The Job Portal Was Three Weeks Old

The Pattern

The message arrived as a job offer. The job did not arrive with it.

It had a title. It had a salary schedule. It had a training session and a private worker portal. It borrowed the names of real businesses. It answered questions with enough detail to resemble an employer from across a dim room.

The structure mattered more than the details. An unknown recruiter offered unusually high pay for simple online work. The work involved boosting products through repeated clicks. The portal displayed commissions. The recruiter supplied an invitation code and remained close enough to guide every step.

This is a task scam.

The Federal Trade Commission uses that name for schemes that present simple online actions as paid work. The screen shows earnings. The numbers rise. Then the platform requires the worker to deposit real money to continue tasks or withdraw the balance. The earnings were never real. The deposit is the product.

A note about the source material

This article is based on documented messages and direct technical inspection of two recruitment portals. The dialogue below is a reconstructed composite. Names, dates, pay figures, personal circumstances, wording, and the order of events have been changed. Invitation codes and phone numbers have been omitted.

The domain records and technical findings remain exact. The reconstruction protects the recipient without giving the mechanism a fake mustache.

The reconstructed pitch

Recruiter: A hiring contact recommended you for flexible remote marketing work. It takes about an hour each day.

Candidate: What would I be doing, and where is the official job listing?

Recruiter: You help partner products gain visibility through daily optimization tasks. There is a guaranteed salary plus commissions that can be withdrawn immediately.

Candidate: Is the registration portal part of the company website?

Recruiter: The public site is for customers. The other site is the internal worker system. Registration takes two minutes and requires no identification.

Candidate: Will there be an interview or an employment agreement?

Recruiter: Training is the interview. Create a new account with my code and send a screenshot when you are inside.

None of those lines needs to be identical to work. The script is modular. Company names, salaries, contacts, and portal addresses can be replaced. The pressure system stays fixed. It is less a conversation than a vending machine with typing indicators.

The recipient tested that machine. Obvious contradictions were introduced. An emotionally significant interruption was placed directly in its path. A human recruiter would have paused. This one stepped over both and returned to the next salary paragraph. The script had somewhere to be.

The contradiction in the domain record

One recruiter claimed months of personal experience with an internal platform. The platform’s domain had existed for less than a month. The employee had achieved seniority before the website achieved a birthday.

Verisign’s registration records show that agencylovepdo.com was created on June 7, 2026. The second portal, smithbrothersmediappc.com, was created on June 25, 2026. During the June 28 and 29 recruitment exchange, one was about three weeks old and the other was four days old.

The recruiter also changed the represented company while keeping the same job structure. A real employer does not become another employer overnight while preserving the same recruiter, compensation ladder, training ritual, and account system. That is not a reorganization. It is a costume change.

There are legitimate businesses using the names Agency Love and Smith Brothers Media. Their public sites use agencylove.com and smithbrothersmedia.com.au. No public evidence connected either business to the recruitment portals. The most supportable conclusion is brand impersonation, not misconduct by the legitimate companies.

What the portal revealed

The second portal presented a minimal application shell rather than a normal careers or employee system. Inspection of its public interface, APIs, and client-side code found repeated references to:

▌ tasks

▌ commissions

▌ wallets

▌ deposits

▌ withdrawals

▌ cryptocurrency

▌ recharging

Those terms describe the financial machinery the recruiter had not yet disclosed. The job description had apparently fallen into the wallet.

Employees receive wages from employers. They do not recharge employer systems with personal funds. When payroll runs in the opposite direction, the employee has been quietly promoted to customer.

The recruiter also said registration required no personal information. The registration form asked for a phone number, login password, separate payment password, gender, invitation code, and acceptance of the site’s terms and privacy policy. Apparently a phone number becomes nonpersonal when placed beside a sufficiently cheerful logo.

Forensic update: the wallet was the job

The strongest finding is not the portal’s age, copied branding, or suspicious vocabulary. It is the transaction machinery.

The Smith Brothers Media impersonation exposed a public withdrawal configuration with Web3 approval enabled. Four withdrawal options were labeled Bitcoin, USDC ERC-20, USDC Arbitrum, and USDT TRC-20. All four actually pointed to Ethereum mainnet, Circle’s official Ethereum USDC contract, the same spender address, and the same approval amount.

That is not four payment networks. It is one USDC permission wearing four hats.

The site’s JavaScript then did the following:

1. Requested the visitor’s Ethereum wallet account.
2. Switched the wallet to Ethereum mainnet.
3. Constructed an EIP-2612 Permit naming the visitor as owner and the site-configured address as spender.
4. Set a one-hour signing deadline and an allowance derived from the site’s public approveAmount value.
5. Asked the wallet to sign the typed permit.
6. Sent the signature components and permit data to the portal’s backend.

A permit signature is not merely a login or proof that a wallet exists. It can authorize a spender to move tokens from the owner’s wallet. The configured amount resolves to 100,000,000,000,000 USDC, or 100 trillion USDC, because USDC uses six decimal places.

The interface did not need the visitor to own 100 trillion USDC. The oversized allowance meant the configured spender could take whatever official USDC arrived later, up to that ceiling, unless the permission was revoked.

The blockchain confirms the pull mechanism was used

I audited every distinct spender address exposed by the live members of the 75-hostname set. To avoid counting token spam as theft, a transfer was included only when all of these conditions were true:

▌ The token was Circle’s official Ethereum USDC contract.

▌ The enclosing transaction was sent by the exact spender address found in the portal configuration.

▌ The transaction was sent to the official USDC contract.

▌ Its function selector was 0x23b872dd, which is transferFrom(address,address,uint256).

▌ The transaction receipt showed success.

Across the latest 100 token operations returned for each of seven spenders, six spenders had executed 39 verified pulls from 22 source wallets totaling at least $660,427.159954 USDC. The history window is limited, so this is a lower bound, not a lifetime estimate.

The spender used by the Smith portal and the Agency Love impersonation accounted for eight pulls totaling $71,581.13. They included one pull for $30,076, one for $19,799.13, one for $1,899, and five pulls from a fourth wallet totaling $19,807.

The four source wallets still showed allowances equal to 100 trillion USDC minus the amounts pulled from them. That remainder is the fingerprint left by the site’s configured ceiling. At the time of inspection, the spender retained only 0.010797 official USDC. Most of the money had moved onward.

The complete wallet audit includes the full spender addresses, transaction hashes, source addresses, amounts, timestamps, selectors, balances, and methodology. It excludes lookalike tokens with Unicode names, zero-value dust, and address-poisoning transfers. Blockchain spam brought props. It did not make the cast list.

The certificates prove impersonation, not employment

The Smith portal served an image of a genuine Australian company registration document for SMITH BROTHERS MEDIA PTY LTD. The Australian Business Register confirms that the legitimate company exists and has been active since 2012.

That does not connect the portal to the company. Anyone who can download a public document can put it behind a menu item. A real registration document proves a company exists. It does not prove the person displaying it works there.

The Agency Love impersonation was sloppier. Its certificate named LOVE AGENCY, SIREN 537 995 912. The French public record shows that company was removed from the register in September 2013. It is not evidence that the current, legitimate Agency LOVE authorized a 2026 task portal.

The portals borrowed corporate existence the way the recruiter borrowed a referral: enough truth to make the next false step feel administrative.

The same system wore at least 75 hostnames

The two recruitment portals were not isolated builds. Their interfaces exposed the same route structure, task terminology, VIP ladders, API shapes, and wallet settings. Some served the same multi-megabyte JavaScript bundle byte for byte. Backend level records began in November 2023, years before the two recruitment domains were registered, showing that the system underneath the branding was older than its current costumes.

To map the surrounding infrastructure, I searched URLScan for pages that had loaded assets from the same Aliyun object-storage hostname used by the portals. That produced 75 distinct hostnames observed in 99 scans from December 19, 2025 through July 12, 2026. I then checked all 75 for DNS, RDAP, HTTPS behavior, public task-platform APIs, wallet settings, certificates, policies, and JavaScript.

One shared image bucket is not proof of one operator. Templates, developers, and hosting providers can be shared. The classifications below therefore depend on live evidence, and the weakest group is explicitly not called confirmed.

The final pass found:

The 18 live platforms are the supportable core. The other 57 are leads and historical infrastructure, not 57 additional accusations. Several had no current DNS, several timed out, and seven resolved to 0.0.0.17, which may reflect blocking or sinkholing. A dead portal does not become innocent, but it also does not become inspectable.

Confirmed permit-enabled clones

smithbrothersmediappc.com, whrmarketingdata.com, whrmarketingdata.info, xplorapdo.com

Wallet-enabled task-scam clones

3hiplus.com, alphazeta-managementppc.com, alphazeta-managementppc.net, anti-hex.com, asoitisapps.com, asoitisapps.info, steadfastdigitalpdo.org, work.bmgmusicppc.com, work.pasteppc.com, xumulusdata.info

Live task platforms with Web3 disabled during inspection

actionaso.com, brown-forman-boost.org, cambrexdata.com, work.republicsub.com

Historical or unreachable members of the 75-hostname set

3h-i-ppc.com, 3h-i-pro.com, 4imediappc.com, addsearchhex.com, aliexpresshex.com, appierhub.com, bellavixhex.com, bellavixppc.com, berkleetop.com, cambrexpdo.info, cazbahtop.com, codelessdata.com, commercehex.com, duffypro.com, emarketingchampsdata.com, emarketingchampsppc.com, embacytop.com, eskyportal.com, exploreaso.com, exterboost.net, flyflightmodetop.com, foxtailgrowthtop.com, gatorworksppc.com, global.downtowntop.com, icepophex.com, icepoptop.com, ipromoteutop.com, lionsgatehex.com, lionsgateppc.com, marsatworkppc.com, musemindppc.org, olifantdigitalpdo.com, olifantdigitalpdo.org, overtureboost.com, overturepromotionsppc.com, perexpressionpdo.org, powercoboost.com, powercocc.org, pureidata.com, pureitop.com, revwisepdo.com, robynandrobyntop.com, seoclaritypro.com, three29pro.com, topvanguard.com, vantecmarketinghex.com, vantecmarketingtop.com, work.hudsonintegratedhex.com, work.ranqhex.com, work.visorait.com, work.wallophex.com, work.winwithoptimaldata.com, www.4imediappc.com, www.lionsgateboost.com, www.simplimkt.com, www.steadfastdigitalboost.com, xumulusdata.com

The Agency Love impersonation sits outside this 75-hostname URLScan result, but direct inspection connected it to the Smith portal through the same 72 client routes, assets, task configuration, spender address, and SaleSmartly project account. Counting it produces a documented 76th portal hostname, not permission to round the network up to whatever number sounds dramatic.

The full 75-hostname audit publishes the observations per hostname, including scan timestamps, DNS, RDAP, response headers, asset hashes, configuration, API evidence, cluster membership, and classification. It is meant to be checked, challenged, and updated. Evidence is more useful when it can survive leaving the article.

Why the script feels plausible

It borrows authority before earning trust

The opening invokes a job board, recruiter, colleague, or recognizable company. The borrowed name does the first round of credibility work. This is authority laundering. The source sounds legitimate because another source was mentioned first.

It separates the real site from the dangerous action

The recruiter may encourage the target to inspect a real company’s website. That inspection proves only that the real company exists. The target is then redirected to a different domain for the action that matters.

The gap is explained as ordinary infrastructure: public site here, employee portal there. A reasonable question receives a familiar analogy instead of verification.

It removes normal employment friction

No résumé review. No interview. No identity check. No tax documents. No supervisor. No written duties.

The absence of these safeguards is presented as convenience. “No personal information required” sounds protective. It also prevents the portal from having to behave like an employer.

It makes the promised income precise

The salary is divided into milestones. Daily commission ranges are supplied. Withdrawal timing is described. Precision creates the appearance of a system even when the system has no verifiable employer behind it.

The numbers are not evidence. They are interface copy. The arithmetic is wearing a lanyard.

It keeps a person beside the interface

The recruiter offers one-on-one training and asks for screenshots. This is not customer support. It is guided compliance. The target is less likely to stop and independently verify the platform when someone is waiting for the next image.

Nothing says independent remote professional like a stranger supervising every click from a text thread.

The turn

The first tasks may appear profitable. Some task scams send a small payment. That payment is not proof of employment. It is the cost of acquiring trust.

Then a task produces a negative balance, a premium order, a combination task, or a frozen withdrawal. The language varies. The solution does not. Deposit personal money, usually cryptocurrency, to repair the account and release the earnings.

Another obstacle follows the deposit. The balance may require a larger recharge, a tax payment, an account upgrade, a credit-score repair, or a final verification fee. “Final” performs difficult work in that sentence.

The balance is theater. Each payment purchases another reason to pay. The only task being optimized is the extraction.

Recognition points

Treat the offer as a task scam when several of these appear together:

▌ The recruiter contacts you unexpectedly by text, WhatsApp, or Telegram.

▌ You did not apply for the stated role.

▌ The recruiter invokes a vague referral that cannot be independently confirmed.

▌ The work is called product boosting, optimization, rating improvement, data submission, or app promotion.

▌ Simple clicks supposedly earn unusually high commissions.

▌ Registration uses an invitation code on a separate domain.

▌ Training replaces an interview and employment agreement.

▌ A dashboard shows a wallet balance or withdrawal amount.

▌ Customer service communicates through chat instead of a verifiable corporate channel.

▌ Any step requires your money to receive wages or release earnings.

The last point closes the question. Paying money to get paid is not employment.

Verify the job before you enter the portal

A polished message is not verification. A company logo is not verification. A listing on a real job board is not verification either. Scammers can copy all three before breakfast.

Use a second path for every important claim. Do not verify the recruiter with information the recruiter supplied.

1. Find the employer without using the message

Type the company’s name into a search engine or enter its known address yourself. Do not begin with the recruiter’s link, QR code, attachment, or search advertisement.

Find the careers page from the company’s main navigation. Search for the exact position, location, and department. A missing listing does not prove fraud, but it creates a question the company should be able to answer.

2. Compare every character in the domain

Read the address from right to left. The registered domain is the part immediately before .com, .org, or another suffix. Extra words such as careers, work, portal, ppc, or hr can turn a familiar brand into an unrelated domain.

company.com.jobs-example.net belongs to jobs-example.net. The company name at the beginning is decoration.

Check whether the recruiter’s email ends with the exact corporate domain. A corporate-looking signature cannot repair a Gmail address. A matching email is useful evidence, but a compromised company account is still possible. No single check gets promoted to certainty.

3. Check when the portal was registered

Use ICANN Lookup to inspect the domain’s creation date, registrar, and current status. A portal registered days or weeks ago deserves scrutiny when the recruiter claims the company or platform has operated for months or years.

A young domain is a warning signal, not a conviction. New businesses exist. Old domains can be stolen. The useful question is whether the domain history agrees with the story being told.

4. Confirm the recruiter through a separate channel

Call the main number published on the employer’s independently located website. Ask for human resources or the named department. Do not call a number in the text message, offer letter, or portal.

Ask three plain questions:

▌ Does this person recruit for your company?

▌ Is this exact position open?

▌ Is this portal one of your authorized domains?

An employer can answer without asking you to deposit cryptocurrency first. This remains one of civilization’s quieter achievements.

5. Search the recruiter and the exact language

Search the recruiter’s name, phone number, email address, and portal domain with terms such as scam, fraud, complaint, and task scam. Search one distinctive sentence from the pitch inside quotation marks. Reused scripts often leave copies behind.

Absence of complaints proves little when the domain is three weeks old. A scam cannot have a long review history before it has a long history.

6. Require a normal hiring process

Before onboarding, a real employer should be able to provide a specific role, reporting line, interview process, written offer, legal employer name, work location or jurisdiction, and ordinary payroll documentation.

Training is not an interview merely because the recruiter says it slowly. An invitation code is not an employment contract.

7. Protect sensitive information until the employer is confirmed

Do not provide a Social Security number, government identification, bank details, tax forms, account credentials, or authentication codes merely to inspect a task interface.

Some legitimate employers need sensitive information after a verified offer for payroll and legal onboarding. The order matters. Identity verification follows employer verification.

8. Apply the money-direction test

Write one sentence: “Who is paying whom?”

Legitimate employers may pay wages, reimburse approved expenses, or provide equipment through documented processes. They do not require workers to fund tasks, repair negative balances, unlock commissions, improve account credit, or pay taxes to a chat agent.

If money must travel from the worker to the work platform, stop. Payroll has left the building.

9. Pause outside the recruiter’s timetable

Send the offer to someone who is not participating in it. A friend, former colleague, career counselor, or consumer-protection organization can inspect the claims without the promised balance glowing on their screen.

A legitimate opening can survive independent verification. A scam needs the next click before the lighting improves.

What to do before money is sent

Stop contact. Preserve screenshots, phone numbers, usernames, wallet addresses, invitation codes, and domain names. Report the message through the messaging service and forward suspicious texts to 7726 in the United States.

Report the scheme at ReportFraud.ftc.gov. Notify an impersonated company through contact information from its verified public site. Do not use the address or phone number supplied by the recruiter.

If you created an account with a unique password and provided no money or identifying information, the immediate exposure is limited. Clear the site’s stored data and permissions. Change the password anywhere else if it was reused.

If you connected a cryptocurrency wallet but signed nothing, disconnect the site in the wallet and review the wallet’s connected-app list. Disconnecting ends the visible session. It does not cancel a token approval or a permit you already signed.

If you signed an approval, permit, typed message, or transaction, treat the wallet as exposed. Use the official block explorer’s token-approval checker or a reputable revocation service reached independently, not through a link sent by the recruiter. Revoke the spender’s USDC permission and move at-risk assets to a clean wallet if necessary. If the signature had a future deadline, do not return funds to the old wallet until that deadline has passed and the permission has been checked again. Keep enough native network currency only for the defensive transaction fee.

Do not continue for entertainment. Scammers can rotate numbers, study responses, send targeted links, and preserve personal details for later attempts. Recognition is the exit. It does not need a closing argument.

If money was sent

Contact the bank, card issuer, cryptocurrency exchange, or payment service immediately. Report fraud and ask whether the transfer can be stopped or the destination account frozen. Preserve transaction identifiers and wallet addresses.

Do not pay a recovery service that promises to retrieve cryptocurrency. Recovery scammers monitor victims and sell a second version of the same hope.

The first portal sells income that does not exist. The second contact sells recovery that does not exist. The screen changes. The deposit remains.