I received this email last Sunday:
From: Jessica Davis
Subject: Writing collaboration opportunity
Hi Hoang,
Your Dev.to post on running the first 100 URLs through the
VNML Agent Framework shares concrete metrics that are rare
in agent write-ups.
I am reaching out on behalf of one of our clients. They are
an AI infrastructure company and are currently looking to
collaborate with active engineering writers to publish
curated, high-value technical deep-dives and listicles.
Are you currently open to technical roundups or freelance
writing projects? If so, I'd love to share the topic outline
and further details.
Best regards,
Jessica
On the surface? Legit. The sender referenced my actual Dev.to post, knew what I write about, and pitched in a professional tone.
But I have a habit of verifying before replying.
5 minutes of checks later, this turned out to be part of a mass scam campaign.
Here's the breakdown.
Step 1 — SPF/DKIM/DMARC: The First Trap
First thing most devs do is check the email headers. Here's what I got:
SPF: PASS with IP 209.85.220.41
DKIM: PASS with domain expound.live
DMARC: PASS
Looks safe. Most people stop here.
Here's what many devs don't realize:
SPF/DKIM/DMARC only confirm the email was sent from that domain — not that the sender has good intentions.
Scammers know how to set up all three records. Total cost to run this exact scam:
- Domain (.live TLD): ~$3/year
- Google Workspace: ~$6/user/month
- SPF/DKIM/DMARC config: free, one-time, 20 minutes
Under $100/year for a fully "legitimate-looking" email infrastructure.
SPF/DKIM/DMARC PASS is a necessary condition. It's not a sufficient one.
Step 2 — IP Check on AbuseIPDB
Traced the sending IP: 209.85.220.41.
It's Google Workspace. So on the surface: "legit Google IP."
But AbuseIPDB:
Confidence of Abuse: 100%
Total Reports: 538
Distinct Reporters: 47
Last Reported: 2026-09-28
Recent reports:
"Impersonating recruiter, asking for personal info"
"Fake freelancing opportunity, requests bank account"
"Scam email from 'content agency'"
538 reports from 47 different people. Some describing the exact same scenario.
A Google IP does not mean the email is trustworthy. Anyone can buy Google Workspace. When thousands of scammers use the same IP range, the reputation of the entire range collapses.
Step 3 — Domain Check
Domain: expound.live. Quick checks:
- Not reachable — no website, no homepage loads
- No LinkedIn company page — search "Expound" returns nothing
- No digital footprint for "Jessica Davis" — LinkedIn, Twitter, blog, nothing
- Domain fresh — .live TLD, commonly used for short-lived campaigns
A real AI infrastructure company hiring writers would have:
- An active website
- LinkedIn with visible employees
- A portfolio of published articles
- Their own domain, not a cheap TLD
None of these existed.
Why Developers With Public Presence Get Targeted
If you've ever thought "I have nothing worth scamming" — wrong.
You have exactly what scammers want:
| Your public asset | What scammers do with it |
|---|---|
| Public email on Dev.to/GitHub/blog | Scrape for mass campaigns, sell to spam lists |
| Active LinkedIn | Impersonate you to scam your network |
| Technical blog | Scrape content, farm SEO, use as fake portfolio |
| GitHub repos with traction | Fork, rename, publish as theirs |
| Solo, no legal team | Easier to scam than companies |
Scams don't target the rich. They target the searching. People actively looking for opportunities miss red flags.
If you just published a post that got traction, you're a prime target.
5 Common Scam Patterns (Know Them)
1. Content Farm — Free Content Extraction
They ask for "3 sample articles" before signing anything. You write them → they disappear. Content gets published elsewhere.
Red flag: Writing before payment, no NDA, no contract.
2. Overpayment Scam
They send a check/PayPal for more than agreed. Then: "Oops, my mistake. Send back the excess." The original payment bounces. You lose real money.
Red flag: Payment exceeds scope, check-by-mail, crypto refunds.
3. Crypto/Investment Pivot
Warm up with "professional" emails for a week. Then pivot: "My client has an AI investment opportunity..." Fake returns, real losses.
Red flag: Topic shift from work to investment, urgency.
4. Identity Theft Prep
20-page "freelance contract" with clauses asking for ID, address, bank account, tax ID. Once they have it → identity theft, loans, etc.
Red flag: Personal documents before work starts.
5. SEO Backlink Farm
They publish your article on a "network of 50+ blogs" — all junk. Google penalizes your domain for association.
Red flag: Unclear blog quality, no editorial review.
The 5-Minute Verification Routine
Use this on every cold outreach:
1. Email headers (1 min)
- SPF/DKIM/DMARC: PASS or FAIL?
- Reply-To ≠ From? → red flag
- Return-Path mismatch? → red flag
2. IP check (1 min)
-
abuseipdb.com→ paste IP → search - Confidence > 50% or reports > 10 → red flag
3. Domain check (1 min)
-
mxtoolbox.com→ domain history - Google:
"company name","person name" "company","domain.com" scam
4. Reply probe (1 min)
Send a reply with specific questions:
- Client name? Platform? Rate? Video call?
- Dodges any of them → scam.
5. Golden rule (1 min thinking)
Three questions:
- If they don't pay, do I lose? → Require 50% upfront
- If they misuse my content, am I affected? → Require contract
- If I drop this, do I lose? → Drop it
Verdict
The email from "Jessica Davis" is a textbook scam campaign.
Only three signals can't be faked:
- 538 abuse reports on the sending IP
- 0 digital footprint for sender or company
- 0 verifiable links to any portfolio
Golden rule: If you can't verify an opportunity's origin in 10 minutes of searching → it's not worth 10 hours of writing.
Don't be paranoid. Don't be naive either.
The verification routine above is 5 minutes. That's the cost of avoiding a 40-hour loss.
What's your verification routine? Ever caught one of these? Drop it in the comments — more examples = better awareness for everyone.
This post is cross-posted from my blog with full screenshots and headers: vnmlstudio.runasp.net
Top comments (1)
tr.ee/dev-to