Scam Spotting: too-good job offer, fake website, and Bitcoins

A redditor recently posted on /r/scams about a too-good-to-be-true job offer:

Hi all, I was hoping you could help me figure if this job offer is a scam. So I received an email saying that I had applied for customer service representative at another company, that was an agency they work with (note I did apply to this), and that they believe me to be better suited for a better job. The HR rep who contacted me said she's confident I stand a chance, and so she wants to forward my application to the hiring manager. The company is currently based on switzerland, and they are opening an office in my area (Toronto Canada) on May 30th. All she requested was that I fill out the employment application. There was nothing weird about the application, it asked for my usual contact info and two work references. No sin number or anything private, or that they couldn't get off my resume. The reason I'm weirded out is because the pay is substantial (for reference it's +20/hr and i'm still in school) and they mentioned the company works with bitcoin. The company name is Trimension Capital Holding. Does anybody have any experience that they'd be willing to share on if this is a scam or not?

This already has a couple red flags

• Based in Switzerland, but opening an office in Toronto
• Over $20 per hour for someone not yet out of school
• Encouraged to apply even if not certain qualified (to do what, exactly?)
• It involves "Bitcoins"

MoneyHouse.ch says the website should be trimension-capital.com

Something is very fishy here. Let's check DNS at WHO.IS



The one with the dash says...

Domain Name: TRIMENSION-CAPITAL.COM
Registry Domain ID: 1784370897_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.1api.net
Registrar URL: http://www.1api.net
Updated Date: 2013-10-16T09:54:53Z
Creation Date: 2013-03-05T13:17:31Z
Registrar Registration Expiration Date: 2017-03-05T13:17:31Z
Registrar: 1API GmbH
Registrar IANA ID: 1387
Registrar Abuse Contact Email: @1api.net
Registrar Abuse Contact Phone: +49.68416984x200
Reseller: Timewarp IT Consulting GmbH http://netmonic.com
Domain Status: ok - http://www.icann.org/epp#OK
Registry Registrant ID: 
Registrant Name: Thomas Bieri
Registrant Organization: Trimension Capital GmbH
Registrant Street: Baarerstrasse 135
Registrant City: Zug
Registrant State/Province: Switzerland
Registrant Postal Code: 6301
Registrant Country: CH
Registrant Phone: +41.417660800
Registrant Phone Ext: 
Registrant Fax: 
Registrant Fax Ext: 
Registrant Email: @trimension-capital.com

Everything matches, headed by Thomas Bieri, right address, right country.

Okay, how about the one without the dash?

Domain Name: TRIMENSIONCAPITAL.COM
Registry Domain ID: 2022941624_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.publicdomainregistry.com
Registrar URL: www.publicdomainregistry.com
Updated Date: 2016-04-20T15:33:24Z
Creation Date: 2016-04-20T15:33:22Z
Registrar Registration Expiration Date: 2017-04-20T15:33:22Z
Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com
Registrar IANA ID: 303
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Registry Registrant ID: 
Registrant Name: Domain Admin
Registrant Organization: Privacy Protection Service INC d/b/a PrivacyProtect.org
Registrant Street: C/O ID#10760, PO Box 16 Note - Visit PrivacyProtect.org to contact the domain owner/operator Note - Visit PrivacyProtect.org to contact the domain owner/operator  

WTF?! This domain was registered LESS THAN A MONTH AGO! (APR-20-2016) and it's got hidden registration. Why?

Let's check the websites.

http://trimension-capital.com/  got me a DNS not resolved.

http://www.trimension-capital.com/  got me a "default webpage", no content setup yet.

http://trimensioncapital.com did get me a webpage... a pretty slick one, in fact.  But why would a company based in Switzerland use NEW YORK skyline as a backdrop? The MetLife and Empire State Buildings, plus other New York landmarks are easily recognizable.

A company based in Switzerland, using NEW YORK skyline as backdrop?

Quick googling of the initial verbiage shows that it was cribbed from a different financial service website.

This is the clone... Note the ungrammatical Holding' (no S)

This is the original, which has no errors. The one with the error is obviously the copy

Ah, but you say, why can't the Trimension be the original? Because Trimension made a mistake when doing that "signature" verbiage. It's nonsensical.

Furthermore, Trimension went on to clone someone else's website for a different section, and that left us with a non-sensical sentence. They are proud of keeping a client for only three years?

Proud of keeping a client for merely 3 years?

Yet the non-sensical sentence makes a lot more sense, when you realized it was copied from yet ANOTHER website... and the original sentence said 20 years.

Now 20 years makes much more sense.

But the real smoking gun is when they got too clever...  This was supposed to be Trimension's top echelon...

Trimension's supposed top echelon

So why is the first photo a mirror flipped version of William E. Ford?

Wikipedia on William E. Ford

In fact, the entire "staff" here seem to be cloned from General Atlantic, and flipped.

"Dirk Kaufer" is actually Thomas Murphy

"Ralph Adenauer" is actually Martin Escobari

"Curt Arnold" is actually Joern Nikolay

And so on and so forth. Everybody at General Atlantic got cloned, image flipped, and renamed with new positions. Why image flip? Google Image search doesn't work on mirrored images. It will report the two pictures do not match if one is mirror of the other. I've seen this tactic before.

So the job offer cannot be real, as the company may be real, but the offer is obviously fake, issued by the clone.