DEV Community: Hoang Nguyen

Scam Emails Targeting Developers With Public Presence — A Real Case Study

Hoang Nguyen — Mon, 12 Oct 2026 01:56:16 +0000

I received this email last Sunday:
From: Jessica Davis
Subject: Writing collaboration opportunity

Hi Hoang,

Your Dev.to post on running the first 100 URLs through the
VNML Agent Framework shares concrete metrics that are rare
in agent write-ups.

I am reaching out on behalf of one of our clients. They are
an AI infrastructure company and are currently looking to
collaborate with active engineering writers to publish
curated, high-value technical deep-dives and listicles.

Are you currently open to technical roundups or freelance
writing projects? If so, I'd love to share the topic outline
and further details.

Best regards,
Jessica

On the surface? Legit. The sender referenced my actual Dev.to post, knew what I write about, and pitched in a professional tone.

But I have a habit of verifying before replying.

5 minutes of checks later, this turned out to be part of a mass scam campaign.

Here's the breakdown.

Step 1 — SPF/DKIM/DMARC: The First Trap

First thing most devs do is check the email headers. Here's what I got:
SPF: PASS with IP 209.85.220.41
DKIM: PASS with domain expound.live
DMARC: PASS

Looks safe. Most people stop here.

Here's what many devs don't realize:

SPF/DKIM/DMARC only confirm the email was sent from that domain — not that the sender has good intentions.

Scammers know how to set up all three records. Total cost to run this exact scam:

Domain (.live TLD): ~$3/year
Google Workspace: ~$6/user/month
SPF/DKIM/DMARC config: free, one-time, 20 minutes

Under $100/year for a fully "legitimate-looking" email infrastructure.

SPF/DKIM/DMARC PASS is a necessary condition. It's not a sufficient one.

Step 2 — IP Check on AbuseIPDB

Traced the sending IP: 209.85.220.41.

It's Google Workspace. So on the surface: "legit Google IP."

But AbuseIPDB:
Confidence of Abuse: 100%
Total Reports: 538
Distinct Reporters: 47
Last Reported: 2026-09-28

Recent reports:

"Impersonating recruiter, asking for personal info"

"Fake freelancing opportunity, requests bank account"

"Scam email from 'content agency'"

538 reports from 47 different people. Some describing the exact same scenario.

A Google IP does not mean the email is trustworthy. Anyone can buy Google Workspace. When thousands of scammers use the same IP range, the reputation of the entire range collapses.

Step 3 — Domain Check

Domain: expound.live. Quick checks:

Not reachable — no website, no homepage loads
No LinkedIn company page — search "Expound" returns nothing
No digital footprint for "Jessica Davis" — LinkedIn, Twitter, blog, nothing
Domain fresh — .live TLD, commonly used for short-lived campaigns

A real AI infrastructure company hiring writers would have:

An active website
LinkedIn with visible employees
A portfolio of published articles
Their own domain, not a cheap TLD

None of these existed.

Why Developers With Public Presence Get Targeted

If you've ever thought "I have nothing worth scamming" — wrong.

You have exactly what scammers want:

Your public asset	What scammers do with it
Public email on Dev.to/GitHub/blog	Scrape for mass campaigns, sell to spam lists
Active LinkedIn	Impersonate you to scam your network
Technical blog	Scrape content, farm SEO, use as fake portfolio
GitHub repos with traction	Fork, rename, publish as theirs
Solo, no legal team	Easier to scam than companies

Scams don't target the rich. They target the searching. People actively looking for opportunities miss red flags.

If you just published a post that got traction, you're a prime target.

5 Common Scam Patterns (Know Them)

1. Content Farm — Free Content Extraction

They ask for "3 sample articles" before signing anything. You write them → they disappear. Content gets published elsewhere.

Red flag: Writing before payment, no NDA, no contract.

2. Overpayment Scam

They send a check/PayPal for more than agreed. Then: "Oops, my mistake. Send back the excess." The original payment bounces. You lose real money.

Red flag: Payment exceeds scope, check-by-mail, crypto refunds.

3. Crypto/Investment Pivot

Warm up with "professional" emails for a week. Then pivot: "My client has an AI investment opportunity..." Fake returns, real losses.

Red flag: Topic shift from work to investment, urgency.

4. Identity Theft Prep

20-page "freelance contract" with clauses asking for ID, address, bank account, tax ID. Once they have it → identity theft, loans, etc.

Red flag: Personal documents before work starts.

5. SEO Backlink Farm

They publish your article on a "network of 50+ blogs" — all junk. Google penalizes your domain for association.

Red flag: Unclear blog quality, no editorial review.

The 5-Minute Verification Routine

Use this on every cold outreach:

1. Email headers (1 min)

SPF/DKIM/DMARC: PASS or FAIL?
Reply-To ≠ From? → red flag
Return-Path mismatch? → red flag

2. IP check (1 min)

abuseipdb.com → paste IP → search
Confidence > 50% or reports > 10 → red flag

3. Domain check (1 min)

mxtoolbox.com → domain history
Google: "company name", "person name" "company", "domain.com" scam

4. Reply probe (1 min)

Send a reply with specific questions:

Client name? Platform? Rate? Video call?
Dodges any of them → scam.

5. Golden rule (1 min thinking)

Three questions:

If they don't pay, do I lose? → Require 50% upfront
If they misuse my content, am I affected? → Require contract
If I drop this, do I lose? → Drop it

Verdict

The email from "Jessica Davis" is a textbook scam campaign.

Only three signals can't be faked:

538 abuse reports on the sending IP
0 digital footprint for sender or company
0 verifiable links to any portfolio

Golden rule: If you can't verify an opportunity's origin in 10 minutes of searching → it's not worth 10 hours of writing.

Don't be paranoid. Don't be naive either.

The verification routine above is 5 minutes. That's the cost of avoiding a 40-hour loss.

What's your verification routine? Ever caught one of these? Drop it in the comments — more examples = better awareness for everyone.

This post is cross-posted from my blog with full screenshots and headers: vnmlstudio.runasp.net

Running Our First 100 URLs — Real Metrics From VNML Agent Framework

Hoang Nguyen — Wed, 30 Sep 2026 12:30:42 +0000

Today I ran my first real batch test with 100 URLs.
Result: 61% success. Not 100%.

And I'm going to tell you why I'm still posting this on LinkedIn.

6 months ago, I started building VNML Agent Framework — a multi-agent AI system running 100% local on my GTX 3050 Ti laptop with 4GB VRAM. No fancy GPU. No cloud. No team.
This morning, I ran 100 URLs across 12 different categories through a complete SEO pipeline:
→ Scraping → Analysis → Writing → Reflection → Validation → Save
Results in 3 hours 6 minutes:
✅ 61 URLs succeeded (61%)
✅ 15 articles scored APPROVED (≥90/100)
✅ 45 articles NEEDED_REVISION (60-89/100)
❌ 39 URLs failed — mostly intentional edge cases (404, paywall, bot detection)

Adjusted success rate (excluding 6 intentional 404 test URLs): 65%.

But this isn't a brag post.
I'm posting this because the batch test exposed 3 bugs that 5-10 URL small tests would NEVER reveal:
🔴 Bug #1: One URL took 20 MINUTES at the Analysis step
→ Content was only 790 chars, but LLM got stuck for 1174 seconds
→ Would destroy entire SLA if unfixed
🔴 Bug #2: example.com — the simplest test page in the world — FAILED to crawl
→ Along with api.github.com (public JSON) also failing
→ Content-type handling bug, not network
🔴 Bug #3: Layer L4 (Coverage) fails ~60% of URLs

→ Threshold too high → most need rewrite → wastes 30% of batch time

3 lessons I learned:
1️⃣ Running 5-10 test URLs will NEVER expose hidden bugs.
You MUST run a batch ≥ 50 URLs before release.
2️⃣ Timeouts need a hard cap, not just dynamic.
When the model is "confused" by short content, dynamic timeout doesn't help.
3️⃣ Honest metrics beat cherry-picked demos.

61% success + root cause analysis > 95% success on 20 pretty URLs.

I'm 43. The Vietnamese IT market considers me "too old."
But I still write code every day. Still debug every bug. Still learn from every batch test.

And I believe: transparency with real numbers matters more than showing off pretty stats.

Full source code + detailed metrics report in the first comment 👇
What are you building with local LLMs? Share in the comments.

Microsoft Copilot Search Indexed My Framework — 5 Lessons on AI-Era SEO

Hoang Nguyen — Tue, 15 Sep 2026 02:00:20 +0000

Last night, after publishing a Facebook post about our framework, I sat with my phone wondering if anyone would reply. On a whim, I typed vnml agent framework into Bing.

What I saw made me sit up straight.

Microsoft Copilot Search returned a detailed summary of our project — not just a GitHub link, but a 200+ word AI-generated description that captured exactly what we had built over the past 6 months.

This is the story of that discovery, and what it teaches us about SEO in the era of AI search engines.

What Copilot Search Said About Us

Here's the exact summary Copilot Search displayed:

"VNML Agent Framework is an open-source, fully local AI agent platform designed for self-learning, self-generating tools, and multi-agent orchestration using small language models."

And it listed these key features:

Multi-Agent System — Multiple AI agents working collaboratively
Self-Learning & Self-Generating Tools — Built-in self-correction mechanisms
Local Execution — Runs fully offline using LlamaCppSharp
Dynamic Tool Synthesis — Uses C# Roslyn Compiler at runtime
Architectural Elegance — Decorator Chain Pattern for loose coupling
Performance Optimizations — Dynamic Timeout with Thinking Mode

Reading this, I realized something: Copilot Search understood our framework better than we could explain it in 30 seconds.

Why This Matters — 3 Reasons

1. Microsoft Has Validated the Project

Not officially — no one from Redmond called me. But Bing + Copilot has:

Crawled our GitHub repository
Indexed our blog on runasp.net
Read our README
Understood the architecture and features
Summarized it into a coherent paragraph

This means Microsoft's infrastructure considers our project important enough to index.

2. This Is Free Social Proof

When pitching to customers, we can now say:

✅ "Our framework has been indexed and summarized by Microsoft Copilot Search."

This sounds very different from:

❌ "We just built a tool, please try it out."

Same truth, but the first version creates immediate trust. Customers don't need to believe us — they can search Bing themselves.

3. AI Understands the USP Correctly

Reading Copilot's summary, I noticed:

It didn't say this framework is "the best" or "the fastest"
It didn't hype
It only described accurately what we built

This matters because: when AI summarizes without bias, readers trust it more.

Bing vs Google — Why Bing Indexed First

I tried the same search on Google. The result was very different:

Search Engine	Result	Quality
Bing Copilot	Full AI summary with 6 key features	✅ Excellent
Google	GitHub link, no AI summary	⚠️ Basic
Perplexity	Summary (shorter)	✅ Good
ChatGPT Search	Not indexed yet	❌ Missing

Reasons Bing indexed first:

Microsoft owns GitHub → has internal data for AI training
Copilot is trained on code + READMEs → understands dev projects
Bing indexes new content faster → especially for tech projects
Google needs more backlinks + authority → slower for new projects

💡 Lesson: If you build a new tech project, submit to Bing first. You'll see results in days, not weeks.

5 Lessons Learned About AI-Era SEO

Lesson 1: README Matters More Than You Think

Copilot Search extracted 90% of its summary from our README. If your README:

Has clear keywords (local LLM, C#, multi-agent)
Describes the architecture
Has concrete examples

→ Copilot will summarize it well.

If your README is vague → Copilot won't index it.

Action: Spend 1-2 hours rewriting your README. It's the "landing page" of your open-source project.

Lesson 2: Personal Blogs Still Matter

Copilot cited runasp.net — our personal blog. Not Medium, not Dev.to, not Substack.

Personal blogs have an advantage:

Full control over content
Platform won't change algorithms
Google/Bing index as a separate entity

Action: Don't just post on Medium. Post on your own blog first, then cross-post.

Lesson 3: GitHub Is a Real SEO Channel

GitHub repos are indexed and summarized by AI. This is something no one thought about 5 years ago.

GitHub = portfolio + SEO channel
Good README → automatic traffic
Stars → trust → job offers/customers

Action: Treat your GitHub repo like a product, not just a code dump.

Lesson 4: AI Search Is Changing SEO

This is the biggest realization:

Old SEO	New AI Search
Write content → rank on Google → user clicks	AI reads content → summarizes → user reads summary
Needs backlinks + authority	Needs AI-readable structure
Long-form content wins	Structured content (bullets, headings) wins
Optimize for humans	Optimize for AI + humans

Action: Write for AI, not just humans.

Lesson 5: No Permission Needed

I used to think: "To be noticed by Microsoft, you need to do something great."

The truth: Bing automatically crawls and indexes public projects. No permission needed, no application, no waiting for a call.

Just:

Build something real
Publish it on GitHub
Write a good README
Have a personal blog
Wait a few weeks

That's all.

What We're Doing Next

After seeing this result, here are 3 things we're going to do:

1. Submit to Bing Webmaster Tools

Ensure the sitemap of runasp.net and our GitHub repo are fully submitted, including:

sitemap.xml
robots.txt allowing AI crawlers
Meta tags for OG and Twitter

2. Write More Technical Blogs

Copilot indexes technical content better than marketing content. We'll write about:

Deep dive into ReflectionEngine
Why we use bigrams for Vietnamese
Benchmarking LLM 4B on weak laptops

3. Optimize GitHub README

Add:

Architecture diagram
Performance numbers
Comparison with other frameworks
Quick start guide

Conclusion

If you're building an open-source project and wondering:

"How do I get noticed?"

The answer is simpler than you think:

Build something real — not a tutorial clone
Publish it — GitHub, blog, social media
Write good content — AI will read it
Wait — Bing indexes fast, Google slower
No PR, no permission needed

⭐ Microsoft doesn't need to call you. They index automatically. And when they do, you have free social proof without spending a single dollar on marketing.

"AI search engines don't care about your marketing budget. They care about the clarity of what you actually built."

About the author: I'm a solo Vietnamese dev building VNML Agent Framework — a multi-agent AI system that runs 100% local using C#. No API, no cloud, no data leaks.

🔗 Framework: github.com/hoangnc/VNMLAgentFramework
📝 Full story (canonical): Microsoft Copilot Search Indexed Our Framework

Share knowledge about the SEO Crawl Supervisor Orchestrator built in the VNMLAgentFramework.

Hoang Nguyen — Sat, 05 Sep 2026 02:48:41 +0000

The SEOCrawlSupervisorOrchestrator is a production-grade, pipeline-based orchestration system designed for automated SEO content processing. It manages end-to-end workflows including:

Web crawling – extract content from target URLs
SEO analysis – evaluate keyword density, readability, structure
Content writing – generate SEO-optimized articles
Quality reflection – multi-layer quality assurance with auto-correction
Result persistence – save articles and generate comprehensive reports See details at:

GitHub: https://github.com/hoangnc/VNMLAgentFramework/blob/main/SEO_Architecture_Design_VN.md

Blog:
http://vnmlstudio.runasp.net/en/blogs/