The Magic Behind Email Spoofing (How I caught a fake $100K job offer)
I almost fell for a $100K remote job scam—and it taught me a lot about email spoofing, SPF, DKIM, and DMARC. Learn how to spot fake domains, decode email headers, and protect yourself from phishing attacks.
A few weeks ago, I received an email that caught my attention:
Dear Maxim,
I hope you’re doing well.
Collegis Education LLC has reviewed your application profile via LinkedIn, and we are currently seeking a Technical Support Specialist for a remote position.
We recognize your talents and are pleased to inform you that you have been shortlisted for the role, making you eligible to proceed to the next stage of the hiring process.
At Collegis Education LLC, we aim to ensure that your skills, aspirations, and career goals align with our company culture and the requirements of this role. If you are still interested in this opportunity, please reply with “Interested” to confirm your receipt of this email.
Looking forward to your response."
At the time, I had been actively applying to jobs, so I wasn’t immediately suspicious. But something felt off. I couldn’t recall ever applying to Collegis Education LLC. A quick check on LinkedIn confirmed it—no application to them on record.
Still, I replied:
Dear Michelin, Thank you for the reminder. I'm still interested in the Technical Support Specialist role. Could you please share more details about the next steps in the hiring process?
They responded quickly, attaching a PDF with interview details. That’s when my doubts kicked in. The job was offering over $100,000. That’s a dream figure, but with my experience level, it didn’t quite add up.
So I investigated further.
Red Flag #1: The Domain
Collegis Education’s real website is collegiseducation.com, but this email came from collegiseducationcareers.com. Why would they use a completely different domain for hiring?
A search for the supposed recruiter, Michelin Thomas, turned up nothing on Google or LinkedIn—not even on Collegis' company page. The email signature was also oddly minimal: just a name and title. No website. No address. Nothing professional.
In most settings, such discrepancies and lack of information are enough to tag this as a scam. Phishing attempt. But I looked into it further.
Red Flag #2: Email Headers and Authentication
Here’s where it got technical. I checked the email source:
dkim=pass header.i=@collegiseducationcareers-com.20230601.gappssmtp.com spf=none
- DKIM (DomainKeys Identified Mail) passed. That meant the email appeared to come from an authorized server.
- SPF (Sender Policy Framework) failed. That’s a big problem—this domain didn’t have an SPF record to authorize sending email. It could easily be spoofed.
- DMARC (Domain-based Message Authentication, Reporting & Conformance) wasn’t configured properly. Without DMARC, the domain can’t tell receivers what to do if SPF or DKIM fails, which pretty much explains why this did not end up in spam.
Red Flag #3: Domain Lookup
I used GoDaddy’s domain tool to check both domains:
- collegiseducationcareers.com was registered on April 21. I received the email on April 24. Very new.
- collegiseducation.com was registered in 2013, hosted on Amazon servers.
The fake domain was using DNSOWL, a provider associated with cheaper, less secure setups. Not the same organization.
Additionally, collegiseducationcareers.com did not have any contact information or details on the company owning the domain, which is the opposite of collegiseducation.com, whose information is public.
Conclusion: It Was a Spoof
No recruiter, no job listings on the company’s official site, and mismatched security protocols.
Honestly, it hurt. A $100K job? That would’ve changed my year. But scams prey on hope, especially in tough job markets.
What You Can Do to Protect Yourself
- Check the sender’s domain. Always compare it to the official website.
- Verify SPF, DKIM, and DMARC records using tools like MXToolbox.
- Search for the sender on LinkedIn. Legit recruiters will have some traceable digital footprint.
- Look up the domain registration date. New or suspicious registrars are red flags.
Trust your gut. If it seems too good to be true, it probably is.
This experience didn’t just make me cautious—it taught me how email security works in practice. It also reminded me how important it is to stay skeptical, even when hope clouds your judgment.
To any ethical hackers reading this, feel free to send me your best (legal) spoofs. I’d love to keep learning.