High riskFake-recruiter email domain — impersonates LEGO and other employers
recruitmentoutreachgroup.com
Registration profileDisposable sender domain — registered to send fake-recruiter email and nothing else, with no corporate footprint behind the name
First seenOctober 2026, in a Reddit r/Scams report of a fake “Digital Marketing Manager role with Lego” offer
Evidence
- Sends unsolicited, polished job offers for attractive roles at real companies — LEGO in the documented wave — from an email address that has nothing to do with the brand.
- No one at the domain has any relationship with the brands whose jobs they're dangling; LEGO recruits from @lego.com addresses or from named agencies whose own domains can be independently verified.
- Three documented outcomes for anyone who replies: an advance-fee scam (onboarding fee, equipment deposit, software license, background-check cost), an identity-theft harvest (“employment verification” collecting SSN, date of birth, bank details, ID scans), or money muling (receiving payments and forwarding them).
- The email is full of real-sounding detail about a real company — cheap to fake and very persuasive; the mismatch between the claimed employer and the sending domain is the whole tell.
- The template rotates through other household names — the LEGO wave is the documented instance of a rotating operation.