Camera and CATV logistics mgr Scam?Help

Hello! I have recently received an email saying this company got my resume from careerbuilder.com and would like me to apply for one of two openings as a logistics manager for his company "Camera and CATV repair" as a logistics manager. Apparently they have a website online known as eramatrix.com. I'm not really sure what to make of it and I was hoping someone could help me out I did look into it a little but I am still confused. The website seems to be legit, When I called the 1800 number on the website it did go to era matrix. I used whois.com to see who registered the site, it says it was registered in 2012 by Frank Jackson via paknic.com and gave me an address. When I googled the address it was an exact match suite # and everything for Habitat Pest Control in San Jose CA. I have seen cases similar to this on this website, (Angela's electronics for one) and I would just like to get to the bottom of things. Below is the email in question, any help is greatly appreciated. Thanks!

Javier Berger <[email protected]>
Attachments4:55 PM (7 hours ago)

to me
RE: Career Builder: Ticket 24k9762j57 - Excellent Resume From (my full name)

Dear (NAME),

My name is Javier Berger, the HR manager at Camera & CATV Repair.

We are currently looking for two new employees to join our team. We plan to add these employees in the next 2 or 3 weeks. It is a home based full- time position.

Founded as a camera and TV repair service, Camera & CATV Repair has been expanded to online computer store and new EraMatrix.com was created in 2012. Since that time we offer great deals on cameras, tablets and more. Our high volume with major electronics suppliers let us offer the greatest deals. We have come far since our first computer store. We constantly search for new locations and talented employees to grow even more.

If chosen as a Camera & CATV Repair Logistics Manager, your responsibilities will include:

• Handle and report customer emails/regular mail.
• Handle shipping issues/oversea shipments/oversized packages/damaged during transportation packages.
• Handle USPS guidelines and make sure we are compliant with all regulations.
• Handle orders from international customers.


Look over the attached Company’s brochure to get acquainted with us.
If you are interested, please complete the application.
Filling the easy online form is the first step to your employment:

http://us-employees.com/?p=b651bf0e1ca2 ... b91937bb2e

Please give our HR specialist up to 5 business days to process your resume. Once we complete the initial screening, we will contact you to set up a phone interview, at which time we will answer any questions you may have and get a better idea of whether you are suitable for a position for Camera & CATV Repair. For your success in obtaining a position with our company, you will need to respond as quickly as possible.



---
Yours Sincerely,
Javier Berger
HR Manager

Camera & CATV Repair
Legal owner of EraMatrix.com

Phone: (800) 948-5580 ext. 75
Fax: (800) 948-4105
Web: http://www.eramatrix.com
Email: [email protected]
Attachments area
Preview attachment Camera & CATV Repair March 2015.pdf
PDF
Camera & CATV Repair March 2015.pdf

Your concerns are well-founded. It is indeed a scam, just like Angela's electronics.

The scammers have used the same tactic, too. They took a domain that was registered and grabbed it immediately so that it would look like it had been registered for a long time.

In reality, the domain changed hands in February of this year--so it is not 3 years old, it is less than 2 months old.

us-employees.com and eramatrix.com are in the process of being reported for fraud.

There is a third site in this Russian reshipping scam. It is the task manager site, used by the scammers to tell the package mules when to expect a package and where to resend it. What is that site?

Dotti, So since this site has already been reported, Is there anything else I should do?

VX has indicated that these criminals usually have a third website, where they have their mules log in. Did you get any other correspondence from them, and if so, can you see if there are any websites mentioned?

The only other website address given was in that email above:

If you are interested, please complete the application.
Filling the easy online form is the first step to your employment:

http://us-employees.com/?p=b651bf0e1ca2 ... b91937bb2e

Is that the one you are looking for?

The first email they sent me did not give any information but it is below:

[email protected] via gator3079.hostgator.com
Mar 31 (3 days ago)

to me

Our company is currently looking for a new Logistics Manager and you look like a potential candidate to perform these responsibilities. Upon viewing your resume at CareerBuilder, we decided to invite you for a phone interview.
Please make sure your skills and qualities are comparable with the details below:

* Entry level computer user
* Basic knowledge of MS Office and Acrobat Reader Program
* Familiar with household devices
* Knowledgeable about USPS or FedEx not necessary, but desired
* Capable of handling 10-50 lbs packages monthly.

This is a full-time job with a 42 hour week. Apart from providing customer support via our internal working panel, you will also receive correspondence at your home address, sort it out and make up a catalogue of incoming parcels. This catalogue will then be sent to the client.

To find out more, send a message to us. Once it is read, our Human Resource Manager will reach you over the phone and make a phone appointment that might be a start of your career at our Company.

resumedistribution.in appears to be a fake domain with completely nonsensical registrant address:

Domain Name:RESUMEDISTRIBUTION.IN
Created On:25-Mar-2015 10:14:55 UTC
Last Updated On:31-Mar-2015 20:22:21 UTC
Expiration Date:25-Mar-2016 10:14:55 UTC
Sponsoring Registrar:Webiq Domains Solutions Pvt. Ltd. (R131-AFIN)
Status:CLIENT TRANSFER PROHIBITED
Status:TRANSFER PROHIBITED
Registrant ID:WIQ_42949195
Registrant Name:Michael Peterson
Registrant Organization:Private Person
Registrant Street1:61 Carry creek road
Registrant Street2:
Registrant Street3:
Registrant City:Cary
Registrant State/Province:
Registrant Postal Code:37216
Registrant Country:RU
Registrant Phone:+1.872192109
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:[email protected]

It has an IP address, but gives a webserver timeout or disconnect. Could you post the complete headers of the email?

The one I'm looking for probably has a name beginning with "db", but I don't know for sure. Previous third websites of this scam gang were db-edit.com, db-log.com, and db-mngt.com.

VX this thread has been reported for fake sites.

When you have all that you need (sites) can you PM me so I can close the reports.

Delivered-To:
Received: by 10.50.249.49 with SMTP id yr17csp276529igc;
Tue, 31 Mar 2015 14:10:31 -0700 (PDT)
X-Received: by 10.60.160.236 with SMTP id xn12mr35974296oeb.53.1427836230887;
Tue, 31 Mar 2015 14:10:30 -0700 (PDT)
Return-Path: <[email protected]>
Received: from gator3079.hostgator.com (gator3079.hostgator.com. [50.87.144.98])
by mx.google.com with ESMTPS id e4si10358122oer.65.2015.03.31.14.10.30
for [email protected]>
(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Tue, 31 Mar 2015 14:10:30 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 50.87.144.98 as permitted sender) client-ip=50.87.144.98;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 50.87.144.98 as permitted sender) [email protected]
Received: from stepup by gator3079.hostgator.com with local (Exim 4.82)
(envelope-from <[email protected]>)
id 1Yd3Qa-0005QL-Kr
for ; Tue, 31 Mar 2015 16:10:28 -0500
To:
Subject:
X-PHP-Script: blog.suwn.org/wp-admin/tempfail.php for 78.129.192.55
From: [email protected]
Reply-To: [email protected]
Errors-To: [email protected]
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Message-Id: <[email protected]>
Date: Tue, 31 Mar 2015 16:10:28 -0500
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - gator3079.hostgator.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [32587 500] / [47 12]
X-AntiAbuse: Sender Address Domain - gator3079.hostgator.com
X-BWhitelist: no
X-Source-IP:
X-Exim-ID: 1Yd3Qa-0005QL-Kr
X-Source: /opt/php52/bin/php-cgi
X-Source-Args: /opt/php52/bin/php-cgi /home1/stepup/public_html/blog/wp-admin/tempfail.php
X-Source-Dir: suwn.org:/public_html/blog/wp-admin
X-Source-Sender:
X-Source-Auth: stepup
X-Email-Count: 16
X-Source-Cap: c3RlcHVwO3N0ZXB1cDtnYXRvcjMwNzkuaG9zdGdhdG9yLmNvbQ==



Delivered-To:
Received: by 10.50.249.49 with SMTP id yr17csp1618760igc;
Thu, 2 Apr 2015 14:19:57 -0700 (PDT)
X-Received: by 10.68.110.37 with SMTP id hx5mr90623751pbb.46.1428009596540;
Thu, 02 Apr 2015 14:19:56 -0700 (PDT)
Return-Path: <[email protected]>
Received: from out.smtp-auth.no-ip.com (smtp-auth.no-ip.com. [8.23.224.61])
by mx.google.com with ESMTPS id ql2si9083011pac.138.2015.04.02.14.19.55
for <>
(version=TLSv1 cipher=RC4-SHA bits=128/128);
Thu, 02 Apr 2015 14:19:56 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 8.23.224.61 as permitted sender) client-ip=8.23.224.61;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 8.23.224.61 as permitted sender) [email protected]
X-No-IP: eramatrix.com@noip-smtp
X-Report-Spam-To: [email protected]
Received: from localhost (unknown [168.150.194.199])
(Authenticated sender: eramatrix.com@noip-smtp)
by smtp-auth.no-ip.com (Postfix) with ESMTPA id 3CB1B400868
for <>; Thu, 2 Apr 2015 14:19:46 -0700 (PDT)
Date: Thu, 2 Apr 2015 13:55:18 -0700
From: Javier Berger <[email protected]>
Reply-To: Javier Berger <[email protected]>
Organization: EraMatrix.com - HR Dept
X-Priority: 3 (Normal)
Message-ID: <[email protected]>
To: >
Subject: Re: Career Builder: ticket 24K9762J57 - Excellent resume from xxxxxxxx
In-Reply-To: <CAKL3FzC5UUX3hi9t6tR55m0QjeXaRY5hN8-nZG41gNOB-ig0+w@mail.gmail.com>
References: <[email protected]> <CAKL3FzC5UUX3hi9t6tR55m0QjeXaRY5hN8-nZG41gNOB-ig0+w@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----------5210E121D23F211"

------------5210E121D23F211
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Are these what you need? I tried to take my info out, Let me know if you need anything else! Thank you!!!

Could you post the message that you sent between those two, with headers? It looks like you sent a message to resumedistribution.in, and he answered from eramatrix.com. The message you sent should be the missing link we need.

Amanda,

You can post it here, but if you would prefer not to publicly post the email, you can send it via private message.
And do remove your own personal information (name, address, email address, phone) - you can simply replace with X's.

Sometimes we need the whole chain to show what the scammers are up to, and also to prove that they are using those domains in their activities.

Delivered-To: [email protected]
Received: by 10.50.249.49 with SMTP id yr17csp276529igc;
Tue, 31 Mar 2015 14:10:31 -0700 (PDT)
X-Received: by 10.60.160.236 with SMTP id xn12mr35974296oeb.53.1427836230887;
Tue, 31 Mar 2015 14:10:30 -0700 (PDT)
Return-Path: <[email protected]>
Received: from gator3079.hostgator.com (gator3079.hostgator.com. [50.87.144.98])
by mx.google.com with ESMTPS id e4si10358122oer.65.2015.03.31.14.10.30
for <[email protected]>
(version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Tue, 31 Mar 2015 14:10:30 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 50.87.144.98 as permitted sender) client-ip=50.87.144.98;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 50.87.144.98 as permitted sender) [email protected]
Received: from stepup by gator3079.hostgator.com with local (Exim 4.82)
(envelope-from <[email protected]>)
id 1Yd3Qa-0005QL-Kr
for [email protected]; Tue, 31 Mar 2015 16:10:28 -0500
To: [email protected]
Subject: =?UTF-8?B?
X-PHP-Script: blog.suwn.org/wp-admin/tempfail.php for 78.129.192.55
From: [email protected]
Reply-To: [email protected]
Errors-To: [email protected]
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Message-Id: <[email protected]>
Date: Tue, 31 Mar 2015 16:10:28 -0500
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - gator3079.hostgator.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [32587 500] / [47 12]
X-AntiAbuse: Sender Address Domain - gator3079.hostgator.com
X-BWhitelist: no
X-Source-IP:
X-Exim-ID: 1Yd3Qa-0005QL-Kr
X-Source: /opt/php52/bin/php-cgi
X-Source-Args: /opt/php52/bin/php-cgi /home1/stepup/public_html/blog/wp-admin/tempfail.php
X-Source-Dir: suwn.org:/public_html/blog/wp-admin
X-Source-Sender:
X-Source-Auth: stepup
X-Email-Count: 16
X-Source-Cap: c3RlcHVwO3N0ZXB1cDtnYXRvcjMwNzkuaG9zdGdhdG9yLmNvbQ==

Hi XXxxxxx!

Our company is currently looking for a new Logistics Manager and you look like a potential candidate to perform these responsibilities. Upon viewing your resume at CareerBuilder, we decided to invite you for a phone interview.
Please make sure your skills and qualities are comparable with the details below:

* Entry level computer user
* Basic knowledge of MS Office and Acrobat Reader Program
* Familiar with household devices
* Knowledgeable about USPS or FedEx not necessary, but desired
* Capable of handling 10-50 lbs packages monthly.

This is a full-time job with a 42 hour week. Apart from providing customer support via our internal working panel, you will also receive correspondence at your home address, sort it out and make up a catalogue of incoming parcels. This catalogue will then be sent to the client.

To find out more, send a message to us. Once it is read, our Human Resource Manager will reach you over the phone and make a phone appointment that might be a start of your career at our Company.=20



MIME-Version: 1.0
Received: by 10.50.245.11 with HTTP; Tue, 31 Mar 2015 15:01:21 -0700 (PDT)
In-Reply-To: <[email protected]>
References: <[email protected]>
Date: Tue, 31 Mar 2015 18:01:21 -0400
Delivered-To: [email protected]
Message-ID: <CAKL3FzC5UUX3hi9t6tR55m0QjeXaRY5hN8-nZG41gNOB-ig0+w@mail.gmail.com>
Subject: Re: Career Builder: ticket 24K9762J57 - Excellent resume from xxxxxx xxxxxxxx
From: xxxxxx xxxxxxx<[email protected]>
To: [email protected]
Content-Type: multipart/alternative; boundary=047d7b6700712f9df105129cbdf1

--047d7b6700712f9df105129cbdf1
Content-Type: text/plain; charset=UTF-8

What company is this for?

On Tue, Mar 31, 2015 at 5:10 PM, <[email protected]> wrote:

> Hi xxxxxxxxxxxxxx!
>
> Our company is currently looking for a new Logistics Manager and you look
> like a potential candidate to perform these responsibilities. Upon viewing
> your resume at CareerBuilder, we decided to invite you for a phone
> interview.
> Please make sure your skills and qualities are comparable with the details
> below:
>
> * Entry level computer user
> * Basic knowledge of MS Office and Acrobat Reader Program
> * Familiar with household devices
> * Knowledgeable about USPS or FedEx not necessary, but desired
> * Capable of handling 10-50 lbs packages monthly.
>
> This is a full-time job with a 42 hour week. Apart from providing customer
> support via our internal working panel, you will also receive
> correspondence at your home address, sort it out and make up a catalogue of
> incoming parcels. This catalogue will then be sent to the client.
>
> To find out more, send a message to us. Once it is read, our Human
> Resource Manager will reach you over the phone and make a phone appointment
> that might be a start of your career at our Company.
>

--047d7b6700712f9df105129cbdf1
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">What company is this for?</div><div class=3D"gmail_extra">=
<br><div class=3D"gmail_quote">On Tue, Mar 31, 2015 at 5:10 PM, <span dir=
=3D"ltr">&lt;<a href=3D"mailto:[email protected]" target=3D"_b=
lank">[email protected]</a>&gt;</span> wrote:<br><blockquote c=
lass=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;=
padding-left:1ex">Hi xxxxxx xxxxxxx!<br>
<br>
Our company is currently looking for a new Logistics Manager and you look l=
ike a potential candidate to perform these responsibilities. Upon viewing y=
our resume at CareerBuilder, we decided to invite you for a phone interview=
.<br>
Please make sure your skills and qualities are comparable with the details =
below:<br>
<br>
* Entry level computer user<br>
* Basic knowledge of MS Office and Acrobat Reader Program<br>
* Familiar with household devices<br>
* Knowledgeable about USPS or FedEx not necessary, but desired<br>
* Capable of handling 10-50 lbs packages monthly.<br>
<br>
This is a full-time job with a 42 hour week. Apart from providing customer =
support via our internal working panel, you will also receive correspondenc=
e at your home address, sort it out and make up a catalogue of incoming par=
cels. This catalogue will then be sent to the client.<br>
<br>
To find out more, send a message to us. Once it is read, our Human Resource=
Manager will reach you over the phone and make a phone appointment that mi=
ght be a start of your career at our Company.<br>
</blockquote></div><br></div>

--047d7b6700712f9df105129cbdf1--



Delivered-To: [email protected]
Received: by 10.50.249.49 with SMTP id yr17csp1618760igc;
Thu, 2 Apr 2015 14:19:57 -0700 (PDT)
X-Received: by 10.68.110.37 with SMTP id hx5mr90623751pbb.46.1428009596540;
Thu, 02 Apr 2015 14:19:56 -0700 (PDT)
Return-Path: <[email protected]>
Received: from out.smtp-auth.no-ip.com (smtp-auth.no-ip.com. [8.23.224.61])
by mx.google.com with ESMTPS id ql2si9083011pac.138.2015.04.02.14.19.55
for <[email protected]>
(version=TLSv1 cipher=RC4-SHA bits=128/128);
Thu, 02 Apr 2015 14:19:56 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 8.23.224.61 as permitted sender) client-ip=8.23.224.61;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 8.23.224.61 as permitted sender) [email protected]
X-No-IP: eramatrix.com@noip-smtp
X-Report-Spam-To: [email protected]
Received: from localhost (unknown [168.150.194.199])
(Authenticated sender: eramatrix.com@noip-smtp)
by smtp-auth.no-ip.com (Postfix) with ESMTPA id 3CB1B400868
for <xxxxxxxxxxxx>; Thu, 2 Apr 2015 14:19:46 -0700 (PDT)
Date: Thu, 2 Apr 2015 13:55:18 -0700
From: Javier Berger <[email protected]>
Reply-To: Javier Berger <[email protected]>
Organization: EraMatrix.com - HR Dept
X-Priority: 3 (Normal)
Message-ID: <[email protected]>
To: xxxxxxxxxxxxxx <[email protected]>
Subject: Re: Career Builder: ticket 24K9762J57 - Excellent resume from xxxxxxxxxxxxxx
In-Reply-To: <CAKL3FzC5UUX3hi9t6tR55m0QjeXaRY5hN8-nZG41gNOB-ig0+w@mail.gmail.com>
References: <[email protected]> <CAKL3FzC5UUX3hi9t6tR55m0QjeXaRY5hN8-nZG41gNOB-ig0+w@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----------5210E121D23F211"

------------5210E121D23F211
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

RE: Career Builder: Ticket 24k9762j57 - Excellent Resume From xxxxxxxxxxxxxx

Dear xxxxxx,

My name is Javier Berger, the HR manager at Camera & CATV Repair.

We are currently looking for two new employees to join our team. We plan to=
add these employees in the next 2 or 3 weeks. It is a home based full- tim=
e position.

Founded as a camera and TV repair service, Camera & CATV Repair has been ex=
panded to online computer store and new EraMatrix.com was created in 2012. =
Since that time we offer great deals on cameras, tablets and more. Our high=
volume with major electronics suppliers let us offer the greatest deals. W=
e have come far since our first computer store. We constantly search for ne=
w locations and talented employees to grow even more.

If chosen as a Camera & CATV Repair Logistics Manager, your responsibilitie=
s will include:

=E2=80=A2 Handle and report customer emails/regular mail.
=E2=80=A2 Handle shipping issues/oversea shipments/oversized packages/damag=
ed during transportation packages.
=E2=80=A2 Handle USPS guidelines and make sure we are compliant with all re=
gulations.
=E2=80=A2 Handle orders from international customers.


Look over the attached Company=E2=80=99s brochure to get acquainted with us=
.=20
If you are interested, please complete the application.=20
Filling the easy online form is the first step to your employment:

http://us-employees.com/?p=3Db651bf0e1c ... 937bb2e=20

Please give our HR specialist up to 5 business days to process your resume.=
Once we complete the initial screening, we will contact you to set up a ph=
one interview, at which time we will answer any questions you may have and =
get a better idea of whether you are suitable for a position for Camera & C=
ATV Repair. For your success in obtaining a position with our company, you =
will need to respond as quickly as possible.



---
Yours Sincerely,
Javier Berger
HR Manager

Camera & CATV Repair
Legal owner of EraMatrix.com

Phone: (800) 948-5580 ext. 75
Fax: (800) 948-4105
Web: http://www.eramatrix.com
Email: [email protected]
------------5210E121D23F211
Content-Type: application/pdf;
name="Camera & CATV Repair March 2015.pdf"
Content-transfer-encoding: base64
Content-Disposition: attachment;
filename="Camera & CATV Repair March 2015.pdf"


That is everything. At the end of the last one there are thousands of letters, im guessing that would be the file he sent me? I didn't open that. If you need something else let me know!
Thanks so much

Thanks! Those are the missing headers we need.

The thousands of letters are an attachment, probably in base-64 code. If we need them, I or another sitekiller will PM you an email address, but I don't think it's necessary.

eramatrix.com , Website Registrant Claimed Address is Fake . Claimed address belongs to a Pest Control Company .

^Amanda pointed that out in the original post. If you drop the suite number, the remaining address appears to be a UPS store, thus Suite 320 is really PMB 320, not a room with a desk in it but just a mailbox.

The registrant address of resumedistribution.in is complete nonsense:

Registrant ID:WIQ_42949195
Registrant Name:Michael Peterson
Registrant Organization:Private Person
Registrant Street1:61 Carry creek road
Registrant Street2:
Registrant Street3:
Registrant City:Cary
Registrant State/Province:
Registrant Postal Code:37216
Registrant Country:RU
Registrant Phone:+1.872192109
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:[email protected]

resumedistribution.in is in the process of being reported for fraud.