of them is "Letter of Interview" and the other one is "Interview Details".

Is it a fake mail, what do you think?
Thanks for your replies.

------------------------------------------
We are pleased to inform you that your job application has been accepted by the ExxonMobil corporation.
ExxonMobil has made an excellent choice based on the expertise, experience and talent found on your resume. We congratulate you on your employment and new role. Therefore, we invite you to have an interview with us in our London Office.
Please find attached herewith, relevant document containing the prototype of your contract package for detailed understanding.
Should you require more information, please contact us immediately through email below.

Warm Regards,
Nathaniel Edward | Head of Recruitment

Email: [email protected]
Address: ExxonMobil House, Ermyn Way, Leatherhead,
Surrey, KT22 8UX.London, United Kingdom.
Tel: +44 (0) 753-718-4370
+44 (0) 753-718-0215
------------------------------------------------------------

[AlanJones]

It's a scam, uk-exxonmobil.com is a fake domain registered by someone claiming to be in the USA a few weeks ago.

Creation Date: 2018-03-21T06:39:27Z
Registrar Registration Expiration Date: 2020-03-21T06:39:27Z

Registrant Name: aktamus williams
Registrant Organization:
Registrant Street: 255 Old Usquepaugh Rd
Registrant City: West Kingston
Registrant State/Province: RI
Registrant Postal Code: 02892
Registrant Country: US
Registrant Phone: +1.6175430022
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: [email protected]

Thanks a lot for your prompt reply.
I also sent an e-mail to real Exxonmobil for checking.

So, should I do anything now?
Or just ignore related e-mial?

[AlanJones]

Just delete the email and don't respond to them.

Hi Guys! I've just received an email from [email protected]:
Offer Letter ( Job Ref:EMCL/ID2187/19) 1 файл (Посмотреть)

От:ExxonMobil Cepu Limited <[email protected]>Подробнее&14 Мая 2019, 09:20&

HUMAN RESOURCES DEPARTMENT
KABUPATEN BOJONEGORO,JAWA
TIMUR 62152, INDONESIA
TELEPHONE:+(62)856 9572 3074
FAX NUMBER: +(62)858 9098 0900
EMAIL: [email protected]



Job Ref:EMCL/ID2187/19


Attn: Rinat ________,

Consequent to your request herewith is an attachment of the advance offer letter and you have been offered employment with us here at ExxonMobil Cepu Limited.

Your employment offer comes standard with provisions for accommodation, feeding, flight ticket, medical care, professional training, transportation, security, holiday/travel packages, etc.

Refer to the attached letter for further details and instructions. Upon review and acceptance of the terms of employment, you are required to sign and return a signed copy to us via email, also contact and forward a copy to the Official Immigration Attorney to commence the application for your Work Permit with the contact details below;

ARASINDO & PARTNERS LAW FIRM
South Jakarta, Indonesia
Barrister/Solicitor: Arnold Espinoza
P: +6285772238797
P/E: [email protected] 

You are expected to conclude all immigration matters with the official Immigration Attorney within two weeks. As soon as we receive confirmation of the approval of your Workers Permit, we will make available your Flight Ticket.

NOTE: Your consistency is needed to ensure speedy processing of your Work Permit. Please do not hesitate to call or send us an email if you have any question regarding this employment offer.

Best Regards,
Jon G. Marshal
Hiring Manager, ExxonMobil Cepu Ltd

 

@ExxonMobil_ID

EXXONMOBIL CEPU LIMITED
Email: [email protected]

This e-mail is confidential and may also contain privileged information. If you are not the intended recipient you are not authorised to read, print, save, process or disclose this message. If you have received this message by mistake, please inform the sender immediately and delete this e-mail, its attachments and any copies.
Any use, distribution, reproduction or disclosure by any person other than the intended recipient is strictly prohibited and the person responsible may incur penalties.
Thank you!

Fake email account???

It's a scam . It's an email domain registered in Lagos Nigeria.

The same for me, I noticed the scam so I'm coming here, you'll probably be better than me at reporting it, especially unlike all what I've read till now, I got bank details and name of the guy I was supposed to pay to obtain life insurance certificate...

# 1st I've been contacted by a fake agency:

CONERSTONE CONSULTANT
Address: 30th Floor WISMA GKBI, Jl. Jenderal Sudirman 28
Jakarta 10210 Indonesia
Email: [email protected]

All responses must be sent to this email:
[email protected]

Attn: Sir/Madam,

Subject: ExxonMobil Cepu Recruitment

The Human Resources department of ExxonMobil Cepu Corporation has found your experience and qualifications suitable for our requirements.

Send your most recent resume and certificates for screening and verification.

Please indicate your present salary and your preferred salary.
Total Years of Experience:-
Years of experience in Oil & Gas companies:-
Current Salary per Month USD:-
Preferred salary USD:-
Nationality / Dual Nationality:-

Yours Sincerely,
Jack Smith
Recruitment Coordinator

==> with below detailed header:
Return-Path: [email protected]
Received: from lpn-prd-vrin015.laposte (LHLO lpn-prd-vrin015) (10.128.63.16)
by lpn-prd-mstr222 with LMTP; Mon, 6 Jan 2020 20:30:55 +0100 (CET)
Received: from lpn-prd-vrin015 (localhost [127.0.0.1])
by lpn-prd-vrin015 (Postfix) with ESMTP id 81C5266001F
for <my address hidden>; Mon, 6 Jan 2020 20:30:55 +0100 (CET)
Received: from mout.gmx.com (mout.gmx.com [74.208.4.201])
(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
(No client certificate requested)
by lpn-prd-vrin015 (Postfix) with ESMTPS id 06B94660142
for <my address hidden>; Mon, 6 Jan 2020 20:30:54 +0100 (CET)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mail.com;
s=dbd5af2cbaf7; t=1578338991;
bh=asjnLQLLTQzAYKCn1qPpgzVYqA4+ehFL6V0oUp4Fxj0=;
h=X-UI-Sender-Class:From:Subject:Date;
b=Ai0a6GN2IVrBudaGZQcaCuu8Na6QdLrXftAawUcLgz1zCxNvPRm3QSLgaxpBBMcMl
gNt4rQYsPWZu3x21g1dE0RPoxnCaPYBln++Fh7xw4hvipFCvDhB50T1bsiQQzcfehk
5fyDxUaRy+8v6Eb8X6U0F5UWEKE+xW1a802oS0a4=
X-UI-Sender-Class: 214d933f-fd2f-45c7-a636-f5d79ae31a79
Received: from [41.190.30.216] ([41.190.30.216]) by web-mail.mail.com
(3c-app-mailcom-lxa01.server.lan [10.76.45.2]) (via HTTP); Mon, 6 Jan 2020
20:29:51 +0100
MIME-Version: 1.0
Message-ID: <trinity-775f0796-68fe-4937-8984-721cc584f264-1578338991660@3c-app-mailcom-lxa01>
From: "Cornerstone Consultant" <[email protected]>
Subject: ExxonMobil Cepu Recruitment
Content-Type: text/html; charset=UTF-8
Date: Mon, 6 Jan 2020 20:29:51 +0100
Importance: normal
Sensitivity: Normal
X-Priority: 3


# 2nd I've had several exchange with a pseudo HR manager from Exxon with the below details:

Return-Path: [email protected]
Received: from 10.128.63.16 (LHLO lpn-prd-vrin015) (10.128.63.16) by
lpn-prd-mstr222 with LMTP; Wed, 8 Jan 2020 10:28:32 +0100 (CET)
Received: from lpn-prd-vrin015 (localhost [127.0.0.1])
by lpn-prd-vrin015 (Postfix) with ESMTP id 4157466E18E
for <[email protected]>; Wed, 8 Jan 2020 10:27:10 +0100 (CET)
Received: from relay10.mail.gandi.net (relay10.mail.gandi.net [217.70.178.230])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by lpn-prd-vrin015 (Postfix) with ESMTPS id A518C66F6AB
for <my address hidden>; Wed, 8 Jan 2020 10:15:20 +0100 (CET)
Received: from webmail.eu.com (webmail25.sd4.0x35.net [10.200.201.25])
(Authenticated sender: [email protected])
by relay10.mail.gandi.net (Postfix) with ESMTPA id 9A3612400B3
for <my address hidden>; Wed, 8 Jan 2020 09:14:51 +0000 (UTC)
MIME-Version: 1.0


# 3rd I was in contact with a pseudo Attorney using the name of a real attorney office in Jakarta with the below details:

Return-Path: [email protected]
Received: from lpn-prd-vrin018.laposte (LHLO lpn-prd-vrin018) (10.128.63.19)
by lpn-prd-mstr222 with LMTP; Fri, 17 Jan 2020 08:57:19 +0100 (CET)
Received: from lpn-prd-vrin018 (localhost [127.0.0.1])
by lpn-prd-vrin018 (Postfix) with ESMTP id E41191466F3E
for <my address hidden>; Fri, 17 Jan 2020 08:57:18 +0100 (CET)
Received: from EUR04-DB3-obe.outbound.protection.outlook.com (mail-oln040092074045.outbound.protection.outlook.com [40.92.74.45])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by lpn-prd-vrin018 (Postfix) with ESMTPS id 4D94D145F236
for <my address hidden>; Fri, 17 Jan 2020 08:57:16 +0100 (CET)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;


# 4th and last I was in contact with a pseudo insurance company who finally ask me to send some money to pre-pay an expatriate work insurance... with the following details (on this one I put the full email detailed because you will see the bank details of Erwin Hermawan who is the scamer who supposed to get the money...):

Return-Path: [email protected]
Received: from 10.128.63.13 (LHLO lpn-prd-vrin012) (10.128.63.13) by
lpn-prd-mstr222 with LMTP; Mon, 20 Jan 2020 09:30:48 +0100 (CET)
Received: from lpn-prd-vrin012 (localhost [127.0.0.1])
by lpn-prd-vrin012 (Postfix) with ESMTP id F1D6E120813
for <my address hidden>; Mon, 20 Jan 2020 09:30:47 +0100 (CET)
Received: from mail-lj1-f177.google.com (mail-lj1-f177.google.com [209.85.208.177])
(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
(No client certificate requested)
by lpn-prd-vrin012 (Postfix) with ESMTPS id B54AA120873
for <my address hidden>; Mon, 20 Jan 2020 09:30:47 +0100 (CET)
Received: by mail-lj1-f177.google.com with SMTP id w1so32909999ljh.5
for <my address hidden>; Mon, 20 Jan 2020 00:30:47 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20161025;
h=mime-version:references:in-reply-to:from:date:message-id:subject:to;
bh=xMYzt0r8uHs/efOjFk3JTvTY1D7tYPLqbm97Iw0LaX8=;
b=mtjZo8vJwRl2uJhgqgJgs5GzfjYCR3UCGHRX/PmZLVA6N5kbVOusWpcBPDERNkJnMZ
Sng6gA0x/yke5NVTgjuo4bh3Ij7p9mRVXOR12QTmcfVT3Os1nv79xp8Y4CTeQyN8gfjb
FSBY2hjvB2ZK3X4iRRASgZW8R0CEzfuS0qP/siE8qWQkrq76ZeTRqG1xPxjyQVFUTRbf
o+lAGBlzXzmmfLgq9vuHlYteb7HJ0dJJ4YBhyiFAuo0xezOYlbnmcwqfvrxorTByL8AX
KlMz0DXSkOkHDIv2GqaOwkrYjnbR4P+y09EOTH4jGStMOvnIBqx/C/XOREZQ0Zi2c9kP
lJbA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20161025;
h=x-gm-message-state:mime-version:references:in-reply-to:from:date
:message-id:subject:to;
bh=xMYzt0r8uHs/efOjFk3JTvTY1D7tYPLqbm97Iw0LaX8=;
b=XFHnODCeGjc0fj8UJqI/XhWYJjwO+aS9J3XhjEK/P577Ixjo5eeIpYFGRz+oX5uiEL
hKZ7ErTcdSiP/TDPp6K1LvtJ9J6kOsZQIAnhJZd49BB4M3w3+Zbrcxh2JSHTSfnXno41
thxP5KkKOPGRopl8PbEet8z8yj2m47ZzGI12pEzLSrbQWi6zbq+26xzJHDW/btPuC6m+
lOk8jWZA9oAKx91kpYYSQnDsi5xMOD2B79S+/GZk0UiZmuUFMgN0DPFKZhTnqWyVTwIb
Mp0Wi20vOOe/hzsvaxqPKhUTDct/HVDTF3jK9S5p3f+JKEPRjWWHt1ETqxQ3acmmo1D6
MW8g==
X-Gm-Message-State: APjAAAXw8uAu6nBt8NxlW3o/s7NSmyqRAp7twFgOk7q8mKyvDIxbM5i6
TElAXxKEB/R5j6LMXkT2LOHbTVEcfHD6uclATwjey6vU
X-Google-Smtp-Source: APXvYqxxFQq7Hjlrre6aWQ/a9s06JFX5xm9xHPjUw9pAp3troZY5N8zpq5oh4aTQ2QhiKMhBIEOmg1ahLBmHYxew+zY=
X-Received: by 2002:a05:651c:111a:: with SMTP id d26mr12957479ljo.153.1579509046876;
Mon, 20 Jan 2020 00:30:46 -0800 (PST)
MIME-Version: 1.0
References: <[email protected]>
<[email protected]>
<CAHzi5WYUUm--aMXPA5hGhMD4TLS58VDez-4JoaH0dcORxYxMZQ@mail.gmail.com> <[email protected]>
In-Reply-To: <[email protected]>
From: PTMNC Assurance <[email protected]>
Date: Mon, 20 Jan 2020 09:30:36 +0100
Message-ID: <CAHzi5WYGj=feiYvG1ZrNU8bo3nVc0SW+yZDV=ZhTHszx9er6CQ@mail.gmail.com>
Subject: Re: I-ewtip application - my name hidden
To: my address hidden
Content-Type: multipart/alternative; boundary="000000000000a89e12059c8e1baa"
Lpn-Authentication-Results: helo=mail-lj1-f177.google.com; spf=pass [email protected]; dkim=pass; dmarc=pass D=gmail.com alignspf=pass aligndkim=pass
X-VR-FullState: 0
X-VR-Score: 0
X-VR-Cause-1: gggruggvucftvghtrhhoucdtuddrgedugedrudeggdduudelucetufdoteggodetrfdotffvucfrrhho
X-VR-Cause-2: fhhilhgvmecunfetrffquffvgfdpggftfghnshhusghstghrihgsvgenuceurghilhhouhhtmecuhedt
X-VR-Cause-3: tdenucenucfjughrpeggfhgjhfffkffuvfgtsegrtderredttdejnecuhfhrohhmpefrvffopfevucet
X-VR-Cause-4: shhsuhhrrghntggvuceophhtmhhntggrshhsuhhrrghntggvsehgmhgrihhlrdgtohhmqeenucfkphep
X-VR-Cause-5: vddtledrkeehrddvtdekrddujeejnecurfgrrhgrmhepmhhouggvpehsmhhtphdpihhnvghtpedvtdel
X-VR-Cause-6: rdekhedrvddtkedrudejjedphhgvlhhopehmrghilhdqlhhjuddqfhdujeejrdhgohhoghhlvgdrtgho
X-VR-Cause-7: mhdpmhgrihhlfhhrohhmpehpthhmnhgtrghsshhurhgrnhgtvgesghhmrghilhdrtghomhdprhgtphht
X-VR-Cause-8: thhopehnihgtohhlrghsrdhmrghnihhnfeeksehlrghpohhsthgvrdhnvghtnecuvehluhhsthgvrhfu
X-VR-Cause-9: ihiivgeptd
X-VR-AvState: No
X-VR-State: 0

--000000000000a89e12059c8e1baa
Content-Type: text/plain; charset="UTF-8"

PT MNC LIFE ASSURANCE(Global Work/Travel Protection)
Jalan M.H. Thamrin No.10
Jakarta 10230, Indonesia
Tele: +6285771475441
Email: [email protected]


Attention: My name,

I received your email. The Insurance Certificate covers for a whole year.
I do not require anything from you other than the deposit of the Insurance
fee after which I will email your Certificate immediately on confirmation
of deposit.

Below is the bank information for the deposit;

Name: Erwin Hermawan
Account Number: 411-602-1736
Bank: Permata Bank
Swift Code: BBBAIDJA
Bank Address: Jl. Astana anyar no.22 ,Cibadak ,Astana anyar ,Bandung ,Jawa
barat 40241
Beneficiary Address : Jl. industri Barat Rt. 004/004, Husen Sastra
Negara,Cicendo,Bandung ,
Jawa Barat 40171

Do not forget to send a copy of the deposit slip once you have made the
deposit.

Best Regards,
Mrs Natalia Angeline Wenur
Issuing Officer, PT MNC Life Assurance

Could you share the mobile numbers used by the 'hr manager' and the 'lawyer'? I think we have the same scammers here.

[AlanJones]

Why don't you share the information you have, rather than inconveniencing other forum members.