Too Good to Be True
How a Fake Remote Job Posting Was Exposed Using Only Public Data
DATE RECEIVED
01 / THE SITUATION
A job seeker received an unsolicited email appearing to be from Northway Biotech, a well-known biopharmaceutical Contract Development and Manufacturing Organization (CDMO) based in Waltham, MA and Vilnius, Lithuania. The email claimed their resume had been reviewed from LinkedIn and ZipRecruiter, and invited them to an immediate online interview via Microsoft Teams for a remote Data Entry and Customer Support role.
The email was sent on November 10, 2025 from the address aliciaroberts4121@gmail.com, signed by 'Mrs. Alicia Roberts, Recruitment Team, Northway Biotech,' and directed the recipient to contact an 'Interview Manager' at Adamwyatt.Northwaybiotech@execs.com
Figure 1: Original Scam Email.
02 / THE INVESTIGATION
Tools Used:
Human Firewall EML Analyzer
WHOIS Lookup
ScamAdviser
419scam.org / Spam.org
Google / LinkedIn
03 / RED FLAGS IDENTIFIED
Email header + IP analysis
Domain registration research
Domain trust scoring
Abuse complaint records
Company verification
■ FLAG 1: Gmail Sender for a Corporate Company
Northway Biotech's official domain is @northwaybiotech.com. No legitimate company recruiter sends hiring emails from a personal Gmail account.
■ FLAG 2: Wrong Job Type for the Company
Northway Biotech is a biopharmaceutical CDMO specializing in gene therapy and biologics manufacturing. They hire scientists and engineers, not data entry clerks or customer service representatives.
■ FLAG 3: Suspicious Interview Domain (@execs.com)
The 'Interview Manager' contact used @execs.com. Research revealed this domain has 33 documented abuse complaints on Spam.org, is flagged by ScamAdviser as very low trust, and appears on 419scam.org, a dedicated fraud reporting database.
■ FLAG 4: Microsoft Teams Chat Interview
Scammers favor Teams chat interviews because they are anonymous, unverifiable, and allow them to impersonate anyone without video. Legitimate companies conduct structured video interviews.
■ FLAG 5: Generic 'Dear Applicant' Greeting
No personalization was present in the email. Scam emails are sent in bulk, making personalization impractical for fraudsters.
■ FLAG 6: IP Origin Confirmed via Email Header Analysis
The Human Firewall EML Analyzer extracted the origin IP: 209.85.218.44, geolocated to Mountain View, CA, Google Infrastructure. This is consistent with a Gmail-originated email, not a corporate mail server.
04 / VERDICT
This email is a fraudulent job scam using brand impersonation. The scammer used the name and reputation of a legitimate, established company (Northway Biotech) to create false credibility. The goal is likely to extract personal information, banking details, or equipment purchase scams during the fake onboarding process. No part of this communication originated from the real Northway Biotech organization.
05 / KEY TAKEAWAYS
1. Always verify the sender's email domain. Legitimate companies never recruit from Gmail.
2. Cross-check the job role against the company's actual industry and hiring profile.
3. Run unfamiliar email domains through ScamAdviser or Spam.org before responding.
4. Be skeptical of any interview conducted via chat only. Always request a verified video call.
5. Use email header analysis to identify the true origin of any suspicious message.
Published: February 26, 2026
Research, analysis, findings, and conclusions by Raquel Noz, DSD Intel. This document was formatted with AI writing assistance. All investigative work, source verification, and judgments are solely those of the author.
This case study was produced for educational purposes only. All findings are based on publicly available information. DSD does not perform private investigations or licensed investigative services.
© DSD-DeepSearchDaily • dsdintel.co • All rights reserved.
