2026 - Finding Ghost Jobs and Ghost Companies using OSINT

## Overview

Patrick Wed, a cybersecurity analyst from Baltimore with nine years of experience, presents practical OSINT techniques for identifying fraudulent job postings ('ghost jobs') and fake companies ('ghost companies'). Ghost jobs are legitimate-looking postings with no genuine intent to fill—used for market research, investor optics, regulatory compliance, or to maintain internal candidates. Ghost companies are entities that don't exist or misrepresent themselves. A real threat exists: PaloAlto's Unit 42 identified a North Korean hacker group called 'Contagious Interview' conducting fake coding interviews that distribute malware.

## Key Topics

Wed emphasizes operational security (OPSEC) before conducting investigations. VPNs, VPS rentals, sock puppet accounts, and VM usage help investigators remain undetected while accessing public data. Domain research forms the foundation: verify WHOIS records and DNS history (using tools like Silent Push), check physical addresses via Google Maps, validate contact information and email deliverability, examine customer testimonials for template reuse, and note if content appears AI-generated. People search requires checking corporate records via Open Corporates and searching LinkedIn, though results aren't always reliable and should be treated as potential leads rather than gospel. Corporate records research reveals company structure, officers, registered agents (often LLCs themselves, creating investigation chains), and state filings linked to articles of incorporation.

## Case Study: Spooky Security LLC

Wed's investigation began with a suspicious OSINT job posting offering $500k–$760k salary for someone with early-career experience. Red flags included impossibly high compensation-to-experience ratios and requirement for deep defense sector connections. Domain research revealed non-existent stock tickers, cryptocurrencies, and software; a private Instagram account with 140,000 followers but zero posts; virtual office space in Wilmington, Delaware (a $99/month service allowing incorporation without physical presence); and attempted but deleted Wikipedia page with public moderator discussion logs.

Three listed executives required investigation:

**Booberry (CLO)**: Unique name with zero online presence anywhere in the country—confirmed fake.

**Bloody Mary (CCO)**: Open Corporates search returned 72,000 registered companies under her name. Investigation revealed she was a legitimate person—an LLC service provider unknowingly used as registered agent for countless small businesses (nail salons, yoga studios, mechanics). She had no actual involvement with Spooky Security; she simply provided a service for $200 paperwork completion.

**Gengar (CEO)**: Traced through copyright registration to fake charity website and personal domain. LinkedIn revealed pattern of defunct startup projects. Fake New York Times articles hosted on AWS, predated Spooky Security by two years and described Gengar as a 15-year-old. PDF metadata analysis revealed version history, placing him at approximately 21 years old during investigation—likely an undergrad.

A former employee (found via LinkedIn) confirmed the company never developed software, constantly requested personal contacts and email addresses, communicated exclusively via Signal, and never paid the employee despite offering $500k salary. The employee kept an 'Open to Work' filter active despite supposedly high compensation—a behavioral inconsistency.

## Technical Details

Key tools include Open Corporates (corporate records), Silent Push (DNS/historical records), LinkedIn, Wayback Machine (archived websites), people search databases, and Obsidian (note-taking). Red flags include unrealistic compensation, AI-generated content, impossible office locations, and templated customer testimonials. PDF metadata analysis proved valuable—PDFs retain version history and previous edits, enabling timeline reconstruction.

## Takeaways

Basic screening requires only Google searches and LinkedIn checks. Deeper investigations demand understanding risk tolerance and OPSEC. Trust instincts: if compensation seems too good, content appears AI-generated, or office addresses don't exist, those are strong indicators of fraud. Scammers rely on quantity over quality; losing 90 percent of operations still yields results. The barrier to entry for these techniques is low—good note-taking skills and curiosity suffice.