Foliage Consulting - New job opening

Someone at my family received an offer from Foliage Consulting. Since he (a while ago) did fill up form on http://www.foliage.com/ (which probably is not related) he thought it was related, but it got more suspicions after and he asked me to take a look:

New job opening
[email protected] <[email protected]> March 2015

Dear job-hunter,
My name is Delores Price, I work at Foliage Consulting Ltd. as a Personnel manager. I found your contact info on Jobdiagnosis. Viewing your information and experience I thought that we could offer you a vacancy with our company. The vacancy in question is that of an Operations Manager OM. You will collaborate with a team of OMs who are responsible of formidable operations in our company.
In our employees we search for Honesty, Liability, Open-mindness. We don’t require any previous experience in this very field as we offer an obligatory preparatory training and a short-tem probation period paid.
At this point I would like to know whether you’re still looking for an employment and if you have spare time to dedicate to our training/probation period. If you do, please respond to me ASAP.


Truly yours,
HR Manager
Delores Price

He replayed but another email from them ended up in spam until they sent reminder couple weeks later and he found the mail in spam folder:

Re: New vacancy
Manager Peter Fuller <[email protected]> March 2015

Dear applicant,

First of all we would like to thank you for your attention towards our
company. I believe that you would become a great contribution to our
company.
We would like to kindly ask you to fill out the Application Form in
order for our HR department to proceed. Please also read the Job
Description to get more information about the position and employment.
Do not hesitate to visit our site as well.
We are looking forward to receiving your answer and we are sure that
you are going to enjoy your involvement with our company. Thank you.

Best regards,
Manager Peter Fuller

FOLIAGE CONSULTING
phone: +1 307 278 9541
web: http://www.foliageconsulting.com

2 attachments
Application Form.doc
97K
Job Description.doc
55K

Application seemed regular but job description is more suspicious:

Interview: Not required, but we can interview you by phone if we decided so.

Job Type: Home Based, Full-Time or Part-Time. You can easily combine it with any other job you have.
Training: We provide a Probationary Period with support. So you can get all necessary experience.
Account for work: We don't provide a bank account. For this work you need to use your personal or open a new special one.

IMPORTANT:
Your account will only be used during the probation period, after passing it you will be provided with a company account. Your account will be only for system and salary purposes. It is inconvenient to open a new business account for every person that has not yet passed the probation period. During this period all of the responsibilities from your account will be passed over to the company.

GENERAL PURPOSE
Perform clerical tasks related to the efficient maintenance and processing of transactions from customers. To become an Operations Manager you must have good organizational skills and be able to work under deadline pressure. All of the job that is ahead of you is according Canadian Employment Standards code RSA 2000.

SCHEME OF WORK
1. Accompany sales: Prepare, verify, and process payments;
2. Verify that transactions comply with financial policies and procedures;
3. Transfer money to headquarters/branch;
4. Keeping accurate records of operations.

there was actually two pages in job description if needed i can post whole thing...
But anyway he sent the application before I looked at it, so next email:

Re: New vacancy
Manager Peter Fuller <[email protected]> March 2015

Dear *NAME*,

With reference to your CV and Application Form we are pleased to
announce that you have qualified and you have been appointed as
Operations Manager.

You can find file attached:
- Labour Agreement: fill-in, print, sign, scan and send it back

If you are happy with the proposed terms and wish to accept this offer
of employment, please fill out the Labour Agreement and send to us.

If you disagree with, or do not understand or wish to clarify anything
in this offer, please contact me to discuss any issue you wish to
raise. Thank you.

Truly,
Manager Peter Fuller

FOLIAGE CONSULTING
phone: +1 315 508 4078
web: www.foliageconsulting.com

Labour Agreement (Full-Time).doc
102K

NOTE: I have change exact date to only month and year for emails not to be identified exactly. And replaced name with *NAME*.

I czeched the whois record. Your family member should leaf it alone.

[whois.regtons.com]
Domain Name: foliageconsulting.com
Registry Domain ID: 1881534979_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.regtons.com
Registrar URL: http://regtons.com
Updated Date: 2015-02-12T00:00:00Z
Creation Date: 2014-10-21T00:00:00Z
Registrar Registration Expiration Date: 2015-10-21T00:00:00Z
Registrar: GRANSY S.R.O D/B/A SUBREG.CZ
Registrar IANA ID: 1505
Registrar Abuse Contact Email: [email protected]
Registrar Abuse Contact Phone: +420.734463373
Domain Status: ok
Registry Registrant ID: PRIVACY_PROTECTION
Registrant Name: Domain Admin
Registrant Organization: Whois protection, this company does not own this domain name s.r.o.
Registrant Street: Zrzaveho 1705/2a
Registrant City: Praha 6
Registrant State/Province:
Registrant Postal Code: 16300
Registrant Country: CZ
Registrant Phone: +420.226517341
Registrant Phone Ext:
Registrant Fax: +420.226517351
Registrant Fax Ext:
Registrant Email: [email protected]
Registry Admin ID: PRIVACY_PROTECTION
Name Server: ns1.lealhost.com
Name Server: ns2.lealhost.com

Domains registered for one year with privacy protection are usually scams.

The phone number of the branch in Saskatchewan, +1-315-508-4078, is in New York.

the complete headers from the email messages may help, but I can tell you it is a fraud.

The domain below is an email only domain.

Domain Name: GENERSO.COM
Registrar: TODAYNIC.COM, INC.
Sponsoring Registrar IANA ID: 697
Whois Server: whois.todaynic.com
Referral URL: http://www.NOW.CN
Name Server: NS5.FOZZY.COM
Name Server: NS6.FOZZY.COM
Status: clientTransferProhibited http://www.icann.org/epp#clientTransferProhibited
Updated Date: 04-mar-2015
Creation Date: 14-may-2014
Expiration Date: 14-may-2015

>>> Last update of whois database: Wed, 01 Apr 2015 23:24:36 GMT <<<
Queried whois.todaynic.com with "generso.com"...

Domain name: generso.com
Registry Domain ID: 77428276_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.todaynic.com
Registrar URL: http://www.now.cn/
Update Date: 2015-03-04T16:00:00Z
Creation Date: 2014-05-14T21:53:06Z
Registrar Registration Expiration Date: 2015-05-14T16:00:00Z
Registrar: Todaynic.com, Inc.
Registrar IANA ID: 697
Registrar Abuse Contact Email: [email protected]
Registrar Abuse Contact Phone: +86.7563810552
Reseller:
Domain Status: clientTransferProhibited http://www.icann.org/epp#clientTransferProhibited
Registry Registrant ID:
Registrant Name: Sally A Clark
Registrant Organization: Private Person
Registrant Street: 1630 Payne Street
Registrant City: Sugar Land
Registrant Province/state: NA
Registrant Postal Code: 77487
Registrant Country: US
Registrant Phone: +1.2812431709
Registrant Phone EXT:
Registrant Fax: +1.2812431709
Registrant Fax EXT:
Registrant Email: [email protected]
Registry Admin ID:

and VX has done the whois for the other domain.

Your family member should create some "Google alerts" for all of the personal information given to these scammers. Go to www.google.com/alerts and set up one each for "address" "bldg #, street name" "Drivers license #" "SSN" "FirstName LastName" and "LastName FirstName", and what ever other data they have given.

use the quotes " " as above for each one of the alerts they set up with Google. It is not likely their ID will be compromised, but I think its better to err on the side of safe, rather than sorry in this case. If the alerts ever show results, address them at that time.

If it is a passport # then contact homeland security ( Department of State) and report it compromised to be issued a new passport #.

Ignoring the domain registrations and everything else (all of which do point to scam of course), this is really all I need to see to know that it is a money mule "job."

Your account will only be used during the probation period

NO legitimate company runs bank transactions through individuals' accounts, period. No matter what bs excuse they give you, it all boils down to that.

foliageconsulting.com is in the process of being reported for fraud.

Please post the headers of the email from generso.com. We need the headers to kill the email-only domain.

foliageconsulting.com is in the process of being reported for fraud.

Please post the headers of the email from generso.com. We need the headers to kill the email-only domain.

Here is the original without our email address:

Delivered-To: ****************@gmail.com
Received: by 10.140.131.195 with SMTP id 186csp1323536qhd;
Fri, 6 Mar 2015 10:52:41 -0800 (PST)
X-Received: by 10.50.36.103 with SMTP id p7mr56958395igj.20.1425667960819;
Fri, 06 Mar 2015 10:52:40 -0800 (PST)
Return-Path: <[email protected]>
Received: from mailer58.gate94.rs.smtp.com (mailer58.gate94.rs.smtp.com. [74.91.94.58])
by mx.google.com with ESMTP id w9si2296984igl.15.2015.03.06.10.52.40
for <******************@gmail.com>;
Fri, 06 Mar 2015 10:52:40 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 74.91.94.58 as permitted sender) client-ip=74.91.94.58;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 74.91.94.58 as permitted sender) [email protected];
dkim=pass [email protected]
Return-Path: <[email protected]>
X-MSFBL: cmVuYXRhLm1paGFsaWNrb3ZhQGdtYWlsLmNvbUA3NF85MV85NF81OEBmb3JtaWRp
b19kZWRpY2F0ZWRfcG9vbEA=
DKIM-Signature: v=1; a=rsa-sha256; d=smtp.com; s=smtpcomcustomers; c=relaxed/simple;
q=dns/txt; [email protected]; t=1425667959;
h=From:Subject:To:Date:MIME-Version:Content-Type;
bh=UbPrZSq8siho5mXJ/4svCbTgtixy1x8WeqJR+7zD5AM=;
b=UYiQ9k2jmSO3DIdNvJ+6EZCIOkgCdx++kyKqY0P4tjv4ussfd0R/QZuS6dRMDDZY
kr1WAgi4k5JXI0jfyq3FIBu5pXhQAwwWTcotjUgWQQ9iVa4NfPqaKiTv2fIBROyM
2xHxL10Pw/g00ivU0FpqQKGqxMX77/cQuTThC3sVM1I=;
Received: from [199.167.29.116] ([199.167.29.116:2520] helo=192.168.10.20)
by rs-ord-mta07-1.smtp.com (envelope-from <[email protected]>)
(ecelerity 3.3.2.44647 r(44647)) with ESMTPA
id EE/BE-14418-677F9F45; Fri, 06 Mar 2015 18:52:39 +0000
MIME-Version: 1.0
Date: Fri, 06 Mar 2015 19:52:39 +0100
X-Priority: 3 (Normal)
Subject: New job opening
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Reply-To: [email protected]
From: [email protected]
To: ******************@gmail.com
Message-ID: <[email protected]>
X-SMTPCOM-Tracking-Number: 4be9a875-a32d-4d83-8d62-8c331c6a2d4b
Feedback-ID: 5007476:SMTPCOM
X-SMTPCOM-Sender-ID: 5007476
X-SMTPCOM-Spam-Policy: SMTP.com is a paid relay service. We do not tolerate UCE of any kind. Please report it ASAP to [email protected]

Dear job-hunter,
My name is Delores Price, I work at Foliage Consulting Ltd. as a Person=
nel manager. I found your contact info on Jobdiagnosis. Viewing your inf=
ormation and experience I thought that we could offer you a vacancy with=
our company. The vacancy in question is that of an Operations Manager O=
M. You will collaborate with a team of OMs who are responsible of formi=
dable operations in our company.=20
In our employees we search for Honesty, Liability, Open-mindness. We don=
=E2=80=99t require any previous experience in this very field as we offe=
r an obligatory preparatory training and a short-tem probation period pa=
id.
At this point I would like to know whether you=E2=80=99re still looking =
for an employment and if you have spare time to dedicate to our training=
/probation period. If you do, please respond to me ASAP.


Truly yours,
HR Manager
Delores Price

Your family member should create some "Google alerts" for all of the personal information given to these scammers. Go to http://www.google.com/alerts and set up one each for "address" "bldg #, street name" "Drivers license #" "SSN" "FirstName LastName" and "LastName FirstName", and what ever other data they have given.

use the quotes " " as above for each one of the alerts they set up with Google. It is not likely their ID will be compromised, but I think its better to err on the side of safe, rather than sorry in this case. If the alerts ever show results, address them at that time.

If it is a passport # then contact homeland security ( Department of State) and report it compromised to be issued a new passport #.

Thank You HillBilly for suggestions, we will probably do that. Fortunately no ID/gov numbers were compromised... only things they have is gob application with name, address, phone# and signature.
And I did suspect it was a scam, but must be new one, couldn't Google anything up. That's also a reason why I posted it here, may helps someone else.

Foliage at http://foliageconsulting.com



Nothing to do with the real Foliage Consulting
whose website is here: http://www.foliage.com

Foliage is the chief world company which provides such services as financial risk management, insurance and reinsurance courtage, consulting in labor power resource and outtasking. With the help of innovative and progressive efficient solutions in the sphere of market risk management and human resource Foliage ensures distinctive client value.

At this time the most important things for any company's management are considered to be insurance and risk management issues. The result of a badly conceived program can be long-term slowdown or even business failure and bankruptcy. If you have a well-considered insurance and risk management program, you can focus on your goal and avoid worrying about the need of reserving your finance and preserve high liquidity.

As a small business owner your time should be spent on the most valuable task of GROWING your business. Let us use our small business expertise to handle the rest.

Headquarters - United States
Address: 201 N Illinois St Indianapolis, IN 46204
Phone: +1 (317) 468-9625
E-mail: [email protected]

Branch - Canada
Address: 2208 Scarth St Regina, SK S4P 2J6
Phone: +1 (315) 508-4078

The headers may not be sufficient (I've asked the chief site-killers and have no response yet). Could you post the headers of a later message, along with the headers and body of the message you sent to which it is the reply?

i received the exact same letter and offer today except they are now using the name John Landry.
a quick search led me here. Keep up the great work.

regards


russ

What email address is John Landry using? Could you post headers?

Here is the email as I received it

regards

Russ





[email protected]


Apr 5 (1 day ago)








to me










Dear job-hunter,
My name is James Landry, I work with Foliage Consulting Ltd. in the quality of Head-Manager. I found your contact info on Jobdiagnosis. Viewing your data and past experience I thought that we could offer you a job in our company. The vacancy in question is that of an Operations Manager OM. You’ll collaborate with a team of OMs who are responsible of important processes within our company.
In our applicants we value Prudence, Responsibility, Open-mindness. We don’t require any past experience in this very field as we offer a mandatory preparatory training and a short-tem probation period paid.
At this point I’d like to know whether you are still looking for an employment and if you have some time to dedicate to our training/probation period. If you do, kindly respond to me ASAP.

Truly yours,
HR Manager

Here is the email as I received it

regards

Russ





[email protected]


Apr 5 (1 day ago)








to me










Dear job-hunter,
My name is James Landry, I work with Foliage Consulting Ltd. in the quality of Head-Manager. I found your contact info on Jobdiagnosis. Viewing your data and past experience I thought that we could offer you a job in our company. The vacancy in question is that of an Operations Manager OM. You’ll collaborate with a team of OMs who are responsible of important processes within our company.
In our applicants we value Prudence, Responsibility, Open-mindness. We don’t require any past experience in this very field as we offer a mandatory preparatory training and a short-tem probation period paid.
At this point I’d like to know whether you are still looking for an employment and if you have some time to dedicate to our training/probation period. If you do, kindly respond to me ASAP.

Truly yours,
HR Manager

Thanks for posting the email(s), Russella.

can you reveal the complete headers and post them as well, please? If you don't know how to reveal the complete headers, see the link at the bottom of my post. Please remove your personal info before posting.

Thanks,
HB

Domain Name: ECOPHUS.COM
addresses 104.152.168.21
Registrar: GRANSY S.R.O D/B/A SUBREG.CZ
Sponsoring Registrar IANA ID: 1505
Whois Server: whois.regtons.com
Referral URL: http://regtons.com
Name Server: NS1.ADELINADNS.INFO
Name Server: NS2.ADELINADNS.INFO
Status: ok http://www.icann.org/epp#OK
Updated Date: 13-mar-2015
Creation Date: 30-may-2014
Expiration Date: 30-may-2015

>>> Last update of whois database: Mon, 06 Apr 2015 13:59:35 GMT <<<
Queried whois.regtons.com with "ecophus.com"...

Domain Name: ecophus.com
Registry Domain ID: 1860840724_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.regtons.com
Registrar URL: http://regtons.com
Updated Date: 2015-03-13T00:00:00Z
Creation Date: 2014-05-30T00:00:00Z
Registrar Registration Expiration Date: 2015-05-30T00:00:00Z
Registrar: GRANSY S.R.O D/B/A SUBREG.CZ
Registrar IANA ID: 1505
Registrar Abuse Contact Email: [email protected]
Registrar Abuse Contact Phone: +420.734463373
Domain Status: ok
Registry Registrant ID: PRIVACY_PROTECTION

They claim a California address, but use a NY phone #???

http://www.ecophus.com/?p=contacts

HEADQUATERS: USA/CANADA
23 Corporate Plaza, Suite 150,
Newport Beach, CA 92660,
USA
Telephone:+1 (315) 636-0931
E-mail: [email protected]

(315) 636-0931
Bandwidth SMSEnabled VoIP in Amber, NY

lookup failed pavazo.com
Could not find an IP address for this domain name.

Sorry but I cant get the full header to work. The link you send costs 20 bucks to get that info and I don't use my credit card online!

Russ