Fake job offer: tradeconstruction.co.uk, spoofing the legitimate Trade Construction Company LLC

This fake job offer claimed to be from a UK-based company called Trade Construction Company LLC using a website at tradeconstruction.co.uk. However, no such company exists in the UK, and this is a rip-off of a wholly legitimate US firm that is actually called Trade Construction Company LLC who are not involved in this scam at all.

From:    JOB ALERT [klakogroups@gmail.com]
Reply-To:    klakogroups@gmail.com
To:    Recipients [klakogroups@gmail.com]
Date:    27 February 2015 at 18:37
Subject:    NEW JOB VACANCIES IN LONDON.

Trade Construction Company,
L.L.C,
70 Gracechurch Street.
EC3V 0XL, London. UK

We require the services of devoted and hardworking workers, who are ready to work after undergoing enlistment training. in all sectors
as The Trade Construction Company Management intends to increase its man power base due to increasing number of customers and contract in the Company.


Available Positions

QUANTITY SURVEY, HEALTH EDUCATOR,CIVIL ENGINEER, FIELD SURVEY SUPERVISION, WELDER,MACHINES SUPERVISOR, MECHINARY OPERATOR,
CHEMICAL ENGINEER, AUTOMOTIVE MECHANIC, DESK OFFICER, ELECTRICAL ENGINEER, CONFERENCE & BANQUETING OPERATIONS MANAGER,
STORE KEEPER,ACCOUNT MANAGER, CASHIER, ASSISTANT MANAGER OF FRONT OFFICE, RECEPTIONIST, CLEANER, FOREIGN/INTERNATIONAL LANGUAGE INTERPRETERS,
MARKETING ASSISTANT, COMPUTER OPERATOR, INTERNET SERVICE EXPERT, SECURITY PERSONNEL, HR ASSISTANT,

The Company Management would be responsible to pay for your Flight Ticket and Accommodation.

All other information about benefits which would be received by new employees would be given in their application process.

So if interested, kindly send your CV/Resume via email to recruitment@tradeconstruction.co.uk



You can also apply directly at.

http://www.tradeconstruction.co.uk/apply_online.html
website: http://www.tradeconstruction.co.uk
Phone: +447990402584

   
The tradeconstruction.co.uk site is almost a bit-by-bit copy of the genuine tradeconstruction.com website.

The difference in content is minimal, but the fake site contains the following contact details:

Office Address:
TRADE Company House
70 Gracechurch Street London
EC3V 0XL
United Kingdom
Phone: +447990402584

Shop Addresses:
Office 208
3 Brindley Place
Birmingham, West Midlands
B1 2JB
United Kingdom
Fax: 225-658-8067 

These are actually the contact details for XL Insurance, who are obviously completely unconnected to this scam.

The fax number is invalid for the UK, and is actually just copied-and-pasted from the genuine site. The telephone number +447990402584  (07990 402584) is valid for the UK but it's a mobile phone number (possibly an untraceable prepay handset) so it could be anywhere.

As I said before, there is no company in the UK called Trade Construction Company and "LLC" is not a recognised type of UK company (typically they would be "Ltd", "PLC" or "LLP").

The WHOIS details for the domain are incomplete and unverified:

Domain name:
        tradeconstruction.co.uk

    Registrant:
        tradeconstruction

    Registrant type:
        Unknown

    Registrant's address:
        SOUTH ROAD
        ERDINTON
        BIRMINGHAM
        Birmingham
        B23 6EL
        United Kingdom

    Data validation:
        Registrant name and address awaiting validation

This is a residential area of Birmingham in the UK, but there is no house number and "Erdington" is spelled incorrectly. It certainly doesn't match the other contact addresses given.

Let's have a look at the mail headers to see if we can determine where this email actually came from.

Received: from mx.giki.edu.pk (mx.giki.edu.pk [121.52.146.229])
    by [redacted] (Postfix) with ESMTP id 91B60ED199
    for [redacted]; Sat, 28 Feb 2015 06:29:19 +0000 (UTC)
X-ASG-Debug-ID: 1425104952-04b09a633509b40001-Ozk3QL
Received: from mail.giki.edu.pk (mail.giki.edu.pk [121.52.146.226]) by mx.giki.edu.pk with ESMTP id 6NnzvLRyt5l62CxM; Sat, 28 Feb 2015 11:29:12 +0500 (PKT)
X-Barracuda-Envelope-From: klakogroups@gmail.com
X-Barracuda-Apparent-Source-IP: 121.52.146.226
Received: from localhost (localhost.localdomain [127.0.0.1])
    by mail.giki.edu.pk (Postfix) with ESMTP id 1127A11414ED;
    Sat, 28 Feb 2015 06:42:31 +0500 (PKT)
Received: from mail.giki.edu.pk ([127.0.0.1])
    by localhost (mail.giki.edu.pk [127.0.0.1]) (amavisd-new, port 10032)
    with ESMTP id m27tNjcw-XxF; Sat, 28 Feb 2015 06:42:30 +0500 (PKT)
Received: from localhost (localhost.localdomain [127.0.0.1])
    by mail.giki.edu.pk (Postfix) with ESMTP id 9E5A111414D7;
    Sat, 28 Feb 2015 06:42:30 +0500 (PKT)
X-Virus-Scanned: amavisd-new at mail.giki.edu.pk
Received: from mail.giki.edu.pk ([127.0.0.1])
    by localhost (mail.giki.edu.pk [127.0.0.1]) (amavisd-new, port 10026)
    with ESMTP id n3YhjtqX2niQ; Sat, 28 Feb 2015 06:42:30 +0500 (PKT)
Received: from [172.245.45.23] (unknown [172.245.45.23])
    by mail.giki.edu.pk (Postfix) with ESMTPSA id 214E611414ED;
    Sat, 28 Feb 2015 06:42:23 +0500 (PKT)

We can definitely say that this email spent a while bouncing around the Ghulam Ishaq Khan Institute of Engineering Sciences and Technology in Pakistan. It appears that it originated from a server at 172.245.45.23 which is a ColoCrossing IP suballocated to:

NetRange:       172.245.45.0 - 172.245.45.31
CIDR:           172.245.45.0/27
NetName:        CC-172-245-45-0-27
NetHandle:      NET-172-245-45-0-1
Parent:         CC-14 (NET-172-245-0-0-1)
NetType:        Reallocated
OriginAS:       AS36352
Organization:   naa (NAA-21)
RegDate:        2013-06-07
Updated:        2013-06-07
Ref:            http://whois.arin.net/rest/net/NET-172-245-45-0-1

OrgName:        naa
OrgId:          NAA-21
Address:        530 W. 6th Street Suite 901
City:           Los Angeles
StateProv:      CA
PostalCode:     90014
Country:        US
RegDate:        2013-06-07
Updated:        2013-06-07
Ref:            http://whois.arin.net/rest/org/NAA-21

OrgAbuseHandle: BRBA-ARIN
OrgAbuseName:   Baker, Rusdi bin abu
OrgAbusePhone:  +1-940-238-5499
OrgAbuseEmail:  rusdi.bin.abu.bakar@gmail.com
OrgAbuseRef:    http://whois.arin.net/rest/poc/BRBA-ARIN

OrgTechHandle: BRBA-ARIN
OrgTechName:   Baker, Rusdi bin abu
OrgTechPhone:  +1-940-238-5499
OrgTechEmail:  rusdi.bin.abu.bakar@gmail.com
OrgTechRef:    http://whois.arin.net/rest/poc/BRBA-ARIN

Note that this isn't saying that this "Rusdi bin abu Bakar" is sending the email, but a customer of theirs is.

Nothing about this job offer is legitimate. It does not come from who it appears to come from and should be considered to be a scam, and avoided.