I received a strange job invitation claiming to be from Bolt. It came from [email protected], and the email headers showed that SPF, DKIM, and DMARC passed. The Received chain also appeared to use legitimate Odoo mail infrastructure.
That made me suspect the sender may have created an Odoo database called bolt-job-invitation and used Odoo Helpdesk to send the message. In other words, this may not be traditional domain spoofing; it could be someone using a legitimate SaaS tenant while impersonating Bolt through the tenant name and message content.
Several details seemed suspicious:
- The links led to bolt-job-invitation.odoo.com rather than Bolt's apparent corporate and careers domain, bolt.eu.
- The recruitment message appeared to be an Odoo Helpdesk ticket, such as helpdesk.ticket-12.
- It claimed the sender had found my profile but did not identify a specific position, team, location, or reason for contacting me.
- The Odoo footer included an unrelated-looking aniimate.net address.
- I could not find reliable public information connecting the sender's name with Bolt.
My current assessment is that this is likely brand impersonation or phishing conducted through legitimate Odoo infrastructure. Passing SPF, DKIM, and DMARC would only show that Odoo was authorized to send mail for the Odoo-hosted domain; it would not prove that the sender is affiliated with Bolt.
Would you classify this as a true positive for phishing? Is my interpretation of the email authentication and domain relationship correct, or are there important caveats?
2 Answers
Your authentication analysis is correct. DMARC passing means the visible From domain was aligned with an authenticated SPF or DKIM identity; it does not establish any relationship with Bolt. A legitimate Odoo tenant can therefore send a properly authenticated message while its owner impersonates another company.
I would quarantine it as suspected brand impersonation. The Helpdesk ticket format and strange footer support that assessment, although neither one proves fraud by itself. For confirmation, independently locate Bolt’s official careers or security contact details and verify the invitation without using any links or contact information in the message.
Yes, this is a reasonable true-positive classification. It fits the broader pattern of attackers abusing legitimate services to send phishing messages. The important point is that the service being abused can have valid authentication and infrastructure while the account or tenant owner is still impersonating another organization.
This example is fairly obvious because an Odoo support system is being used to pose as Bolt. Similar abuse can be more convincing when the legitimate service itself is the brand being impersonated—for example, messages sent through a real payment provider or form service. In those cases, checking only the sender domain can create a false sense of safety.
That distinction is helpful. If the trusted service and the claimed brand are the same, sender-domain checks can look reassuring even though the message is malicious. I’ll include that scenario when explaining why authentication results alone aren’t enough.