Docusign Phish from Microsoft Outlook

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 04 Feb 2025 15:36:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))

(envelope-from )

id 1tfRW6-000000003ET-3yVa

for dave@doctor.nl2k.ab.ca;

Tue, 04 Feb 2025 15:35:38 -0700

Resent-From: The Doctor

Resent-Date: Tue, 4 Feb 2025 15:35:38 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-am6eur05hn2201.outbound.protection.outlook.com ([52.100.174.201]:48353 helo=EUR05-AM6-obe.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98 (FreeBSD))

(envelope-from )

id 1tfM7b-000000006ya-2mQb

for doctor@doctor.nl2k.ab.ca;

Tue, 04 Feb 2025 09:50:06 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=D2Pe1SILkRbeLDCVMbGduwp9VXhzcY2pIrvfmTv6rICzjfenU8w8SlRJNN/4HEI6SwOYlAx3Rv3sTLabbTVbHs+EDKmA+qNI9sGpNHkvwUsgRGC37kfD6GvGbOkJgIATaaMPgSSxjFcIJmL1tN2E6j0Qdu1qPgoUXyf3iybiI+nsxnqddBBZMURA8Y3rcbly0vKkhqYapYBp6E2iUI/ezRUPnYaiCJJ5b2vLOsez2/BQk6a+o2p39jofS8ZSmxZdn2EjeuOpwg3//VN21pbGSpJQE0B24GhINvyWnGNai6UpuNaG082ODF6RJwPD6wD+S0HTwNL/TM8wpuq5n0gDhQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=EQ2y/X/ptPJFD+iotM2wxA40+FpQ2w8K5XIeQaQXarU=;

b=NJnFmxFI/S99pGeTJ+aUAHFEcQaLHuQma9ZH47DPSWm7qF3VCeOyNImO6zPRPjiI6JE8KPvPwFZUuW1gfLraqe7RkrovEbDgzHMMj8D9aqjyPQdAyf1nmE5fqdOe865Rk55I/otl+WnNkWnMEijZCa/3NdjeoMUu4tZD5+FMckJbr4XKPIOXHlzybQ6iH48yEIF7o6zIQbRyMO6LBgqu/reUHW1TvoxdoMrD5VL0i6dHao3jXZmsd/RYGYJ4EEQ2ByIXPEpv2eCJ3a9foQsfnaWDxPJVlPI8e3mfXSxVv1zhWj/9IpBDTu+5vPRTacTNUrTI39izOgsjA8hkrbSXHA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is

64.207.219.71) smtp.rcpttodomain=xoxomor.store smtp.mailfrom=docusign.net;

dmarc=pass (p=reject sp=reject pct=100) action=none header.from=docusign.net;

dkim=pass (signature was verified) header.d=docusign.net; arc=none (0)

Received: from DU2PR04MB9113.eurprd04.prod.outlook.com (2603:10a6:10:2f4::8)

by DUZPR04MB9745.eurprd04.prod.outlook.com (2603:10a6:10:4e1::5) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8398.24; Tue, 4 Feb

2025 16:47:48 +0000

Received: from DU2PR04MB9113.eurprd04.prod.outlook.com

([fe80::95f8:5344:a5fe:d1e5]) by DU2PR04MB9113.eurprd04.prod.outlook.com

([fe80::95f8:5344:a5fe:d1e5%4]) with mapi id 15.20.8398.025; Tue, 4 Feb 2025

16:47:47 +0000

Received: from DUZPR01CA0151.eurprd01.prod.exchangelabs.com

(2603:10a6:10:4bd::13) by AM9PR04MB8777.eurprd04.prod.outlook.com

(2603:10a6:20b:408::20) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8398.25; Tue, 4 Feb

2025 16:47:11 +0000

Received: from DU2PEPF00028D04.eurprd03.prod.outlook.com

(2603:10a6:10:4bd:cafe::4b) by DUZPR01CA0151.outlook.office365.com

(2603:10a6:10:4bd::13) with Microsoft SMTP Server (version=TLS1_3,

cipher=TLS_AES_256_GCM_SHA384) id 15.20.8398.24 via Frontend Transport; Tue,

4 Feb 2025 16:47:08 +0000

Authentication-Results: spf=pass (sender IP is 64.207.219.71)

smtp.mailfrom=docusign.net; dkim=pass (signature was verified)

header.d=docusign.net;dmarc=pass action=none header.from=docusign.net;

Received-SPF: Pass (protection.outlook.com: domain of docusign.net designates

64.207.219.71 as permitted sender) receiver=protection.outlook.com;

client-ip=64.207.219.71; helo=mailch.docusign.net; pr=C

Received: from mailch.docusign.net (64.207.219.71) by

DU2PEPF00028D04.mail.protection.outlook.com (10.167.242.164) with Microsoft

SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8398.14

via Frontend Transport; Tue, 4 Feb 2025 16:47:11 +0000

Received: from SE101FE152.corp.docusign.net (se-c103-f51-81.corp.docusign.net [10.101.81.137])

by mailch.docusign.net (Postfix) with ESMTP id 35B5820106B6

for ; Tue, 04 Feb 2025 16:47:10 +0000 (UTC)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=docusign.net;

s=mail1; t=1738687630;

bh=gWqBGBYaAxByjT/4yQ0uTHZEms1a8GEdNv7YxrWLG28=;

h=Reply-To:Feedback-ID:From:To:Date:Subject;

b=F1RHfXFHoMee/JZQT5gkXkW5TdTE44kFqsbY3tt1qkMiozw9Gys8vQABi6H8Sbtwz

s032T0i0VuKcrmLTipHWqlSzeTpQhNy0CmHCGXAReyKzKY75hzTRdzwfvP1HXVb8ps

nKwlS6TYc73Z9voqOxRCtken7l9FjrXVY+rY0/twQHrFHcrDTWtKchP/V5O4UqZsdT

zXTerJDsPobt47P0wry10kcXD7BcLFNBC2pSViQ5JHWpGwqxVrRl+d10s4AqC3wfrq

T+HA6SGOWjhQemrClzVlNSBRTpDsE9NIy97jl8mngqOHbkrVmlkq42SlQiGFISUpfR

V+9omI9hEZIXQ==

Received: from docusign.net ([127.0.0.1]) by SE101FE152.corp.docusign.net with Microsoft SMTPSVC(10.0.17763.1697);

Tue, 4 Feb 2025 08:47:09 -0800

Sender: DocuSign NA4 System

Reply-To: "Billing Team"

Recipient-Id: 43f9166e-7983-42c3-befb-0e3eda06de91

X-Debug: False

X-Email-Rejection-Mode: LearningMode

X-Api-Host: na4.docusign.net

Site-Id: 7

X-BounceEmailVersion: 1

Feedback-ID: 1:ff1e8948ed0aab956a87a93a0f9c9fda:EnvelopeActivation:Docusign_Prod

X-DS-Score: 1

From: "Billing Team via Docusign"

To: "Dear Customer"

Message-ID:

Date: Tue, 04 Feb 2025 08:47:09 -0800

Subject: Notification From PayPal

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_20F58451_E956_4B14_AC54_0FD24090E013"

X-OriginalArrivalTime: 04 Feb 2025 16:47:09.0954 (UTC) FILETIME=[6ED4F620:01DB7724]

X-EOPAttributedMessage: 0

X-EOPTenantAttributedMessage: d3569ad0-d051-4957-8326-dcaa2181d333:0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic:

DU2PEPF00028D04:EE_|AM9PR04MB8777:EE_|DUZPR04MB9745:EE_

X-MS-Office365-Filtering-Correlation-Id: 6a6f8d37-8600-4865-ff6c-08dd453b9237

X-Moderation-Data: 2/4/2025 4:47:46 PM

X-LD-Processed: d3569ad0-d051-4957-8326-dcaa2181d333,ExtAddr

X-MS-Exchange-SenderADCheck: 0

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam: BCL:0;ARA:13230040|1032899013|35002699018|3033299015;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?d2lPdFJsZm5Ub294SitlMUVsdzR1Z1RrOFJLMTM2UWV6VUZ5YW5tTlRqRjBO?=

=?utf-8?B?SFQyYnNNdVJ5Y0xpbGxTU2g3MTB2Nitqa2JMRndXbU5TSHFJVVVndFdjZUVs?=

=?utf-8?B?aUdWcE0rMFh3KzBKRVU1YUg0T2tqdFNvRnFTQkRXUHh5Z0F6RlNSZUp6aWNp?=

=?utf-8?B?cEJGWnFmUUZFUWcvUkdZNyt4NEtEbnVmM2VWZmtpbFpidzdxU3NycW9qaDZu?=

=?utf-8?B?aitSZVFyaExmc2ZYVjZxWTZFVG5sVkd6OXkrNWpLSnpzWXAvcjh1M0c5eTBF?=

=?utf-8?B?NVllZWN3RjUyVkEyRUhsbkFCMHVtT0VzVDN6TWRjSEhzKzZMZFd2V0pIZXRC?=

=?utf-8?B?Tjc2QWl5dENFdHAxSFUrTy9BWGprYkhPTjRWR25CZjk0V0FLTjJjcWUxUjlV?=

=?utf-8?B?V0lMMEVQM1BITU80UFRWbkgxQUl2WE5UN3B3VjJ5SnprSFJic2FYZGlQdG1F?=

=?utf-8?B?TkplZlZzUlhVc2Voam5YczY0Vk5obEVtVFZ0NTFrNWRQUmlWV0dPaEs0Q3d1?=

=?utf-8?B?SFNwTVJzSEZmWDJwQ0FqbkNrKzlheXNSQ3dBb1YydlBDc2xCT1UrSVdWQ2N5?=

=?utf-8?B?NTBMckg1bHFTaEhUY0wwRlNmOGxaMUYwbHp6NlFEanVSaDVEQWVLOG5mK1RB?=

=?utf-8?B?cnFlbWw4WVZKYzRjc0FzTzIzdnFVaVdiaUFyclVjY01hZnd1dGdQYTBvbjdK?=

=?utf-8?B?dUtRN0VBUUJKSDJaVXk3Q0R0SFYrNWpqM0NhNlNjcFR3WDZ3WHNRL0p0dG1S?=

=?utf-8?B?VTNhMmNsNkRiWWI5WkhmU3dNUGR6RnpNaTFZT05TZmRBLzBHZGtIcnBDUkJU?=

=?utf-8?B?N2hTSEpFK1NjWEVveEgwazRldHZVLzJjbW9tbWNZOVhpVThzbFFqVklIUUhl?=

=?utf-8?B?ZkFidzdkZlBnVU1DN05hcHE4TWUzQkNzT2c0K2Z1Vlo1UzdiNFIwMUtibEdV?=

=?utf-8?B?enQ1QytxWC9zb1hTSG9hNG14SzUzV2lUNHJ2M1h0a3NDd3A5Y2k2Q05oYW8z?=

=?utf-8?B?eWtKc2taQmdJL0RtaGJMbWtLMmF5eU1CN2JCcWcxaXR4YWJHaVFJUS9KQ1lz?=

=?utf-8?B?Q0ZvYmx4RXM3emdscEo0TkdBQ1VBUUFkSDMyV0VWazFhQUQvRmladkNBZ0Fl?=

=?utf-8?B?aENYUEpZa3FOVUlRZThtUE5wMitlMnpVMmJXRkJjRSt3TGMzQjZxUGdzNmpX?=

=?utf-8?B?QS9Rc2xZcmRjUUpUY2FoeVE2U0VQUHlKaElyVXZUL0ZNdmN0QnZiOFVaT3M1?=

=?utf-8?B?SjhEeTFKYlFMZGFzOVZjSHF3d3cyVzgwUjdlc09ieFlMaXdOY2xMSFFIbEpL?=

=?utf-8?B?TFdiSkZWZ09XZGhUUDhGdENVOERNaWhCT2J3dzR0ck83OVhBYzFOT3p5ekdj?=

=?utf-8?B?MVlnZDdaaXE3L3hwRE92M3NyTGp4aDlieDEyTmNOVkpiUnQxbW5XRzV5TlY4?=

=?utf-8?B?a2g4Y0huZWZET2xrektVK2RQcmJ6bnlxMFZEUFVTNUg4RUM4S2J3dUtpaXJQ?=

=?utf-8?B?SkNkbUEyQjV0QVgxd2liaURSZkc2V3NWV0JtS0QzNmpObGtWK1JCNmp0QTl4?=

=?utf-8?B?ajdYdUd5UWRSenFRNlptb1FPbkpVN3h6RmFuVkdJK0tYbVdJRUlsQzNKS3E0?=

=?utf-8?B?V3EwMWd0NFpGUzNkSEcwVUZFZjU4ZitUL251WjgrSFppZFU1MFBra2NvRHFG?=

=?utf-8?B?WFkrMk5zaGlLRW9RRnZFellLdDgrTE01engxcXhoVk1VeVhxVmppRlUvK2pa?=

=?utf-8?B?QVpHK3cvWW80eXdYUjJRbEg3eWY1VTMxbG1BVE40ZUFhZWl3WHZ4dldPb2NS?=

=?utf-8?B?clNyaHJFS0ZRT2ZLVW42YVh1dTFSazYrODZNZ3NaK0lTYS9qNndIdnlndkRv?=

=?utf-8?B?d1hsN0tzZ1RuaGJVSno2VDdSKzFDanlBQy92cUJBaGJMWkY4SWlDdTh4aVU4?=

=?utf-8?B?NzJvS3piU2lrYmJzSHFUcVB4QSt4d0o4VnZhK0VHSkN3d1UrNmkwYzZ4QlNV?=

=?utf-8?B?QVpLYlo4cmlDcWZjUnFVY2JqSWlONCthSkZoSU9zUldrOGlCWm4zdEtYc2Zn?=

=?utf-8?B?QTM0OWFlUVk2bHdvVkxaSlRGVkovVElPeVg5TDZhQ0ZWck9mZVVQV2hYdUs2?=

=?utf-8?B?VFBZd21jamV0UGJiQmNPTU15bkdYckpQR3hScGRYNDBOdlQ2UGsyYlVnbkx0?=

=?utf-8?B?RzVSaXo3WXB5QytDMnZPdVkxSEhCMUZQNVRVZXBlRmdXbTJVcVU4MndGQkpZ?=

=?utf-8?B?eDZPUUozdlEvaWYxbit5cFM4Z09GWEJ4dHRwd3p1RTJTS1A1cGRzeVVKalln?=

=?utf-8?B?L1NkSXF3M0lyaFkwZGVTQm5TU0FoOEpuZDVXa3hZTFEydVZ1NEJTOXQ1eVo1?=

=?utf-8?B?NC9aMmdvdi9EZ2hJdVpXNTVRRTZ5NkQvSEk5WC9MMTBHTTNScXdZWThnM2pp?=

=?utf-8?B?RVFQYnc5aG9GTkhmSXJnMGIrYkQxUWpJdXhLWTBQcmV4RThmZ1NieTZFcDFP?=

=?utf-8?B?clRpRmEzT2pMaURwcU9XNUxpNThsR1lWQ09yeUQxUkg4N3FyZUZ3SEpGbzhJ?=

=?utf-8?B?YnB1K3BPRFkrQ1Ixbk9sUDREbTUzeVpBYlRuUXdsTFM4NEZMeUx3R09lRjFj?=

=?utf-8?B?bllPcS80azYzZE9CREdoWDFMeCtMWGMxN3d3ajJ6YTNWVTVtZ3duTW9IRlNQ?=

=?utf-8?B?ZVI2QVBlT1lNTXdpY2UwQlEyWHlHWXk0bkZtQWJFUUQvYTRzbHczOHdJVm9v?=

=?utf-8?B?cGY1ZzYvNDR1RCtCQ3kxeHRGVUtzcTFwOHFHdm9MNHJwWmczUmlteUM4U2RZ?=

=?utf-8?B?MXg0MDA0ZU14eXhkYW0rWDg1bHVwRks1cEdPLzh1RGFDZVhjb2NpSUhYZ2dY?=

=?utf-8?B?NS9VSnpWbmJzdWVXODI2SWp3eHdhZ201MDRhRVZMaXBUTVk0QmhmK2tpUHV2?=

=?utf-8?B?Z3VJOENNTGFDQW9yOCtFT01WVFcvcWw5dWZ3RFJZLzRhMmFyNjNZSW5iTmQ5?=

=?utf-8?B?LzcrMXpla1dKMkFLT01NMWxKUFJCY2R2R01OR25tT2ZKb3J1R2JJZEZ3RnNK?=

=?utf-8?B?dk9pd3NiRmZYd2dQNDZtYkhxZ29UMjRwMFpXeXRZZ1loSXpicFg5M0xEUFFU?=

=?utf-8?B?ZjlvTkFlZnZ3TFFiYytnRFMwSERLWVdJdWZqbm91a0NiOUFIcU5IMGFRMlRq?=

=?utf-8?B?YlA0Q25rV1M2YU1BUjNyMFRRS2NWVURRY3hnRkkvTGlrbWdQSXUvdlpJdjln?=

=?utf-8?B?UjJOOU1zZVJyYU5OUWp2MU9KSjBsNUxaeSs0U1FwbGUrRko5MStjSFpLcWNC?=

=?utf-8?B?eitCak4xTnBqRGdzZ0xCL0VocjVBVVFRPT0=?=

X-Forefront-Antispam-Report:

CIP:64.207.219.71;CTRY:US;LANG:en;SCL:8;SRV:;IPV:NLI;SFV:SPM;H:mailch.docusign.net;PTR:mailch.docusign.net;CAT:OSPM;SFS:(13230040)(1032899013)(35002699018)(3033299015);DIR:OUT;SFP:1501;

X-Auto-Response-Suppress: DR, OOF, AutoReply

X-OriginatorOrg: xoxomor.store

X-MS-Exchange-CrossTenant-Network-Message-Id: 6a6f8d37-8600-4865-ff6c-08dd453b9237

X-MS-Exchange-CrossTenant-Id: d3569ad0-d051-4957-8326-dcaa2181d333

X-MS-Exchange-CrossTenant-AuthSource: DU2PEPF00028D04.eurprd03.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: Internet

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Feb 2025 16:47:47.9544

(UTC)

X-MS-Exchange-CrossTenant-MailboxType: HOSTED

X-MS-Exchange-CrossTenant-UserPrincipalName: qf9vsyJUelDKxIQ4XpD1OGLCNaCUYM2iM4DyAI14VhWndw5wpTq1aRCUALrvWJYyMrJZeoc5xxJFb2ThYkG6RYvB2hNOqOtn/PQa59L5GTrDDk0j8Pb5LPZU8V5LifQ7gJQNLZtjfNisK/RTWPQoNgWb5srb4c5ANyoVVAw474Yp1lXsmT7rLk0KiKVTiqS67/gLH9XtJPeQcNZ+UvMLlvRNl7lOsJ9s3lKySLs1f4Y=

X-MS-Exchange-Transport-CrossTenantHeadersStamped: DUZPR04MB9745

X-Spam_score: 6.2

X-Spam_score_int: 62

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello Dear Customer, Billing Team has sent you a new Docusign

document to view and sign. Please click on the link below to begin signing.

We have observed an attempt to charge $649.89 to your PayPal account for

the purchase of 0.0066 Bitcoin. To safeguard your account, this transaction,

which came from an unidentified IP address in Texa [...]



Content analysis details: (6.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[64.207.219.71 listed in will-spam-for-food.eu.org]

[64.207.219.71 listed in will-spam-for-food.eu.org]

[64.207.219.71 listed in will-spam-for-food.eu.org]

[64.207.219.71 listed in will-spam-for-food.eu.org]

[64.207.219.71 listed in will-spam-for-food.eu.org]

[64.207.219.71 listed in will-spam-for-food.eu.org]

[64.207.219.71 listed in will-spam-for-food.eu.org]

[64.207.219.71 listed in will-spam-for-food.eu.org]

[2603:10a6:10:4bd:cafe:0:0:4b listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4bd:cafe:0:0:4b listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4bd:cafe:0:0:4b listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4bd:cafe:0:0:4b listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4bd:cafe:0:0:4b listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4bd:cafe:0:0:4b listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4bd:cafe:0:0:4b listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4bd:cafe:0:0:4b listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4bd:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4bd:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4bd:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4bd:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4bd:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4bd:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4bd:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4bd:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:2f4:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:2f4:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:2f4:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:2f4:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:2f4:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:2f4:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:2f4:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:2f4:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[52.100.174.201 listed in will-spam-for-food.eu.org]

[52.100.174.201 listed in will-spam-for-food.eu.org]

[52.100.174.201 listed in will-spam-for-food.eu.org]

[52.100.174.201 listed in will-spam-for-food.eu.org]

[52.100.174.201 listed in will-spam-for-food.eu.org]

[52.100.174.201 listed in will-spam-for-food.eu.org]

[52.100.174.201 listed in will-spam-for-food.eu.org]

[52.100.174.201 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[52.100.174.201 listed in dnsbl.ahbl.org]

[52.100.174.201 listed in dnsbl.ahbl.org]

[52.100.174.201 listed in dnsbl.ahbl.org]

[52.100.174.201 listed in dnsbl.ahbl.org]

[2603:10a6:10:2f4:0:0:0:8 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:2f4:0:0:0:8 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:2f4:0:0:0:8 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:2f4:0:0:0:8 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:4bd:0:0:0:13 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:4bd:0:0:0:13 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:4bd:0:0:0:13 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:4bd:0:0:0:13 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:4bd:cafe:0:0:4b listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:4bd:cafe:0:0:4b listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:4bd:cafe:0:0:4b listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:4bd:cafe:0:0:4b listed in]

[dnsbl.ahbl.org]

[64.207.219.71 listed in dnsbl.ahbl.org]

[64.207.219.71 listed in dnsbl.ahbl.org]

[64.207.219.71 listed in dnsbl.ahbl.org]

[64.207.219.71 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[52.100.174.201 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[52.100.174.201 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[52.100.174.201 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[52.100.174.201 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.100.174.201 listed in list.dnswl.org]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[52.100.174.201 listed in sa-trusted.bondedsender.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[52.100.174.201 listed in sa-accredit.habeas.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.100.174.201 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[52.100.174.201 listed in bl.score.senderscore.com]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[52.100.174.201 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.0 ARC_SIGNED Message has a ARC signature

0.0 ARC_VALID Message has a valid ARC signature

0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[tube_x159(at)yopmail.com]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.3 LONGWORD BODY: Uses overlong words

0.1 TW_MZ BODY: Odd Letter Triples with MZ

0.6 MEGALONGWORD BODY: Uses really overlong words

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 NO_RDNS2 Sending MTA has no reverse DNS

1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} Notification From PayPal



------=_NextPart_20F58451_E956_4B14_AC54_0FD24090E013

Content-type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable



Hello Dear Customer,



Billing Team has sent you a new Docusign document to view and sign=2E P=

lease click on the link below to begin signing=2E



We have observed an attempt to charge $649=2E89 to your PayPal account =

for the purchase of 0=2E0066 Bitcoin=2E To safeguard your account, this=

transaction, which came from an unidentified IP address in Texas, has =

been temporarily blocked=2E=20



You Must Do

Please get in touch with us right away to prevent further action if you=

did not approve this transaction=2E=20



The Way to Get in Touch with Us=20

PayPal Resolution Center=F0=9F=93=9E 24/7 Toll-Free Help: +1 (877) 513-=

3656

To see more information, click "REVIEW NOW=2E"=20



Details of the Transaction: Bitcoin (0=2E0066BTC)=20

The total amount charged was $649=2E89=2E=20

Date of Transaction: February4, 2025;

Invoice ID: RRY-70003691



Subsequent Activities=20

To dispute or immediately cancel an unauthorized charge, call +1 (877) =

513-3656=2E=20

If authorized: Nothing needs to be done=2E=20



We Put Your Security First=2E=20

Remember that PayPal will never ask for=20



Thank you for choosing PayPal=2E

PayPal Security Team

=C2=A9 1999-2025 PayPal, Inc=2E All rights reserved=2E



=20



REVIEW DOCUMENT



https://na4=2Edocusign=2Enet/Signing/EmailStart=2Easpx?a=3D94f28582-c8a=

9-40c3-a0ce-e359990dd2bc&etti=3D24&acct=3D7f6da93a-04a2-4c1b-8459-ecf6d=

596c013&er=3D43f9166e-7983-42c3-befb-0e3eda06de91



If clicking the link does not work, you can highlight and copy the enti=

re line above and paste it into your browser to get started=2E



This message was sent to you by Billing Team who is using the Docusign =

Electronic Signature Service=2E If you would rather not receive email f=

rom this sender you may contact the sender with your request=2E



Do Not Share This Email

This email contains a secure link to Docusign=2E Please do not share th=

is email, link, or access code with others=2E



Questions about the Document?

If you need to modify the document or have questions about the details =

in the document, please reach out to the sender by emailing them direct=

ly=2E



Stop receiving this email

Report this email https://protect=2Edocusign=2Enet/report-abuse?e=3DAUt=

omjpFak9GlbPL0zFFi111xlVFj293S2wijW3WyMfmxf_gbh4Vyk6vAfOTSp0CYiZb6YerQH=

Ej4t9mKZiNsYBDbqYDEH474ljpLedLxQbk5SvMFk2cskTuGCL4qA0p4Y3AbGq756izIOcKg=

Vf21Yf8PRUtsfwfeu2Xa44st_94lBo3WzcjYJ954iittV9Nkblelhoygf412P59E8KRSo3U=

lfPgD02lg7oMd1EhOK9N0VA25DhoEDVjgk3JI41lkyb9QPuDY33qKVGfdw68O0ej9DS7tzz=

-v4dv6uqlcKSuH0YEfHzxSGHTK5zFhGQyULyPCjt-mzsGc5Al7-WsFzRp8RdNvO73UuN1Ea=

9letB8Y7aEqzKIdTlhInVyIhBUy-y3K1EhwNq6lu_w-xM9tiysdDFN63TKKQlCuHCbKCuNd=

UFtGZ8sHBF6bUGLcWnZUg&lang=3Den

Declining to sign=20

Managing notifications=20



If you have trouble signing, visit "How to Sign a Document" on our Docu=

sign Support Center, or browse our Docusign Community for more informat=

ion=2E

https://support=2Edocusign=2Ecom/s/articles/How-do-I-sign-a-DocuSign-do=

cument-Basic-Signing?language=3Den_US&utm_campaign=3DGBL_XX_DBU_UPS=

_2211_SignNotificationEmailFooter&utm_medium=3Dproduct&utm_sour=

ce=3Dpostsend

------=_NextPart_20F58451_E956_4B14_AC54_0FD24090E013

Content-type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable




xt/html; charset=3DUTF-8"/>
cale=3D1=2E0"/>
o"/>EnvelopeActivation
olor:#EAEAEA;padding:2%;font-family:Helvetica,Arial,Sans Serif;">
role=3D'presentation' border=3D'0' cellspacing=3D'0' cellpadding=3D'0'=

align=3D'center' width=3D"100%" dir=3D"">
">
rspace:0pt;border-collapse:collapse;background-color:#ffffff;max-width:=

640px;">

" width=3D"116" src=3D"https://docucdn-a=2Eakamaihd=2Enet/olive/images/=

2=2E62=2E0/global-assets/email-templates/email-logo=2Epng" alt=3D"DocuS=

ign"/>

le=3D'presentation' border=3D'0' cellspacing=3D'0' cellpadding=3D'0' wi=

dth=3D'100%' align=3D'center' style=3D'background-color:#260559;color:#=

FFFFFF;'>

;background-color:#260559;color:#FFFFFF;font-size:16px;font-family:Helv=

etica,Arial,Sans Serif;width:100%;text-align:center;" align=3D"center">=


et/olive/images/2=2E76=2E0/email/iconSignWhite=2Epng" style=3D"width:75=

px;height:75px;" alt=3D"" />
ellspacing=3D'0' cellpadding=3D'0' width=3D'100%'>

ing-top:24px;font-size:16px;font-family:Helvetica,Arial,Sans Serif;bord=

er:none;text-align:center;color:#FFFFFF" align=3D"center"> Billing Team=

sent you a document to review and sign=2E

e=3D'presentation' border=3D'0' cellspacing=3D'0' cellpadding=3D'0' wid=

th=3D'100%'>
<=

table cellspacing=3D"0" cellpadding=3D"0">

ht=3D"44" style=3D"font-size:15px;color:#FFFFFF;background-color:#735AF=

F;font-family:Helvetica,Arial,Sans Serif;font-weight:bold;text-align:ce=

nter;text-decoration:none;;border-radius:2px;background-color:#735AFF;;=

display: block;">
tart=2Easpx?a=3D94f28582-c8a9-40c3-a0ce-e359990dd2bc&etti=3D24&acct=3D7=

f6da93a-04a2-4c1b-8459-ecf6d596c013&er=3D43f9166e-7983-42c3-befb-0e3eda=

06de91" style=3D"font-size:15px;color:#FFFFFF;background-color:#735AFF;=

font-family:Helvetica,Arial,Sans Serif;font-weight:bold;text-align:cent=

er;text-decoration:none;;border-radius:2px;background-color:#735AFF;;di=

splay:inline-block">
> REVIEW D=

OCUMENT
span>

td>
size:16px;font-family:Helvetica,Arial,Sans Serif;background-color:white=

;">
ing=3D'0'>

g style=3D"height:40px;width:40px;border-radius:2px;" height=3D"40" wid=

th=3D"40" src=3D"https://NA4=2Edocusign=2Enet/Member/image=2Easpx?i=3Dl=

ogo&l=3D2aebca2c-affc-4564-bd6a-2ddf4a5caf6b" alt=3D"Picture of Billing=

Team" />

ily:Helvetica,Arial,Sans Serif;font-weight:bold;line-height:18px;font-s=

ize:15px;color:#333333;"> Billing Team

Helvetica,Arial,Sans Serif;line-height:18px;font-size:15px;color:#66666=

6;">tube_x159@yopmail=2Ecom

size:15px;color:#333333;font-family:Helvetica,Arial,Sans Serif;line-hei=

ght:20px;">We have observed an attempt to charge $649=2E89 to your PayP=

al account for the purchase of 0=2E0066 Bitcoin=2E To safeguard your ac=

count, this transaction, which came from an unidentified IP address in =

Texas, has been temporarily blocked=2E

You Must Do
Plea=

se get in touch with us right away to prevent further action if you did=

not approve this transaction=2E


The Way to Get in Touc=

h with Us
PayPal Resolution Center=F0=9F=93=9E 24/7 Toll-Free Hel=

p: +1 (877) 513-3656
To see more information, click "REVIEW NOW=2E=

"

Details of the Transaction: Bitcoin (0=2E0066BTC)
Th=

e total amount charged was $649=2E89=2E
Date of Transaction: Febr=

uary4, 2025;
Invoice ID: RRY-70003691

Subsequent Activit=

ies
To dispute or immediately cancel an unauthorized charge, call=

+1 (877) 513-3656=2E
If authorized: Nothing needs to be done=2E =



We Put Your Security First=2E
Remember that PayPal wil=

l never ask for

Thank you for choosing PayPal=2E
PayPal=

Security Team
=C2=A9 1999-2025 PayPal, Inc=2E All rights reserved=

=2E


24px;background-color:#ffffff;font-family:Helvetica,Arial,Sans Serif;fo=

nt-size:11px;color:#666666;">
px 45px 24px;background-color:#EAEAEA;">


ont-family:Helvetica,Arial,Sans Serif;font-size:13px;color:#666666;line=

-height:18px;">Do Not Share This E=

mail

This email contains a secure link to Docusign=2E Please d=

o not share this email, link, or access code with others=2E


style=3D"margin-bottom:1em;font-family:Helvetica,Arial,Sans Serif;font-=

size:13px;color:#666666;line-height:18px;">
heading">Alternate Signing Method

Visit Docusign=2Ecom, click =

'Access Documents', and enter the security code:
94F28582C8A940C3=

A0CEE359990DD2BC7


ca,Arial,Sans Serif;font-size:13px;color:#666666;line-height:18px;">
aria-level=3D"3" role=3D"heading">About Docusign

Sign document=

s electronically in just minutes=2E It's safe, secure, and legally bind=

ing=2E Whether you're in an office, at home, on-the-go -- or even acros=

s the globe -- Docusign provides a professional trusted solution for Di=

gital Transaction Management=E2=84=A2=2E


1em;font-family:Helvetica,Arial,Sans Serif;font-size:13px;color:#666666=

;line-height:18px;">Questions abou=

t the Document?

If you need to modify the document or have qu=

estions about the details in the document, please reach out to the send=

er by emailing them directly=2E


heading">Stop receiving this email


docusign=2Enet/report-abuse?e=3DAUtomjpFak9GlbPL0zFFi111xlVFj293S2wijW3=

WyMfmxf_gbh4Vyk6vAfOTSp0CYiZb6YerQHEj4t9mKZiNsYBDbqYDEH474ljpLedLxQbk5S=

vMFk2cskTuGCL4qA0p4Y3AbGq756izIOcKgVf21Yf8PRUtsfwfeu2Xa44st_94lBo3WzcjY=

J954iittV9Nkblelhoygf412P59E8KRSo3UlfPgD02lg7oMd1EhOK9N0VA25DhoEDVjgk3J=

I41lkyb9QPuDY33qKVGfdw68O0ej9DS7tzz-v4dv6uqlcKSuH0YEfHzxSGHTK5zFhGQyULy=

PCjt-mzsGc5Al7-WsFzRp8RdNvO73UuN1Ea9letB8Y7aEqzKIdTlhInVyIhBUy-y3K1EhwN=

q6lu_w-xM9tiysdDFN63TKKQlCuHCbKCuNdUFtGZ8sHBF6bUGLcWnZUg&lang=3Den' sty=

le=3D'color:#2463d1;' >Report this email
or read more about
=3D'https://support=2Edocusign=2Ecom/en/guides/Declining-to-sign-DocuSi=

gn-Signer-Guide' style=3D'color:#2463d1;' >Declining to sign
and
href=3D'https://support=2Edocusign=2Ecom/en/articles/How-do-I-manage-m=

y-email-notifications' style=3D'color:#2463d1;' >Managing notifications=

=2E

If you have trouble signing, visit "
s://support=2Edocusign=2Ecom/s/articles/How-do-I-sign-a-DocuSign-docume=

nt-Basic-Signing?language=3Den_US&utm_campaign=3DGBL_XX_DBU_UPS_221=

1_SignNotificationEmailFooter&utm_medium=3Dproduct&utm_source=3D=

postsend' style=3D'color:#2463d1;' >How to Sign a Document
" on our =


>Docusign Support Center
, or browse our
y=2Edocusign=2Ecom/esignature-111?utm_campaign=3DGBL_US_PRD_AWA_2405_Co=

mmunityCTA&utm_medium=3Demail&utm_source=3Dpostsend' style=3D'c=

olor:#2463d1;' >Docusign Community
for more information=2E

/>


erif;font-size:13px;color:#666666;line-height:18px;">
/www=2Edocusign=2Ecom/features-and-benefits/mobile?utm_campaign=3DGBL_X=

X_DBU_UPS_2211_SignNotificationEmailFooter&utm_medium=3Dproduct&=

;utm_source=3Dpostsend" style=3D"color:#2463d1;" >
right:7px;border:none;vertical-align:middle;" width=3D"18" height=3D"18=

" src=3D"https://docucdn-a=2Eakamaihd=2Enet/olive/images/2=2E62=2E0/glo=

bal-assets/email-templates/icon-download-app=2Epng" alt=3D"" />Download=

the Docusign App


vetica,Arial,Sans Serif;font-size:13px;color:#666666;line-height:18px;f=

ont-size:10px;line-height:14px;">This message was sent to you by Billin=

g Team who is using the Docusign Electronic Signature Service=2E If you=

would rather not receive email from this sender you may contact the se=

nder with your request=2E


le><=

meta itemprop=3D"text" content=3D"Billing Team sent you a document to r=

eview and sign=2E"/>
"http://schema=2Eorg/CreativeWork">
ion" itemtype=3D"http://schema=2Eorg/ViewAction">
content=3D"https://na4=2Edocusign=2Enet/Signing/EmailStart=2Easpx?a=3D=

94f28582-c8a9-40c3-a0ce-e359990dd2bc&etti=3D24&acct=3D7f6da93a-04a2-4c1=

b-8459-ecf6d596c013&er=3D43f9166e-7983-42c3-befb-0e3eda06de91"/>
temprop=3D"name" content=3D"View Documents"/>

y>

------=_NextPart_20F58451_E956_4B14_AC54_0FD24090E013--

Trackbacks

Trackback specific URI for this entry

This link is not meant to be clicked. It contains the trackback URI for this entry. You can use this URI to send ping- & trackbacks from your own blog to this entry. To copy the link, right click and select "Copy Shortcut" in Internet Explorer or "Copy Link Location" in Mozilla.

No Trackbacks

Comments

Display comments as Linear | Threaded

No comments

Add Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA