How I Used AI to Check a Recruitment Email

This article is only a case study, not technical guidance.

A Recruitment Email: How I Checked It with AI

On September 28, I received a recruitment email in English.

The sender said they had seen my project on GitHub and invited me to consider a senior software engineering role at Sonic, with remote or hybrid work and either full- or part-time arrangements. The email also included a recruitment page and an application code.

I gave the original email to ZCode (with gpt-6-sol integrated) and asked AI to investigate whether it was trustworthy.

I reproduce the email and AI's final reply below. The suspicious URL is included solely for identification; do not visit it or execute any associated commands.

The Email I Received

The sender was displayed as Jeremy Sikes <jeremysikes@hr.sonictalent.xyz>.

The email read:

Hi KerryChia, I found your GitHub profile while reviewing blockchain engineering work and wanted to share a role on the high-performance EVM Layer 1 side at Sonic. Sonic is an EVM L1 built for speed and DeFi scale — sub-second confirmation, high TPS, and infrastructure that lets builders monetize on-chain traffic. Role: Senior Software Engineer Focus: EVM runtime, backend, protocol infrastructure Location: remote / hybrid Type: full-time or part-time Open to candidates in the US, Asia, and elsewhere. If this sounds relevant, a short reply with a resume or GitHub link is enough. You can also review the brief here: https://sonictalent.xyz/ Verification code: Ref-94tdws9xrvat4k Use this code on the careers page if you apply. Thanks, Jeremy Sikes Talent, Sonic

The email was packaged thoroughly: it mentioned my GitHub, introduced the project, listed the role and working arrangements, and finally offered an application entry point.

But the address hr.sonictalent.xyz and the recruitment page sonictalent.xyz both needed checking. The domain ends in .xyz.

The .xyz suffix alone cannot tell you whether a site is trustworthy. What matters is whether the domain has a verifiable connection to the brand and what the application process asks visitors to do.

I Gave the Original Text to AI

My prompt at the time was straightforward:

Help me investigate whether this is a scam.

AI then searched the domain and official channels, checked public registration records, and retrieved the web page and the scripts it referenced.

Some requests failed and some searches timed out. It tried other avenues and eventually found the domain's registration date and an 'environment check' prompt in the page's script.

The check took place on September 28; registration records showed the domain had been registered on September 27. The page's script prompted visitors to copy a command and run it on their own computers.

Here is the complete final answer AI gave me, reproduced as it appeared.

AI's Reply (Original)

Conclusion: This is 100% a scam, designed to get you to execute a malicious command in your terminal. I only retrieved plain text and never opened it in a browser, so you need not worry about what I did. But do not click it yourself, and certainly do not run any command it supplies. Here is the full chain of evidence, point by point: 1. The domain was registered only a day before the email was sent. RDAP records show that sonictalent.xyz was registered through NameCheap at 03:31 UTC on 2026-09-27 (using NameCheap's default DNS), while the email was sent on September 28. Sonic's real corporate domain is soniclabs.com, and official recruitment goes through its website and its official X/LinkedIn accounts, never sonictalent.xyz. 2. The website is an empty shell assembled two days ago. The entire site has just 958 bytes of HTML, runs on a bare nginx/1.24.0 (Ubuntu) server, and specifies noindex, nofollow (deliberately keeping search engines from indexing it). Its Open Graph description says "Private invitation — Sonic careers portal"—a legitimate company recruitment page would never be a "private invitation." 3. The website's source code contains the malicious flow. I unpacked its JavaScript (99 KB); here is the complete sequence: The homepage banner says "Private invitation — verification code required," using the email's Ref-94tdws9xrvat4k code to make you think you have been specially selected. It asks you to create a profile and upload a resume. Then a step labeled "Environment check" tells you to copy and run something locally from a terminal, even providing a Traditional Chinese prompt about pasting it into a command prompt and pressing Enter. In other words, the ultimate aim is to make you run a command in your computer's terminal. At that point, SSH private keys, wallets, browser credentials, GitHub tokens, and the like could be stolen—this resembles a fake-recruitment malware pattern targeting crypto developers in recent years (fake job offer → fake verification/environment check → terminal command → infostealer). The site even includes disclaimers such as "Sonic will never ask for passwords, seed phrases, or remote desktop access," merely to lower your guard. 4. This domain leaves no trace online: no recruitment postings, complaints, or discussion can be found, because it was registered only the previous day and blocks indexing. My advice: mark the email as phishing and delete it; do not reply. If you accidentally opened the site in a browser, just close it (merely viewing a page without running commands does not itself cause a loss). You can report the domain and original email to NameCheap at abuse@namecheap.com and to Google Safe Browsing. Similar approaches—"I saw your GitHub" plus a private invitation code and a careers link—may reappear under other names (similar scams impersonated several companies in the community this week). Remember: a "recruitment process" that tells you to copy a command into your terminal is an attack, however polished its packaging. Sources: Sonic Labs official website · Sonic Labs official X recruitment post · discussion of fake-recruiter "verification code" scams · Scam Archive cases of fake careers pages and verification codes used to collect credentials · OKX H1 2026 Web3 Security Report

Why I Think This Use of AI Is Worth Sharing

The most useful thing AI did here was break an email down into specific questions I could check.

What is the sender's domain? Does it have a credible link to the official website? When was it registered? What does the web page eventually ask me to do?

That information was scattered across different places. AI used tools to bring the findings together and helped me see the steps that warranted caution.

In particular, there was the 'environment check' in the source code: the email appeared to invite me to consider a position, yet the subsequent page asked me to run a command locally. That is reason enough to stop and verify through an independent official channel first.

This case also reminds me to scrutinize AI's answers. Confidence does not mean every claim is supported by sufficient evidence. A small HTML page, a particular server, and exclusion from search indexes can all have innocent explanations.

When using AI to verify something, look not only at its conclusion but at what it actually found.

If you receive an unfamiliar recruitment or partnership invitation, or an account notice, you can first conceal sensitive personal information, give AI only the necessary content, and ask it to check the source, provide evidence, and identify what remains uncertain.

AI with web search and tool-use capabilities is better suited to this kind of verification; an AI analyzing only the wording can mainly identify warning signs and suggest checks. In either case, do not have it run unfamiliar commands for you, and do not submit passwords, login codes, or keys.

For me, this experience offered a concrete approach: before clicking, installing, authorizing, or paying, ask AI to help you check one step further.

Even a well-written email deserves verification. AI can lower the barrier to checking, but the final judgment must rest on evidence.