thermo fisher scientific fake

[rimicovi]

Offering a remote job impersonating a real company (thermo fischer scientific), then asking for a payment to ship the Home Office tools needed.

This was the first approach on outsourcely.com:

Elise Ludgin 3:08 AM
Are you ready to be part of a company where you’re empowered to learn and grow personally and professionally? if yes please send your full name and verification code (TH9123) via email to our career desk here:([email protected]) requesting for a comprehensive briefing about the position and schedule an interview. We will get back in touch with you. Good day!
Regards,
Elise Ludgin
‎Sr. Director, Human Resources
Thermo Fisher Scientific

I answered the email and was interviewed on skype just by chat. The real company is very big so at first it looked like a good opportunity. Then I noticed thermofishersc.com (used in email) is different from thermofisher.com (actually website).

I looked it up and domain was only created a few days ago.

They try to ask you for 250 dollars for shipment expenses for the tools they "send you" that you need to work from home to them.

Hope I helped some of you out there.

[Tim Atem]

Thank you for posting!

Employment scam posing as [email protected] - an email-only domain and has nothing to do with the legitimate Thermo Fisher Scientific company.

Domain Name: THERMOFISHERSC.COM
Registrar: TUCOWS DOMAINS INC.
Sponsoring Registrar IANA ID: 69
Whois Server: whois.tucows.com
Referral URL: http://www.tucowsdomains.com
Name Server: NS2.VPWEB.COM
Name Server: NS3.VPWEB.COM
Name Server: NS4.VPWEB.COM
Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited
Updated Date: 03-jun-2017
Creation Date: 03-jun-2017
Expiration Date: 03-jun-2018

[vonpaso xlura]

Please post the complete headers of the email from thermofishersc.com. We need them to kill the domain.

[rimicovi]

I think this is the header you asked?

[email protected]


Responder|
sáb 03-06-2017 18:16
Para:
<removed personal information> Mike W
Thermo Fisher Scientific Inc. (NYSE: TMO) is the world leader in serving science, with revenues of $17 billion and more than 50,000 employees in 50 countries. Our mission is to enable our customers to make the world healthier, cleaner and safer. We help our customers accelerate life sciences research, solve complex analytical challenges, improve patient diagnostics and increase laboratory productivity. Through our premier brands – Thermo Scientific, Applied Biosystems, Invitrogen, Fisher Scientific and Unity Lab Services – we offer an unmatched combination of innovative technologies, purchasing convenience and comprehensive support
Job Description
When you’re part of the team at Thermo Fisher Scientific, you’ll do important work, like helping customers in finding cures for cancer, protecting the environment or making sure our food is safe. Your work will have real-world impact, and you’ll be supported in achieving your career goals.
Attracts potential customers by answering product and service questions; suggesting information about other products and services.
Opens customer accounts by recording account information.
Maintains customer records by updating account information.
Resolves product or service problems by clarifying the customer's complaint; determining the cause of the problem; selecting and explaining the best solution to solve the problem; expediting correction or adjustment; following up to ensure resolution.
Pay : $35/hour 25-30 hours/week
Non-Negotiable Hiring Criteria:
Must possess communication skills, written and verbal, to clearly express his or her ideas, share technical information, communicate well with customers and various levels of the organization, write procedures and develop plans.
Must possess analytical and critical thinking ability to be able to evaluate, interpret information and procedures, to make timely decisions while functioning in a fast-paced, changing work environment.
Must possess organizational skills to meet deadlines and assist staff in multi-tasking.
Must be able to apply sound judgment and decision-making skills in dealing with a variety of routine and non-routine issues.
Must be self-motivated, stress and pressure resistant, as well as a quick learner.
Intermediate proficiency in computer applications: i.e. Microsoft Word, Outlook, Visio and Adobe Acrobat. Intermediate Excel skills is a must.
Ability to solve problems and work independently
Ability to produce accurate high-quality work with attention to detail
Ability to work well both independently as well as within a team environment
Ability to work overtime as dictated by the workload.
Demonstrate Thermo Fisher Scientific values – Integrity, Intensity, Innovation and Involvement
At Thermo Fisher Scientific, each one of our 50,000 extraordinary minds has a unique story to tell. Join us and contribute to our singular mission—enabling our customers to make the world healthier, cleaner and safer.
Thermo Fisher Scientific is an EEO/Affirmative Action Employer and does not discriminate on the basis of race, color, religion, sex, sexual orientation, gender identity, national origin, protected veteran status, disability or any other legally protected status.
Best Regards,
Stephanie Schacht
‎Director, Talent Acquisition At Thermo Fisher Scientific

[vonpaso xlura]

No, we need complete headers. Especially the Received headers, and the X-Originating-IP header if any, but we need them all.

[rimicovi]

Maybe something like this?

Received: from VE1EUR03HT186.eop-EUR03.prod.protection.outlook.com
(2a01:111:e400:52b7::29) by AM5P189MB0387.EURP189.PROD.OUTLOOK.COM with HTTPS
via AM3PR05CA0061.EURPRD05.PROD.OUTLOOK.COM; Wed, 7 Jun 2017 10:25:09 +0000
Received: from VE1EUR03FT032.eop-EUR03.prod.protection.outlook.com
(10.152.18.55) by VE1EUR03HT186.eop-EUR03.prod.protection.outlook.com
(10.152.19.44) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.1101.12; Wed, 7
Jun 2017 10:24:45 +0000
Authentication-Results: spf=temperror (sender IP is 64.98.42.127)
smtp.mailfrom=thermofishersc.com; hotmail.com; dkim=none (message not signed)
header.d=none;hotmail.com; dmarc=temperror action=none
header.from=thermofishersc.com;
Received-SPF: TempError (protection.outlook.com: error in processing during
lookup of thermofishersc.com: DNS Timeout)
Received: from SNT004-MC11F2.hotmail.com (10.152.18.59) by
VE1EUR03FT032.mail.protection.outlook.com (10.152.18.121) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id
15.1.1143.11 via Frontend Transport; Wed, 7 Jun 2017 10:24:43 +0000
X-IncomingTopHeaderMarker: OriginalChecksum:5812E660782CA2641988FB8924894C509A098A57B93B12BBF025D2C147A71258;UpperCasedChecksum:A59B5D1C85D2199E6F2FB47042659592A0D6174616EE585BE7FA050F3575B55C;SizeAsReceived:2064;Count:19
Received: from smtprelay.b.hostedemail.com ([64.98.42.127]) by SNT004-MC11F2.hotmail.com over TLS secured channel with Microsoft SMTPSVC(7.5.7601.23143);
Wed, 7 Jun 2017 03:24:20 -0700
Received: from filter.hostedemail.com (10.5.19.248.rfc1918.com [10.5.19.248])
by smtprelay01.b.hostedemail.com (Postfix) with ESMTP id 82FED2D2A1E;
Wed, 7 Jun 2017 10:24:18 +0000 (UTC)
X-Session-Marker: 74616C656E74706F6F6C40746865726D6F66697368657273632E636F6D
X-Spam-Summary: 64,4,0,,d41d8cd98f00b204,[email protected],::::::,RULES_HIT:41:152:355:379:392:408:582:962:967:973:988:98911891313134514361516151815751589159417301777196325572562291131393141335237693866386838734361:4362:4425:5007:6261:6678:7754:8603:8957:9040108481165812043122311248413134131611322913439140371409614346147211487921324214513001230054:30070,0,RBL:none,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:,MSBL:0,DNSBL:none,Custom_rules:0:1:0,LFtime:5,LUA_SUMMARY:none
X-HE-Tag: joke58_863f558fa154
X-Filterd-Recvd-Size: 700852
Received: from mail.thermofishersc.com (imap-ext [64.98.36.5])
(Authenticated sender: webmail@[email protected])
by omf04.b.hostedemail.com (Postfix) with ESMTPA;
Wed, 7 Jun 2017 10:24:17 +0000 (UTC)
Content-Type: multipart/mixed; boundary="=_6853488474734e1d4b6d5e9f92b506f6"
Date: Wed, 7 Jun 2017 06:24:17 -0400
From: <[email protected]>
To: undisclosed-recipients:;
Subject: OFFER LETTER
Message-ID: <[email protected]>
X-Sender: [email protected]
User-Agent: Roundcube Webmail/1.1.5
X-Originating-IP: [71.40.150.67]
Return-Path: [email protected]
X-OriginalArrivalTime: 07 Jun 2017 10:24:20.0412 (UTC) FILETIME=[39B0BFC0:01D2DF78]
X-IncomingHeaderCount: 19
X-MS-Exchange-Organization-Network-Message-Id: f533f00f-a8da-4352-6824-08d4ad8f6a5e
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0
X-MS-Exchange-Organization-MessageDirectionality: Incoming
CMM-sender-ip: 64.98.42.127
CMM-sending-ip: 64.98.42.127
CMM-Authentication-Results: hotmail.com; spf=temperror (sender IP is
64.98.42.127) smtp.mailfrom=[email protected]; dkim=none
header.d=thermofishersc.com; x-hmca=none
header.id=[email protected]
CMM-X-SID-PRA: [email protected]
CMM-X-AUTH-Result: NONE
CMM-X-SID-Result: NONE
CMM-X-Message-Status: n:n
CMM-X-Message-Delivery: Vj0xLjE7dXM9MDtsPTE7YT0wO0Q9MTtHRD0xO1NDTD0w
CMM-X-Message-Info: NhFq/7gR1vRCqXg11MuuvRvWObdWSdvFJyoQr36eApjmg+6Gxfz4/poDz0xf7xt+4O8lDsmPGyFnZqoam4yCCPiz3aSA/5+DFDBdgjt6LUWJ2ivK2KUCuqOWOLjZYmkpfjWEcrfNrt0vr1Vfra5clsAOk8xaIymK1UkZ5wKAfvb49wXhhHvvj2C34JQ/fZUddU6z5fEnySgwRKidszxBxDIqx2njjSO7GUw7nSqJ092UpGAMfix/jqTB9QkCDvt0
X-MS-Exchange-Organization-PCL: 2
X-MS-UserLastLogonTime: 6/7/2017 9:59:55 AM
X-Microsoft-Exchange-Diagnostics: 1;VE1EUR03FT032;1:rExTlriU1hLVgZ/BbE9gaoxo0YkHstsUFVZd8js6ZQ+KMlNnyT5JMMvepTIrHLatkAxhGFuxQlUWtB5ooXws+ZcwlfZuAPNLr8yzu2NK8ZaEY1T5Cs0vBhb6D9mTKAqgbPltegHodymioJuR1gjSPmrbgHyg9BujV5VW0WXwWiyB9DjSlNJcp+728TA3Aln0QDoj3D2Iv0+UHAIyn+hB+1O7dKuJwUtgZ64J7jAdXk6f5YdQ+4KoZ685egBAB+6r3tdXwmSzSn6Xsqcy5FBJSQ==
X-Forefront-Antispam-Report: EFV:NLI;SFV:NSPM;SFS:(98901004);DIR:INB;SFP:;SCL:1;SRVR:VE1EUR03HT186;H:SNT004-MC11F2.hotmail.com;FPR:;SPF:None;LANG:en;
X-MS-Exchange-Organization-AuthSource: VE1EUR03FT032.eop-EUR03.prod.protection.outlook.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: VE1EUR03HT186:
X-MS-Office365-Filtering-Correlation-Id: f533f00f-a8da-4352-6824-08d4ad8f6a5e
X-Microsoft-Antispam: BCL:0;PCL:0;RULEID:(23075)(22001)(8291500097)(8291501071);SRVR:VE1EUR03HT186;
X-Microsoft-Exchange-Diagnostics: 1;VE1EUR03HT186;3:/rCc1fMzaoUjvkGrsYjKe2IP97iSVGfPwd8nzVbZwSkTJJaZ1wxAh1lmNmIjJKfy4VqX1onaiBS4PRftM6Y2tYz9T/hwPU9pnHdq2Gt/SB5VciCO3SNDHRp9Xdzt6px54AWHM/UsymIsrN059/KLPSAZkHmQuoBSiDRjq5kUfsiUn5qewPE8l8N12Pbj/b6vM8OCEvjFuwo9eQXBtLq0tPCwi+qrKHzv88Cayzkg6GiLPmWhK2XG+ZEVt0H+v010pO2xe51BGtDiU3bJPPwxLoRyhYX4eNPY867Do5/oQoqBkNFrDpCVpjFxHkMdpoSt7jNCowQNdGcj9EbcEr3EOfWi627GkUYI4TN8vIFDh6/HgfvbVhBk9mRrWTqRqYvrVkHx2tDcCq8PyI4f738wTA==
X-Microsoft-Exchange-Diagnostics: 1;VE1EUR03HT186;25:PZPpJ2cxv4pn+prLo+KJzKIvVBlrMMCrKKO0hMR7nYb3KB3F+HLMHXEgfQcGGcI/i/ZTHPeTRWmg9M3UbUeKlhMRNLu2Hc2o/MfF5NG0xwP77sm4CzH9ebSuT4EVNhvbPugmv245mphandQ+NCNRHfUXOwRE3gZd9qZbfu7rlIBfmZXXkntMUONt8AOTedjex66Ul/6HqE+bD0xtQ1bg9J1cj2G3DDANAg7JKzg2I5Zo9butEs7IzdQWHtjvvU4BdpJlDL1+qfBEwgnQLHVBBbbK46SrvwYwAXGgKZRQLfCgK7Kx+UPsHXfttBY3QF6mIpPOn4PVcUGYI3tVEWX3k83COvyKgGHHQ1AAMoL1Sn/4oqn7QRiPL/DmuoZsp10mevq37pd7hwPFW2uKSdgJ52gOIh/l+7tCItExqc2zmhtJ+cmAEogRx2e7zqp/axWRs3EbzyFAiyTo0uytwszgPBAV0zJGcx9Gf6NS7qD/Gt/cjryHP1gWg/8IpxF4MvUrIFhDRITZUY8lxyOpnmjoU/8nY5d5lyENTNnp1i7GSpCPoyTYXbgJwaR11y8TbrOY;31:aFwcR80W/PDRIOqtRfuMqokdU6eflAqNkZ3MGVdOYWRXSnHyloLSDzCowY1tYbFWi5jdce8XUqvinQwsCqcltkxH6MY6lNEnDuTSUYzC5K7g+eWkNr01YDk9ujs+uv1DOi/YolIyhUvZSrIqeIfuB3qFIUCSBLArJmyRrO0Rkjgw3YQ6EMKrVsO2ELcslFficYIVewyeTYotN168aGVoXVYHkXpFxVugea/vxP5mvKJzwsN3p+1guYwiITUiUJFFft2Mk5ENKOrujdoT44DWmyRRUUVHKsopxmE6ZRsVKSWUcLPFHLv83BuqQI5ijlPLCRy6DIYn1C4jDskpPkFdsNeGdQ4qTCSWtIimSiJWCgA=
X-MS-Exchange-Organization-AVStamp-Service: 1.0
X-Exchange-Antispam-Report-Test: UriScan:;
X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(444111536)(595095)(102415395)(82015058);SRVR:VE1EUR03HT186;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:VE1EUR03HT186;
X-Microsoft-Exchange-Diagnostics: 1;VE1EUR03HT186;4:h5NTRN45Ad21Ar5PiIOd49eoZF2NDGfX24XvEUeGSvnOZLoWEuw9y2uWn7m6RZv2IjEYYbHg73uIzurVP1pIqOyYwoZu4+buQq7H+p0e6IYFjn6yke33u/YFFUO2Nd/PptbIW5qEmWQX72VxkxU8N9iHsWk8/hrRqRqKf7zVtv66gZGUWegS6EBuodU8oVKkUd64AaqCklbUiRnMKbSvFxYERzTEqPxGvLbIYeKfi6jmzM45FADzCLfYC5C297h5h2osiZa4u46QwACHcJ7cB4rFzM87N001eqprqeoSESWCig3nZNiZt83RQpA9HClcclzqEXIGeCuH5/OhjEez2J4wf+acn6TQl2UIv1JPPxsIBr2O+KeHPe2EpmR4hQNJOi2wO+lxyozBkOVE/TsDLP3nIcDkEKYe7sTZ8zWoIqjhFsvktzP5Xcm4mPVBkHMDZp8xOJEPNE/9uGZpn1Gn2Ujr4tMlRv9G/CVB8+f83MyTPn2e5i8Vl37j9rjFudxGu0/bfxnxiD5qJA+xxdZe+w==;23:voUGSIuk3HMTC4liTrsp86nNxJGa2K5hGjqQYLSarBXUKqGmkEZjNRccKjIS6BgEAp4zsIjhYjsvSYu2Bg66uxU/luQqpMukIPx9ZNazFNLcdGg14ieuh1P64ESuuCqGHKxDFS5qjzXY3dc1mRb/BziVW+MFksYpq1T9w6VbUaI=
X-MS-Exchange-Organization-SCL: 1

[vonpaso xlura]

Thanks, the headers look good. However, the domain is already disabled in the mail server Hosted Email.

[ntm2017]

Omg why didnt I checked first!I just finished the interview. The shipping of items on my expense already raised a red flag so I just had to check. Karen Wilson was the name and when I searched through linkedin..profile looks legit didnt realize that they mightve posted as her.