THREAT INTELLIGENCE ALERT
The 96-Hour Job Scam
How Fraudsters Built, Deployed & Burned a Fake Company in Under 4 Days
Investigation Report: AlterAlliance Network Solutions | January 2026
THE CRISIS IN NUMBERS
Employment fraud has exploded into a global epidemic. Before diving into this investigation, consider what Canadian job seekers are facing:
- $49M — Lost by Canadians to job scams in 2024
- 276% — Increase in US job scam losses (2023→2024)
- $12.5B — Total fraud losses in US (2024)
- 2,300+ — Canadian victims reported (2024)
- 5-10% — Of incidents actually reported
- $4.8M — Lost in Alberta alone (2024)
REALITY CHECK: The Canadian Anti-Fraud Centre estimates only 5-10% of fraud incidents are reported. The true scale of job scam losses could be 10-20x higher than official figures.
THE STORY BEGINS
It started with a dream job posting. A remote IT support role at $67,000 CAD/year with a legitimate-looking company called "AlterAlliance Network Solutions." For job seekers scrolling through Indeed and DevITJobs, it looked perfect.
Within hours of applying, candidates received professional-looking messages through Indeed's own messaging system—complete with valid email authentication. A contact named "Pierre Lapiper" instructed them to visit an external website and enter a "Registration Token" for their interview.
But something was terribly wrong. The entire operation—from domain registration to abandonment—lasted less than 96 hours.
ATTACK FLOW / KILL CHAIN
- LURE — Fake job on Indeed
- CONTACT — Indeed message
- MIGRATE — Off-platform URL
- TOKEN — "Registration" code
- HARVEST — PII collected
- EXTRACT — Money/Identity theft
ATTACK TIMELINE
The scammers moved with military precision:
- Jan 9, 09:46 UTC — Domain alteralliance.info SSL certificates issued
- Jan 9, 10:49 UTC — Additional certificates from multiple CAs (redundancy planning)
- Jan 9, 14:56 UTC — Scam emails sent via Indeed's authenticated relay
- Jan 10-11 — Active targeting of Canadian IT job seekers
- Jan 12 — Domain status: NXDOMAIN — burned and abandoned
BURN & RUN TACTICS: Modern fraud syndicates operate "disposable infrastructure." Domains are created, weaponized, and abandoned within days to evade detection. By the time security teams investigate, the attackers have already moved to new domains.
FORENSIC EVIDENCE: Certificate Transparency logs revealed 6 SSL certificates issued within 2 hours on January 9, including wildcard coverage (*.alteralliance.info) enabling unlimited subdomain deployment. Multiple issuers (Let's Encrypt, Google Trust Services, Sectigo) indicate deliberate redundancy planning.
EMAIL AUTHENTICATION EXPLOIT
The scam message PASSED all email security checks (DKIM, SPF, DMARC) because it was sent through Indeed's legitimate infrastructure—not spoofed. This represents fraudulent employer account abuse, exploiting platform trust to bypass spam filters and validate the message as "authentic."
THE TRIPLE IMPERSONATION SCHEME
This wasn't a simple phishing attempt. The attackers weaponized the reputations of three legitimate organizations simultaneously:
- AlterAlliance (France) — Domain Squatting: Used .info TLD to mimic legitimate .com domain
- Keel Cottrelle LLP — Phone Number Theft: 905-890-7700 belongs to real law firm—victims calling verify with receptionist
- DLA Piper (Global) — Name Pattern Embedding: "Pierre Lapiper" + email aliases echo "DLA Piper" for false legal authority
RED FLAGS YOU MUST KNOW
HIGH RISK:
- Off-platform registration required
- Domain registered <3 days before contact
- "Interview token" or tracking mechanisms
- "On-site parking" listed for REMOTE job
- Phone number belongs to different company
MEDIUM RISK:
- High salary for entry-level ($67K+)
- Generic IT keywords (Jira, ServiceNow)
- Reply-To differs from From domain
- Pressure to act immediately
- Vague company details/history
HOW TO PROTECT YOURSELF
BEFORE YOU APPLY:
- Research the company on LinkedIn, Glassdoor, and the Better Business Bureau
- Verify the domain age using WHOIS lookup tools (new domains = red flag)
- Search "[company name] + scam" before engaging
- Confirm job postings appear on the company's official website
DURING THE HIRING PROCESS:
- NEVER leave the official job platform for "registration" on external sites
- NEVER provide SIN/SSN, banking info, or government ID before a verified offer
- Request video interviews—scammers avoid face-to-face contact
- Verify phone numbers independently (don't trust numbers in emails)
ABSOLUTE RED LINES:
- You're asked to deposit a check and send money back
- You're asked to pay for equipment, training, or "processing fees"
- The employer communicates only via WhatsApp, Telegram, or Signal
- The job involves receiving/forwarding payments or packages
THE GOLDEN RULE: Legitimate employers NEVER ask you to pay money to get a job. If anyone asks you to spend your own money as part of the hiring process, it is a scam. Period.
IF YOU'VE BEEN TARGETED
- STOP ALL CONTACT with the scammers. Do not respond to further messages.
- CONTACT YOUR BANK immediately if you've shared financial information or deposited checks.
- REPORT TO AUTHORITIES:
- Canada: Canadian Anti-Fraud Centre (antifraudcentre-centreantifraude.ca) — Phone: 1-888-495-8501
- US: FTC (reportfraud.ftc.gov) and FBI IC3 (ic3.gov)
- REPORT ON THE JOB PLATFORM (Indeed, LinkedIn, etc.) to help protect others.
- DOCUMENT EVERYTHING — save emails, screenshots, and any communications.
THE BIGGER PICTURE
This AlterAlliance investigation revealed connections to a parallel "X12 Digital Systems" campaign targeting Western Canada. The same tactics, techniques, and procedures (TTPs) indicate an organized criminal syndicate using a "factory model" of fraud—deploying multiple shell companies across geographic regions to maximize victim yield while evading detection.
| Attribute | AlterAlliance | X12 Digital Systems |
|---|---|---|
| Target Region | Eastern Canada (Montréal) | Western Canada (Calgary) |
| Infrastructure Status | NXDOMAIN (Burned) | Active (Cloudflare) |
| Advanced Tactic | Token System + Indeed Relay | QR Code Gate (Quishing) |
FINANCIAL ENDGAME ANALYSIS
Based on the role profile and observed tactics, three primary fraud vectors are identified:
- FAKE CHECK SCHEME (Highest Probability) — Victim receives $2K-$5K check for "equipment," instructed to buy from scammer-controlled vendor. Check bounces, victim loses real money.
- IDENTITY THEFT ("Fullz" Harvesting) — Interview portal collects DOB, SIN/SSN, banking info. Complete identity packages sold on dark web for credit fraud.
- RECOVERY TRAP (Secondary Scam) — Victims added to "sucker lists." Later contacted by fake "fraud investigators" offering to recover funds for upfront fees.
The scammers exploit economic anxiety. Alberta alone has seen job scam losses increase more than tenfold—from $440,000 in 2022 to $4.8 million in 2024—during a period of record population growth and rising unemployment.
THE BOTTOM LINE: Job scam reports have tripled since 2020. Losses have quadrupled. Only 5-10% of incidents are reported. You are the best defense against employment fraud.
RESOURCES & REPORTING
CANADA:
- Canadian Anti-Fraud Centre: antifraudcentre-centreantifraude.ca — Phone: 1-888-495-8501
UNITED STATES:
- FTC: reportfraud.ftc.gov
- FBI IC3: ic3.gov
- Better Business Bureau: bbb.org
Share this report to protect others. Employment fraud thrives in silence.
Originally published on LinkedIn by Ross Moravec.
Written by Ross Moravec, founder of Nonprofit Tech Support.