A scammer calling from Essential Services Worldwide, matches an LLC based in Wilmington, Delaware. Do not give these people any of your financial information.The IP for this website, 220.127.116.11, resolves to a number of other domains offering similar type services for AOL, Hotmail, and PCs. At least one of these websites was also found to host a malicious executable. freepccleandownload[.]com is one site that was found hosting a PE that is detected as adware by 17/55 AV engines on VirusTotal.
According to corporatdir.com, the man behind essentialservices[.]in appears to be Sharad Goel. He is listed as the registrant of the website as well as a managing director for the company. In addition, his name is attached, via his username sharadmcp2003, to most of the recruitment posts on the website. Furthermore, Sharad Goel or essentialservices[.]in is named as the registrant for several of the other domains resolving to 18.104.22.168.
Digging a bit more, we found a mouthshut.com profile for Sharad Goel who appears to be 32 and based in New Dehli. We also found a LinkedIn profile for Sharad and it appears he was educated at St. Mary's Sr. Sec. School in Uttarakhand. His work experience includes sales and telemarketing in SecPoint, a Danish IT and security company. He has been director of Essential Services since 2011 and works in another recruitment outfit as well called SMS Consultancy.
Farman Anees, located in New Dehli with phone number 91-991-028-2896
and email firstname.lastname@example.org. A LinkedIn page for Farman Anees lists him as an HR manager for Essential Services since February 2015. In addition, a post recruiting for a technical support position at Essential Services on Indian networking site beBee lists his email and phone number for points of coAfter establishing the New Delhi-based infrastructure of the scam, we also identified a U.S.-based individual who appears to act as money handler for the operationntact.
A search of the payment address that macinscan[.]org directed us to—4630 Border Village Road Suite N1497, San Ysidro, CA, 92173—matches a WHOIS registrant address for the website tesserboigltd[.]com. The registrant's name is Sergio I. Cortes Jr., his email email@example.com, and his organization is called "Tesser Enterprises."
Tesser Enterprises, Citibank, 322271724, Account Number, 205862568, address: 352 H Street Chula Vista, CA 01910 Tesser Enterprises, Citibank, 322271724, Account Number, 205862568, address: 352 H Street Chula Vista, CA 01910
In addition, firstname.lastname@example.org is listed as a PayPal address.
email@example.com Both Sharad Goel and Sergio I. Cortes Jr.