How Legitimate Platforms Enable Job Scams: The CEIPAL/Micro1 Pipeline

The email arrives from notifications@ceipalmail.com. SPF passes. DKIM passes. DMARC passes. Your spam filter sees a legitimate message from a trusted applicant tracking system used by thousands of staffing agencies worldwide.

But the "staffing agency" behind the email is a shell company. The job doesn't exist as described. And the real destination is an AI data annotation platform where your technical skills, biometric data, and personal information become the product.

This investigation examines a three-stage scam pipeline that weaponizes legitimate business infrastructure to bypass every email security control you have in place.

The Three Actors

1. CEIPAL ATS — The Unwitting Weapon

CEIPAL is a legitimate, cloud-based applicant tracking system headquartered in Rochester, NY. It serves thousands of staffing agencies with email campaigns, resume parsing, and candidate management. CEIPAL is not a scam operation — it is a victim of platform abuse.

Because CEIPAL sends emails from its own mail servers, every message carries valid SPF and DKIM signatures for ceipalmail.com. Any tenant — legitimate or fraudulent — inherits this trusted sender reputation.

2. Crossing Hurdles — The Shell Company

"Crossing Hurdles" is the named employer in the outreach emails. It exhibits every indicator of a purpose-built front company: minimal corporate registry footprint, no verifiable web presence, no identifiable leadership, and no function beyond serving as a pass-through in the scam pipeline.

3. Micro1 — The Bait-and-Switch Destination

Micro1 presents as an AI career platform. Candidates recruited for software engineering, data science, or other technical roles are redirected to AI data annotation and labeling tasks — work that bears no resemblance to the original job description.

The Six-Step Scam Workflow

Step 1: LinkedIn Targeting
  Operators identify candidates via LinkedIn, scraping, or data broker lists
      |
Step 2: CEIPAL Email Outreach
  Automated emails sent via CEIPAL ATS
  SPF/DKIM: PASS (legitimate infrastructure)
      |
Step 3: Candidate Engagement
  Communication moves to WhatsApp (no corporate paper trail)
      |
Step 4: Shell Company Processing
  "Crossing Hurdles" conducts preliminary screening to build trust
      |
Step 5: Redirect to Micro1
  Original job description is abandoned
      |
Step 6: Bait-and-Switch
  Candidate presented with AI annotation tasks, not the advertised role
  Video interviews harvest biometric data
  Technical assessments harvest intellectual property

Why This Bypasses Email Security

This is the same pattern documented in our AlterAlliance investigation, where scammers abused Indeed's email infrastructure. The fundamental exploit is identical:

Attribute	Indeed Abuse (P307)	CEIPAL Abuse (P314)
Legitimate platform	Indeed	CEIPAL ATS
Sending domain	`@indeedemail.com`	`@ceipalmail.com`
SPF/DKIM status	Pass	Pass
Abuse method	Scam postings via employer accounts	Scam outreach via tenant accounts
Shell entity	AlterAlliance, X12 Digital	Crossing Hurdles
Contact channel	External portals	WhatsApp

The platform is not complicit. It is being exploited. But the result is the same: scam emails that look legitimate because they are technically legitimate — sent from real infrastructure with valid authentication.

Risks to Victims

Risk	Severity	Description
Intellectual property theft	High	Technical assessments harvested for commercial use without compensation
Biometric harvesting	High	Video interviews capture facial geometry, voice prints, behavioral biometrics
Personal data collection	High	Resumes, identity documents, employment history aggregated and potentially sold
Reputation contamination	Medium	Association with flagged entities may damage professional profiles
Labor exploitation	Medium	AI annotation tasks may be uncompensated under the guise of "trials"

Detection Indicators

No single indicator is conclusive. Flag emails from CEIPAL infrastructure when multiple of these signals co-occur:

Broad salary ranges with no justification (e.g., "$80,000 - $150,000")
No named recruiter — email doesn't identify a specific person with direct contact
WhatsApp-only communication — sole channel offered is WhatsApp, not corporate email
Generic job descriptions lacking specific technical requirements or team details
Shell company name — the "agency" returns zero results in corporate registries or LinkedIn
No company website or LinkedIn page for the purported agency
Urgency language — "immediate start," "urgent hiring," "limited positions"
Role mismatch — recruited for one role, redirected to different work

What Can Be Done

For job seekers:

Verify any staffing agency independently before engaging — check corporate registries, LinkedIn, and web presence
Treat WhatsApp as a sole communication channel as a red flag
If a role changes description mid-process, disengage immediately
Never submit technical assessments or video interviews without verifying the employer

For platform operators:

Implement tenant verification before granting email campaign capabilities
Monitor for high-volume outreach from newly created tenant accounts
Provide abuse reporting channels and act on reports promptly

For organizations:

Deploy detection signatures for CEIPAL-originated emails exhibiting multiple risk indicators
Educate employees and candidates about platform abuse patterns
Report abuse to CEIPAL's support team with full evidence packages

Based on the defensive forensic investigation. CEIPAL is a legitimate platform — this analysis distinguishes between the provider (not at fault) and the tenant abusing it.

Written by Ross Moravec, founder of Nonprofit Tech Support.

← All posts