An unsolicited job offer for an "IT Operations Coordinator" at $62,306.74 CAD/year. A company called TsunadeQ Systems Inc. claiming offices in Edmonton's Manulife Place. An "online interview" portal at interview365.net. Every element looked plausible at first glance — and every element was fabricated.
This investigation documents the forensic deconstruction of a phantom firm: a synthetic corporate identity engineered to exploit job seekers through credential harvesting and identity theft.
The Name Gives It Away
"Tsunade" is a central character in the Naruto anime franchise — the Fifth Hokage, a figure of authority. The "Q" suffix is affix padding to bypass domain availability. No legitimate Canadian systems integrator names itself after a copyrighted anime character. This naming pattern is common in low-to-mid-tier cybercrime communities.
Corporate Registry: Complete Absence
| Verification Point | Expected | Found |
|---|---|---|
| Alberta Corporate Registry | Present | ABSENT |
| Alberta King's Printer | Present | ABSENT |
| Municipal Business License | Present | ABSENT |
| GST/HST Registration | Present | ABSENT |
TsunadeQ Systems exists only as a "digital ghost" — visible on unregulated job boards but vanishing under any legal scrutiny.
Geographic Impossibility
The listing claims operations in High Level, Alberta (population ~3,000, 733 km north of Edmonton) and simultaneously claims tenancy at Manulife Place in downtown Edmonton. Hidden metadata in an Adzuna listing reveals a third location: Irving, Texas (ZIP 75038) — residue from a scraped US job posting the scammers failed to sanitize.
Manulife Place's tenant directory does not list TsunadeQ. Verified tenants like Xenali and XGen Studios appear with suite numbers. Vacant units are explicitly listed. TsunadeQ is nowhere.
The $62,306.74 Tell
No hiring manager sets a salary of "$62,306 and 74 cents." Legitimate salaries use round figures: $60,000, $62,500, $65,000.
Reverse-engineering the number reveals an automated currency conversion:
- Base salary (USD): $45,000
- Exchange rate: ~1.38459 CAD/USD
- Calculation: $45,000 x 1.38459 = ~$62,306
The two-decimal precision is a definitive marker of machine calculation — and a red flag visible to anyone who knows what to look for.
The Phishing Infrastructure
The domain interview365.net was registered on January 13, 2026 — one day before the scam emails went out — through Spaceship Inc. with Cloudflare nameservers. Six SSL certificates were provisioned within hours, from three different certificate authorities (Let's Encrypt, Google Trust Services, Sectigo).
The domain mimics Microsoft 365 branding ("interview" + "365" + ".net"). When accessed from a mobile device, it redirects via HTTP 302 to sourceplatform.org — the same scam portal documented in our X12 Digital Systems investigation. Desktop browsers receive a different response, a known anti-analysis tactic to frustrate security researchers.
The phishing workflow: credential harvesting through fake registration, automated chatbot "interviews" (allowing one scammer to process hundreds of victims simultaneously), and potential malware delivery through fake "Zoom invitations."
The Bot Behind the Curtain
The contact email logw82357@tsunadeq.com reveals a bot-generated username — no legitimate IT department provisions accounts as random alphanumeric strings. The mail infrastructure runs on Alibaba Cloud (47.242.207.104) with SPF configured but no DMARC — another indicator of hastily deployed spam infrastructure.
Connected Scam Infrastructure
This investigation confirmed a direct infrastructure link:
TsunadeQ → interview365.net → sourceplatform.org
The same sourceplatform.org platform serves the X12 Digital Systems campaign and the AlterAlliance operation, confirming an organized syndicate operating multiple phantom firms through shared backend infrastructure.
Detection Indicators
HIGH CONFIDENCE Red Flags:
- Company name derived from anime/gaming character
- No corporate registry records in any jurisdiction
- Salary with unusual decimal precision (e.g., $XX,XXX.74)
- Geographic impossibility — simultaneous presence in incompatible locations
- Bot-generated email usernames (random alphanumeric strings)
- Interview portal domain registered within days of outreach
- Redirect to known scam infrastructure
MEDIUM CONFIDENCE Red Flags:
- Domain mimicking established software brands (Microsoft 365)
- Job description plagiarized from legitimate postings (BMC Software)
- Keyword stuffing across multiple technology stacks
- Senior responsibilities under junior title (Manager duties, Coordinator title)
How to Protect Yourself
- Verify the company in your province's corporate registry before engaging
- Check the salary — precision to the cent is a machine artifact
- Verify physical addresses through tenant directories or Google Street View
- Check domain age — legitimate companies don't register domains the day before contacting you
- Never register on external "interview portals" — legitimate employers use established platforms
If You've Been Targeted
- Stop all contact with the personas immediately
- Do not access interview365.net or any linked domains — run a full anti-malware scan if you have
- Report listings on Indeed, Adzuna, and DevITjobs as fraud
- Contact the Canadian Anti-Fraud Centre: 1-888-495-8501
Based on forensic investigation TQ-INT-365-2026. The entity "TsunadeQ Systems" is a confirmed fraudulent construct — it does not exist as a legitimate commercial entity.
Written by Ross Moravec, founder of Nonprofit Tech Support.