Anatomy of a Multi-Tier Employment-Lure Spam Ecosystem

Over a nine-month window, we mapped an employment-themed email operation that funnels job seekers from benign-looking listings into outright fraud. A mildly spammy "we're hiring" newsletter sits at the top of a funnel that ends in prize fraud, fake government benefits, and advance-fee schemes. This is not one campaign. It consists of at least six distinct operator clusters that share recipient lists, a common pool of click-through domains, and one strategy: wrapping everything in the language of work. We examined how the tiers connect, the delivery infrastructure they abuse, and the behavioral signals that distinguish the ecosystem from legitimate job traffic.

Key Takeaways

• The ecosystem operates as a funnel: benign-looking job-aggregator spam at the top builds and warms recipient lists, and those same lists later receive prize, benefits, and advance-fee scams sent from separate identities at the bottom.
• Six operator clusters share a common click-through domain pool and monetization playbook while sending from at least ten legitimate email service providers.
• Two provider-hosted factories form the scam backbone: one runs on Sailthru across two parallel delivery rails, while the other runs on Robly using innocuous lifestyle-topic identities such as recipes and daily-history bait.
• Impersonation covers nine major consumer brands and, separately, state workforce agencies through {state}jobdepartment lookalike domains registered as a full fifty-state cohort.
• Every sampled message passes SPF, DKIM, and DMARC, making inbound authentication unusable as a signal against this operator.
• The adversary footprint covers several hundred domains and, across the window, hundreds of thousands of messages, including algorithmically generated .info throwaways built for rapid rotation and a newer tier that replaces rented providers with a self-hosted mail stack.

Background

Employment scams are one of the fastest-growing consumer fraud categories. The U.S. Federal Trade Commission reported that losses to job and "task" scams climbed sharply through 2024, with more than $220 million reported lost in the first half of that year alone. Job seekers are attractive targets because they actively solicit contact from strangers, expect to provide resumes and identity details, and often act under financial urgency. A large data-broker and list economy compounds the problem. Resumes and job-seeker contact records are scraped from job boards and social profiles, aggregated, and traded, giving spam and lead-generation operators cheap, targeted recipient lists.

For most of the traffic, the operators do not run their own mail servers. They rent deliverability from mainstream email service providers, so their mail authenticates cleanly and inherits an established sender reputation. The clusters in this ecosystem rely primarily on Sailthru and Robly, along with AWeber, Amazon SES, Brevo, SendGrid, ActiveCampaign, Campaign Monitor, ConvertKit, MailerLite, and the creator platform Beacons. Each is a legitimate service. Sailthru (now part of Marigold) is an enterprise marketing platform; mail from its IP pools inherits a high-reputation identity that passes authentication and lands in inboxes. Robly is a small-business marketing provider whose low-friction signup and aligned authentication allow cheap campaigns to borrow warm IP reputation. Amazon SES is a pay-as-you-go cloud relay that is inexpensive, scriptable at scale, and signs mail with AWS-owned IPs and valid DKIM. Freemium providers such as Brevo, SendGrid, ConvertKit, and MailerLite are abused in the same way: a free account with vendor-managed DKIM and SPF gives a throwaway campaign instant authentication, and the operator rotates accounts when individual ones are suspended. Beacons is a link-in-bio and creator monetization tool with broadcast email features; its sending domains are generally trusted and unlikely to appear on a blocklist.

Discovery and Infrastructure

The ecosystem has tiers based on how directly each cluster defrauds the recipient.

The top tier is a lead-generation aggregator layer and the largest coordinated cluster. It uses roughly 97 domains, all sending under a listings@{domain} convention through Amazon SES. The messages contain geo-targeted job listings that use major employers as bait, specific fabricated salary figures, and a boilerplate disclaimer denying affiliation with the listed companies. Affiliate revenue drives the business model: clicks pass through tracking redirects to real job boards, and the operator earns a per-click or per-lead commission. This layer also includes a UK branch on .co.uk domains and a shared redirector backend at careerfalcon[.]com and best-jobs-online[.]com.

The middle tier harvests data. One phone-number collection operation uses fake "verify it's you" application flows, a consistent "Employment Advisor" persona, and rotating state-and-job-title display names. An older version of this cluster used budget providers. A newer version has moved to a self-hosted mail stack with its own trk., sptrk., bounces., and em####. sending and tracking subdomains on operator-owned apexes. The operator gains resilience from provider abuse desks, full visibility into who clicks, and independence from third-party account suspensions, but must warm and defend its own IP reputation. A separate branch of the data-harvesting tier impersonates state workforce agencies through {state}jobdepartment lookalike domains. It uses umail. and pmail. sending subdomains and a universal obct. tracking host across a fifty-state registration cohort.

The bottom tier consists of pure scams that use job-themed sender identities but contain zero job content. Two provider-hosted factories form the backbone. One operates on Sailthru across two parallel delivery rails (a pmta. rail and a mx. rail), covering 33 sender verticals with names such as benefits, financial, cardarena, and daily. Each vertical rotates dozens to hundreds of display names over a stable noreply@{vertical} address. The second operates on Robly and uses innocuous lifestyle-topic bait identities across 22 sender verticals themed around crime headlines, recipes, daily history, and weather. These messages lead to the same scam landing pages as the Sailthru factory. Both factories use a shared click-through domain pool, the strongest single cross-cluster pivot in the ecosystem.

Indicator	Role	Notes
careerfalcon[.]com, ct.careerfalcon[.]com	Redirector	Shared lead-gen click-tracker backend across the aggregator layer
best-jobs-online[.]com	Platform	Shared aggregator lander platform with regional subdomains
benefits.pmta.sailthru[.]com	Sender vertical	Master vertical of the provider-hosted scam factory
crime.robly[.]com	Sender vertical	Lifestyle-topic bait identity, second scam backbone
quick-jobfinder[.]com	Self-hosted stack	Operator-owned sending and tracking subdomains
illinoisjobdepartment[.]com	Impersonation	State workforce-agency lookalike, fifty-state cohort

How It Works

The lures differ clearly by tier. Top-of-funnel aggregator mail resembles a bulk job digest:

From: "Jasper" <listings@joblistify[.]com>
Subject: We're Hiring
Body: Amazon Delivery $30.00 per hour - [City] | American Airlines
      $35.95 per hour | Data Entry From Home $16.74 per hour ...
Disclaimer: References to a company name or logo are not intended
      to suggest an affiliation.
CTA: http[:]//joblistify[.]com/link/[tracking-params]

Bottom-of-funnel scam mail abandons the listing pretense and promotes prize or benefits fraud:

From: "FordTruck" <work@quickjobalert[.]com>
Subject: HAS WON A NEW FORD TRUCK?
Body: ATTENTION: Did you win the NEW FORD TRUCK?! Click to the
      attached site and see if you won!
CTA: http[:]//onequickjobalert[.]com/[uuid]

From: "Dave" <work@quickjobalert[.]com>
Subject: Unaccepted Payment Owed to you
Body: One or more assistance payments may be waiting for YOU.
      Reveal how much has been set aside in your name.
Disclaimer: We are not affiliated with any government agency.
CTA: http[:]//onequickjobalert[.]com/[uuid]

The data-harvesting tier creates urgency around a stalled application:

From: "Employment Advisor" <info@quick-jobfinder[.]com>
Subject: verify it's you
Body: These employers have been trying to reach you on your cell
      phone. Please verify your phone number to be matched with jobs.
CTA: http[:]//[operator-tracking-subdomain]/[path]

Technical Analysis

Provider-Hosted Factory Anatomy

The scam tier is not a loose collection of senders. It consists of two industrialized factories, each built on a legitimate ESP and divided into named verticals. On one enterprise marketing platform, the operator uses two parallel delivery rails under one naming grammar: noreply@{vertical}.pmta.sailthru[.]com and a mirror noreply@{vertical}.mx.sailthru[.]com. Across the two rails, we mapped 33 distinct verticals with catalog-like names: benefits, financial, financialassist, cardarena, platinum, helpguide, bulletin, websavings, hero, admired, share, low, us, daily, and more. Each vertical retains one stable envelope address while rotating a large set of display-name personas. The master benefits vertical alone cycles well over 150 distinct sender names, and most verticals use dozens. The address remains fixed for deliverability, while the visible From name changes with each theme.

A second factory uses the same approach on a small-business marketing provider, but presents its verticals as innocuous lifestyle newsletters rather than employment brands: noreply@{topic}.robly[.]com across 22 topics such as crime, cuisineoftheday, dayofhist, emergencymessagenews, funfacteveryday, chucklesinbox, and theamericansurvey. The inconsistency is apparent when a "recipe of the day" identity links to sweepstakes and benefits landers. The two factories use different providers but the same strategy, drawing from one shared pool of scam landing domains that ties them to a single operation.

The CTA Pool Names Itself After the Sender

The ecosystem's strongest fingerprint is the operator's practice of naming click-through domains after the verticals that send them. The daily vertical uses a purpose-built cohort whose labels take pmta, thru, and sail directly from daily.pmta.sailthru[.]com; the finance verticals use finance-branded siblings; credit verticals map to a dedicated credit set. A shared assistance-themed family cuts across both rails and appears under multiple unrelated sender identities. It is the most reliable pivot for linking an otherwise anonymous vertical to this operator.

Sending vertical	Purpose-built click-through family (defanged)
daily	dailypmta[.]com · dailypmtathru[.]com · dailypmtasail[.]com
financial / myfinances	financialpmta[.]com · flyjuniperfinancial[.]com · junipermyfinances[.]com
cardarena / credit	unitedstatescreditnew[.]com · techuscredit[.]com · credittheatermedia[.]com
cross-rail (shared)	yourassistgroup[.]com · yourassistgame[.]com · infoyourassist[.]com

Naming disposable infrastructure after an internal sending vertical is an operational-security mistake. It turns a rotation intended to appear random into a deterministic map of the operator's structure.

Algorithmic Domain Generation, Tracked Over Time

The rotation tier is machine-generated. One family creates landing domains from a template shaped like {adjective}-{noun}-to-{verb}today[.]info, using the low registration cost of .info to support burn-and-rotate churn ahead of takedowns. Because we sampled the generator across a multi-month window, we could observe its wordlists expanding. Over time, the pools added tokens such as "broadcast", "bulletin", "observe", "perceive", "recital", "construe", and "regard", producing new but structurally identical names on demand. The operator also mistypes its own output, creating typo-siblings such as benefitmentor[.]com / benefitmetor[.]com and champlionchronicle / champtionchronicle. Those near-duplicates provide another clustering signal that links generated batches.

Registration Cohorts and Aged-Domain Staging

Registration metadata clearly separates the throwaway tier from the impersonation tier. Disposable landing and .info domains cluster on cheap bulk registrars in tight, recent, purpose-built cohorts. For example, the dailypmta* set was registered as one batch immediately before its matching vertical became active. The government-impersonation tier follows the opposite pattern: the entire fifty-state {state}jobdepartment[.]com inventory belongs to one identical registration cohort dated 2013-04-15 and was aged for years before activation specifically to evade new-domain heuristics. The lead-generation tier forms a third cohort, with a single European registrar footprint from 2014-2015 covering both its US and UK .co.uk branches. WHOIS registrant fields are routinely privacy-protected, so we base attribution on registrar-and-date cohorts, subdomain grammar, and lander templates rather than registrant identity.

Subdomain Grammar as Operator Signature

Each tier uses a consistent subdomain grammar that persists through domain rotation. The state-impersonation cluster sends from umail. and pmail. subdomains and routes every click through a universal obct. tracking host found across all active state domains. A mainstream job-aggregator platform uses the same umail./pmail. mailing convention, tying the impersonation cluster to the aggregator tier. The self-hosted tier uses its own recognizable set of trk., sptrk., bounces., em####., si., and email. sending and tracking subdomains on operator-owned apexes. These conventions are stable enough to attribute a never-before-seen domain to a tier from its subdomain shape alone.

From Rented Reputation to Owned Infrastructure

The most substantial escalation is a data-harvesting cluster's move from rented ESPs to a self-hosted mail stack. Instead of borrowing a provider's IP reputation, the operator now manages its own sending and tracking subdomains end to end. We observed the playbook spread from the first operator apex to at least three more over successive months. Owning the stack provides resilience from provider abuse desks, complete visibility into who clicks, and independence from third-party account suspensions. In exchange, the operator must warm and defend its own IP reputation, a trade it has decided is worthwhile.

Content-Level Evasion

At the message layer, the scam clusters use three methods to defeat naive content analysis. Homoglyph substitution replaces trigger words with look-alike characters, so "Congratulations", "income", and "Click" become C0ngratulations, inc0me, and CIick (a zero for the letter o, a capital I for a lowercase l) while remaining readable to people. Zero-width non-joiner padding places invisible characters inside words to break tokenization. Filler injection adds large blocks of unrelated benign prose. In sampled cases, these included paragraphs taken from NASA Webb-telescope mission descriptions and several hundred words of generic "trust and transparency" boilerplate, diluting the statistical profile of the scam pitch.

Detection Observations

Recognition varies sharply by tier, with difficulty following the funnel.

The top-of-funnel aggregator layer is the hardest to recognize from content features alone because a single message resembles a mildly spammy job newsletter, including a legal-sounding affiliation disclaimer. The operation becomes visible at the ecosystem level through the shared redirector backends and coordinated listings@ sending convention, rather than through any one message. The shared click-through domain pool and the two redirector backends provide the strongest cross-cluster pivots because they connect otherwise unrelated sender identities to a common operator.

Bottom-of-funnel scam clusters contain strong per-message signals: prize-fraud and unclaimed-money subject lines, rapidly rotating click-through domains, and known scam-infrastructure sending verticals. Lifestyle-topic bait identities become recognizable when, for example, a "recipe of the day" sender links to sweepstakes and benefits landers.

Inbound authentication is unusable as a signal anywhere in this ecosystem. Every sampled message passes SPF, DKIM, and DMARC because the operators either rent authenticated provider infrastructure or, in the newer tier, operate their own aligned mail stack. Defenders should give more weight to sender-identity-to-content mismatches, redirector-backend reputation, and display-name rotation than to header-authentication checks.

Indicators of Compromise

All indicators are defanged. Victim data has been removed. Each table contains a representative subset of the verified-malicious set; where a type was capped, totals are noted.

Senders

Value	Role	Notes
work@quickjobalert[.]com	Sender	Bottom-of-funnel prize and benefits fraud
help@bestjobstoday[.]com	Sender	Work-from-home income scam, homoglyph evasion
help@homepaidjobs[.]com	Sender	Work-from-home scam
apply@preferableonlygreatjobs[.]com	Sender	Brand-impersonation lure, zero-width padding
updates@email1.payingsocialmediajobs[.]com	Sender	Work-from-home income scam
info@quick-jobfinder[.]com	Sender	Self-hosted-stack phone-harvesting tier
noreply@benefits.pmta.sailthru[.]com	Sender vertical	Master vertical, provider-hosted scam factory
noreply@financialassist.mx.sailthru[.]com	Sender vertical	Parallel delivery rail of the same factory
noreply@crime.robly[.]com	Sender vertical	Lifestyle-topic bait, second scam backbone
noreply@cuisineoftheday.robly[.]com	Sender vertical	Recipe-themed bait identity
listings@joblistify[.]com	Sender	Top-of-funnel aggregator layer
listings@adoptjobs[.]net	Sender	Aggregator layer, shared redirector backend
listings@getacareer[.]co[.]uk	Sender	Aggregator layer, UK branch
jobs@umail.illinoisjobdepartment[.]com	Sender	State workforce-agency impersonation
job@alert.searchhiring[.]com	Sender	Scam-themed sender on operator subdomain

... (representative subset; 250+ verified-malicious senders)

Domains

Value	Role	Notes
quickjobalert[.]com	Sender/CTA	Bottom-of-funnel scam cluster
bestjobstoday[.]com	Sender	Homoglyph-evasion income scam
homepaidjobs[.]com	Sender	Work-from-home scam
preferableonlygreatjobs[.]com	Sender	Brand-impersonation lure
careerfalcon[.]com	Redirector	Shared aggregator click-tracker backend
best-jobs-online[.]com	Platform	Shared aggregator lander platform
onequickjobalert[.]com	CTA	Prize-fraud landing page
unemploymentbenefitsfindercare[.]com	CTA	Fake benefits landing page
yourassistgroup[.]com	CTA	Cross-rail shared scam lander
flyjuniperfinancial[.]com	CTA	Loan and credit scam lander
dailypmta[.]com	CTA	Rotation-cohort scam lander
illinoisjobdepartment[.]com	Impersonation	State workforce-agency lookalike
ohiojobdepartment[.]com	Impersonation	State workforce-agency lookalike
joblistify[.]com	Sender/CTA	Aggregator layer
adoptjobs[.]net	Sender/CTA	Aggregator layer

... (representative subset; 500+ verified-malicious domains). The .info throwaway family follows the templated {adjective}-{noun}-to-{verb}today[.]info pattern and rotates continuously.

Hosts

Value	Role	Notes
ct.careerfalcon[.]com	Redirector	Aggregator click-tracker, /ls/click path
jobs.jobsflag[.]com	Redirector	Lead-gen redirector
trc.bestjobassistance[.]com	Redirector	Payment-scam redirector
bounces.quick-jobfinder[.]com	Self-hosted stack	Operator-owned bounce subdomain
sptrk.quick-jobfinder[.]com	Self-hosted stack	Operator-owned tracking subdomain
em7784.prolocaljobs[.]com	Self-hosted stack	Operator-owned sending subdomain
email.usatalentlink[.]com	Self-hosted stack	Operator-owned sending subdomain
obct.ohiojobdepartment[.]com	Tracking	State-impersonation tracking host
trk.jobspringboard[.]com	Self-hosted stack	Operator-owned tracking subdomain
si.assistmycareer[.]com	Self-hosted stack	Operator-owned sending subdomain
poj.preferableonlygreatjobs[.]com	Redirector	Brand-impersonation lure redirector

... (representative subset; hundreds of verified-malicious hosts)

MITRE Fight Fraud Framework Mapping

The mapping below follows the MITRE Center for Threat-Informed Defense Fight Fraud Framework (F3), https://ctid.mitre.org/fraud. The public matrix is rendered client-side and does not provide stable technique identifiers in a citable form, so we mapped behaviors by tactic and technique name; consult the live matrix for current identifiers.

Tactic	Technique observed in this ecosystem
Initial Access	Mass unsolicited email lure; SMS and voice follow-up funnels
Initial Access	Brand and government-agency impersonation; display-name and domain spoofing
Execution	Prize, unclaimed-benefits, and employment-offer pretexts
Positioning	Phone-number and PII harvesting via fake apply-and-verify forms
Monetization	Affiliate and lead-resale commissions; advance-fee follow-on schemes
Stealth	Domain rotation; abuse of trusted sending services; homoglyph, zero-width, and filler content obfuscation

Conclusion

The operators behind this ecosystem have designed resilience into every tier. They rent provider reputation where it is cheap, use a self-hosted mail stack where control matters, and maintain a domain-generation pipeline that outpaces reputation blocking. No single message exposes the full operation. The links appear in the shared infrastructure beneath the identities: the common click-through pool, redirector backends, and sending conventions that connect unrelated brands to one operator. Defenders tracking employment-themed spam should map the redirector backends first and treat the benign-looking aggregator layer as the front door to everything downstream.

Tags: scams, phishing, identity protection