Docusign phish from Google Gmail part 2
Posted by Dave Yadallee on
=EF=BB=BF
name=3D"viewport" />
name=3D"viewport" />
Docusign phish from Google Gmail part 1
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 09 Jul 2026 14:15:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1whv8V-000000000n1-1unK
for dave@doctor.nl2k.ab.ca;
Thu, 09 Jul 2026 14:14:19 -0600
Resent-From: The Doctor
Resent-Date: Thu, 9 Jul 2026 14:14:19 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-qv1-f104.google.com ([209.85.219.104]:46166)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1whuyp-00000000KZ8-45C8
for root@nl2k.ab.ca;
Thu, 09 Jul 2026 14:04:29 -0600
Received: by mail-qv1-f104.google.com with SMTP id 6a1803df08f44-8f0d6853360so2605506d6.0
for; Thu, 09 Jul 2026 13:03:32 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=sabeng.it; s=google; t=1783627406; x=1784232206; darn=nl2k.ab.ca;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=CBCnKi6yFedusYVAYEog8Pbq6nVfckjxBILUJZflDog=;
b=UJBmP9bjf1fxV94IBKqeiCLjKXWwdtfj+SBMT4sfuGx1JoteDw9AF7Z4lJ37QT1Jk/
3yJpzpJ7YleH5b4bU+G5R67cY+64aqJy5CvD7I73AcL8vwpizL51ruGQFswrXOLNLzYt
OBnYZw+8xYhVvt/czXSjiwlwM+yea8y8Kof3s=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1783627406; x=1784232206;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date
:message-id:reply-to:content-type;
bh=CBCnKi6yFedusYVAYEog8Pbq6nVfckjxBILUJZflDog=;
b=W8y1L4QW04OiGrvp7+lSDbDIWak6ORjboQNbQK3zv5QFAFFHl8RpjjcQPTy7CmVnga
fbmNme0Ht7fPyJKa8EuJM5lDnfyutWeQOuyBCcxV6TOaLPLQLSm5aFBdCZgcOXSyyR3e
32FIdM5Q2gx7Lqo+zkghFw0hsXMgQPpLPblzSCv8HfAnJC15e5U37/vW875aLptK5z3k
cPBS7kPE7xuFnsGvRCLl5xjcpRX6L5RXf1tXlGjM/hKR8B1SrEagiCtvNy4oaLD+l8xe
62fdnVMyqk0DjMZRHS/0y/QgnK3JmST9l67mEPgn42QRduulh7tqStBClWEy01IbKQXs
T3hA==
X-Gm-Message-State: AOJu0YwhQ/X4zfZ/5EyGCtgPWoNxcyMmg94jh3Nngbawsa5Cwmf8+gmN
Q5haeU2Fqj5MKsnL68MqJs0eE2vFjVbcyjIv8Edzz7FNaCJ6L+Y/5VhyBi0EXTN6XlxjWYpfpAL
dPEfyF5DRhqRTTDIcyglONJEtA+Bo9O5k4oeP9DnFWsPJGS8=
X-Gm-Gg: AfdE7cmu8bgJSskNzTkq+95KV2Rm7pa1kbJMKBdxetoSIPfpZLOFTnBfdQ6Xkf4iHaO
aZFTnx/cihtDv57w1SNzVDFIfbvMc0Ko7enULVWmI3XUJQV9xAdeQ9aspDAUL0UFqKghWCUwHZx
ICOKM+JQ3sjkkVEivErHOcqVZqQY8i01OAzGwNGJZ24YP19UWzRYeoBsGRuIX/37R7VeoEyrjF7
kZXAAQha+jpyzP6KulGnq6tXzQTrzBys9yr/6CEvYyzI3MY6d0gWF31AulfdoinEEnzhQ7xsAat
s/1eHVAm+1eYxzj25wA3kRWDs5X5ZiMB8cAURqYLQa1FEVFDCIMW2H9dunQt9ng8f/SIyskOpgC
Z0ViL6HgYXz8uJqjGQn51AQ==
X-Received: by 2002:a05:6214:2347:b0:8f1:4bff:3a55 with SMTP id 6a1803df08f44-8fec693a73bmr91116096d6.38.1783627405634;
Thu, 09 Jul 2026 13:03:25 -0700 (PDT)
Received: from sabprogetti.com ([192.210.236.148])
by smtp-relay.gmail.com with ESMTPS id 6a1803df08f44-8ffd9751461sm1877466d6.26.2026.07.09.13.03.25
for
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Thu, 09 Jul 2026 13:03:25 -0700 (PDT)
X-Relaying-Domain: sabeng.it
From: "Incoming_Remittance| Scheduled | Online/OU=EXCHANGE ADMINISTRATIVE
GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-49098"
To: root@nl2k.ab.ca
Subject: =?UTF-8?Q?Please_Review_the_Attached_Slip=2C_Invoi?=
=?UTF-8?Q?ce_=26_Payment_Report_=EF=BF=BD_07/09/20?=
=?UTF-8?Q?26_=EF=BF=BD_root=40nl2k=2Eab=2Eca?=
Message-ID: <4bd9ba81-66f8-369f-01fe-5b1fb4e6c450@sabeng.it>
Content-Transfer-Encoding: quoted-printable
Date: Thu, 09 Jul 2026 20:03:24 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=utf-8
X-Spam_score: 6.1
X-Spam_score_int: 61
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview:  A document has been sent for your review View Document
Please review the attached document at your convenience. Contact the sender
if you have questions.
Content analysis details: (6.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[209.85.219.104 listed in dnsbl.ahbl.org]
[209.85.219.104 listed in dnsbl.ahbl.org]
[209.85.219.104 listed in dnsbl.ahbl.org]
[209.85.219.104 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[209.85.219.104 listed in will-spam-for-food.eu.org]
[209.85.219.104 listed in will-spam-for-food.eu.org]
[209.85.219.104 listed in will-spam-for-food.eu.org]
[209.85.219.104 listed in will-spam-for-food.eu.org]
[209.85.219.104 listed in will-spam-for-food.eu.org]
[209.85.219.104 listed in will-spam-for-food.eu.org]
[209.85.219.104 listed in will-spam-for-food.eu.org]
[209.85.219.104 listed in will-spam-for-food.eu.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.219.104 listed in list.dnswl.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.219.104 listed in bl.score.senderscore.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.219.104 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 NO_RDNS2 Sending MTA has no reverse DNS
0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
Subject: {SPAM?} =?UTF-8?Q?Please_Review_the_Attached_Slip=2C_Invoi?=
=?UTF-8?Q?ce_=26_Payment_Report_=EF=BF=BD_07/09/20?=
=?UTF-8?Q?26_=EF=BF=BD_root=40nl2k=2Eab=2Eca?=
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 09 Jul 2026 14:15:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from
id 1whv8V-000000000n1-1unK
for dave@doctor.nl2k.ab.ca;
Thu, 09 Jul 2026 14:14:19 -0600
Resent-From: The Doctor
Resent-Date: Thu, 9 Jul 2026 14:14:19 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-qv1-f104.google.com ([209.85.219.104]:46166)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.99.3 (FreeBSD))
(envelope-from
id 1whuyp-00000000KZ8-45C8
for root@nl2k.ab.ca;
Thu, 09 Jul 2026 14:04:29 -0600
Received: by mail-qv1-f104.google.com with SMTP id 6a1803df08f44-8f0d6853360so2605506d6.0
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=sabeng.it; s=google; t=1783627406; x=1784232206; darn=nl2k.ab.ca;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=CBCnKi6yFedusYVAYEog8Pbq6nVfckjxBILUJZflDog=;
b=UJBmP9bjf1fxV94IBKqeiCLjKXWwdtfj+SBMT4sfuGx1JoteDw9AF7Z4lJ37QT1Jk/
3yJpzpJ7YleH5b4bU+G5R67cY+64aqJy5CvD7I73AcL8vwpizL51ruGQFswrXOLNLzYt
OBnYZw+8xYhVvt/czXSjiwlwM+yea8y8Kof3s=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1783627406; x=1784232206;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date
:message-id:reply-to:content-type;
bh=CBCnKi6yFedusYVAYEog8Pbq6nVfckjxBILUJZflDog=;
b=W8y1L4QW04OiGrvp7+lSDbDIWak6ORjboQNbQK3zv5QFAFFHl8RpjjcQPTy7CmVnga
fbmNme0Ht7fPyJKa8EuJM5lDnfyutWeQOuyBCcxV6TOaLPLQLSm5aFBdCZgcOXSyyR3e
32FIdM5Q2gx7Lqo+zkghFw0hsXMgQPpLPblzSCv8HfAnJC15e5U37/vW875aLptK5z3k
cPBS7kPE7xuFnsGvRCLl5xjcpRX6L5RXf1tXlGjM/hKR8B1SrEagiCtvNy4oaLD+l8xe
62fdnVMyqk0DjMZRHS/0y/QgnK3JmST9l67mEPgn42QRduulh7tqStBClWEy01IbKQXs
T3hA==
X-Gm-Message-State: AOJu0YwhQ/X4zfZ/5EyGCtgPWoNxcyMmg94jh3Nngbawsa5Cwmf8+gmN
Q5haeU2Fqj5MKsnL68MqJs0eE2vFjVbcyjIv8Edzz7FNaCJ6L+Y/5VhyBi0EXTN6XlxjWYpfpAL
dPEfyF5DRhqRTTDIcyglONJEtA+Bo9O5k4oeP9DnFWsPJGS8=
X-Gm-Gg: AfdE7cmu8bgJSskNzTkq+95KV2Rm7pa1kbJMKBdxetoSIPfpZLOFTnBfdQ6Xkf4iHaO
aZFTnx/cihtDv57w1SNzVDFIfbvMc0Ko7enULVWmI3XUJQV9xAdeQ9aspDAUL0UFqKghWCUwHZx
ICOKM+JQ3sjkkVEivErHOcqVZqQY8i01OAzGwNGJZ24YP19UWzRYeoBsGRuIX/37R7VeoEyrjF7
kZXAAQha+jpyzP6KulGnq6tXzQTrzBys9yr/6CEvYyzI3MY6d0gWF31AulfdoinEEnzhQ7xsAat
s/1eHVAm+1eYxzj25wA3kRWDs5X5ZiMB8cAURqYLQa1FEVFDCIMW2H9dunQt9ng8f/SIyskOpgC
Z0ViL6HgYXz8uJqjGQn51AQ==
X-Received: by 2002:a05:6214:2347:b0:8f1:4bff:3a55 with SMTP id 6a1803df08f44-8fec693a73bmr91116096d6.38.1783627405634;
Thu, 09 Jul 2026 13:03:25 -0700 (PDT)
Received: from sabprogetti.com ([192.210.236.148])
by smtp-relay.gmail.com with ESMTPS id 6a1803df08f44-8ffd9751461sm1877466d6.26.2026.07.09.13.03.25
for
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Thu, 09 Jul 2026 13:03:25 -0700 (PDT)
X-Relaying-Domain: sabeng.it
From: "Incoming_Remittance| Scheduled | Online/OU=EXCHANGE ADMINISTRATIVE
GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-49098"
To: root@nl2k.ab.ca
Subject: =?UTF-8?Q?Please_Review_the_Attached_Slip=2C_Invoi?=
=?UTF-8?Q?ce_=26_Payment_Report_=EF=BF=BD_07/09/20?=
=?UTF-8?Q?26_=EF=BF=BD_root=40nl2k=2Eab=2Eca?=
Message-ID: <4bd9ba81-66f8-369f-01fe-5b1fb4e6c450@sabeng.it>
Content-Transfer-Encoding: quoted-printable
Date: Thu, 09 Jul 2026 20:03:24 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=utf-8
X-Spam_score: 6.1
X-Spam_score_int: 61
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview:  A document has been sent for your review View Document
Please review the attached document at your convenience. Contact the sender
if you have questions.
Content analysis details: (6.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[209.85.219.104 listed in dnsbl.ahbl.org]
[209.85.219.104 listed in dnsbl.ahbl.org]
[209.85.219.104 listed in dnsbl.ahbl.org]
[209.85.219.104 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[209.85.219.104 listed in will-spam-for-food.eu.org]
[209.85.219.104 listed in will-spam-for-food.eu.org]
[209.85.219.104 listed in will-spam-for-food.eu.org]
[209.85.219.104 listed in will-spam-for-food.eu.org]
[209.85.219.104 listed in will-spam-for-food.eu.org]
[209.85.219.104 listed in will-spam-for-food.eu.org]
[209.85.219.104 listed in will-spam-for-food.eu.org]
[209.85.219.104 listed in will-spam-for-food.eu.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.219.104 listed in list.dnswl.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.219.104 listed in bl.score.senderscore.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.219.104 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 NO_RDNS2 Sending MTA has no reverse DNS
0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
Subject: {SPAM?} =?UTF-8?Q?Please_Review_the_Attached_Slip=2C_Invoi?=
=?UTF-8?Q?ce_=26_Payment_Report_=EF=BF=BD_07/09/20?=
=?UTF-8?Q?26_=EF=BF=BD_root=40nl2k=2Eab=2Eca?=
Docusign phish from Google Gmail Part 3
Posted by Dave Yadallee onsrc=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/email-logo.png" width=3D"116" />
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.76.=
0/email/iconFileWithCheckWhite.png" width=3D"75" />
A document has been sent for your review
target=3D"_blank">View Document
Please review the attached document at your convenience. Contact the =
sender if you have questions.
This invitation is intended only for the recipient and contains secure =
access information.
Confidential: Do not share this email or link with =
others.
Alternative signing:
class=3D"alt-sign-link" href=3D"https://app.docusign.com/documents" =
target=3D"_blank">![3D"DocuSign"]()
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/email-logo.png" /> Access documents on =
DocuSign and use code:
padding:2px 8px; border-radius:12px; font-weight:bold; =
color:#260559;">{docu-id}
class=3D"alt-sign-link" href=3D"https://app.docusign.com/documents" =
target=3D"_blank">
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/email-logo.png" /> Access documents on =
DocuSign and use code:
padding:2px 8px; border-radius:12px; font-weight:bold; =
color:#260559;">{docu-id}
About Docusign: Sign securely and legally in minutes, =
from anywhere.
Need help? Contact the sender or visit our support page=
.
com/en/guides/Declining-to-sign-DocuSign-Signer-Guide" =
target=3D"_blank">Decline to sign |
href=3D"https://support.docusign.com/en/articles/How-do-I-manage-my-email-n=
otifications" target=3D"_blank">Manage notifications
Download the app:
.com/features-and-benefits/mobile" target=3D"_blank">
height=3D"18" src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/icon-download-app.png" width=3D"18" />Get =
Docusign
Sent by Ashley Allen via Docusign. To unsubscribe, =
contact the sender.
This message contains =
confidential information. If you are not the intended recipient, please =
delete immediately.
Docusign phish from Google Gmail Part 2
Posted by Dave Yadallee on=EF=BB=BF
name=3D"viewport" />
Docusign phish from Google Gmail Part 1
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 09 Jul 2026 14:15:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1whv8K-000000000gs-19VX
for dave@doctor.nl2k.ab.ca;
Thu, 09 Jul 2026 14:14:08 -0600
Resent-From: The Doctor
Resent-Date: Thu, 9 Jul 2026 14:14:08 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pl1-f230.google.com ([209.85.214.230]:60445)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1whuyo-00000000KZ5-0pB2
for root@doctor.nl2k.ab.ca;
Thu, 09 Jul 2026 14:04:26 -0600
Received: by mail-pl1-f230.google.com with SMTP id d9443c01a7336-2cc6ae3e7f1so1003195ad.0
for; Thu, 09 Jul 2026 13:03:30 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=sabeng.it; s=google; t=1783627405; x=1784232205; darn=doctor.nl2k.ab.ca;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=CBCnKi6yFedusYVAYEog8Pbq6nVfckjxBILUJZflDog=;
b=eRB0wWCSh64UnIwLYI8rcKDor2K0NP/3FkYYZpGeSk3+2fep+SgGL1zJzN11bzYc87
Paa8v+bbl6WVzCBwiVJkkVYzrZilztOtRr6D5qhlMKvOLkgh3Z69lV7iw6kHrrNR/yO6
AUR/Fyol8criz5PcDxM93PsgVLOscipoAtLOs=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1783627405; x=1784232205;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date
:message-id:reply-to:content-type;
bh=CBCnKi6yFedusYVAYEog8Pbq6nVfckjxBILUJZflDog=;
b=bv/pOpeMQY4K/sb10DCLzjcjQ7Z4+72yZkFzaiPZh7h74fEdXn28hOvdw1L5pi3QpV
AEPt1kNTjrPiLZ81npb0JM/d3BeLmsVtPfzz2IADk51hV+ytsVy0O+2iMTvKxIOq1kNE
5KumrkFBQ2ZJXvrFEwojS42VM1z0dimGowV4c0uWLU4GTfrEtQug/gbjd/2jbLL83l4/
nVryJyqhxomHWIds3qhucZduv+iLT+c7br1lKA/FIODlmQRcIvGV4xVDv1Gx+BTDNsSz
xRbWLNOMSZnBwhuuEJsigahB83hdTpFFhJ3D3BcaCiOPN2ox6P9PSqj/hdgr198iOzTW
HzqA==
X-Gm-Message-State: AOJu0Yym0VFrbShg0a3FhaBoLFya7TPRmSV9vBjCgeRj5G3tFZp56ECJ
tlT5QH2UwTPYFWSuBwrQGLrBKsQxyg7x9keq6tOJkI9lysaVlLwjnpqbu/HUcTh9SH3y0SoiOtk
6nxrbZNhmHu9s8KCnQcGVjAkEWknIiPTPnfkr3cVJwrzdI8g=
X-Gm-Gg: AfdE7cnOV+mNp3ofmvfOsxTExfMZaT0tGLP8/hGOLyc9p/vp56MQDwOUyaj0ITocXB2
3p6LpfMlIQrKcKT8Vkh0YDOJsYOtSZH1WGJN7DSegU+slMe0ghhDKLVKYlpyqss4l4NlSYsNbiD
swu1fwCZoRXbFwQR/pihTzak43sEVR9R6LzWTp9NOiHAN+n2hbp6OFbCmEheTR6MyqKPO5dvrQ/
i/yeJJ7z+EWzvRMhgOQPHY9Dyq3DrHr+JLvJnVGx0GmaVw1zqU6dL3BR1pn4+RumDx5dfjAtF8+
nS3rYeMwW9hTyrlZRJmKH2e09t45l5/WKwZWZoX8U5bINGaHc3p8p8QFxdMiPcLhdz5fXnTzZdS
EDi5ZDuSdoolfNzeAwBueOg==
X-Received: by 2002:a17:903:380e:b0:2c9:c083:cd50 with SMTP id d9443c01a7336-2ccea36d9demr85676775ad.17.1783627405065;
Thu, 09 Jul 2026 13:03:25 -0700 (PDT)
Received: from sabprogetti.com ([192.210.236.148])
by smtp-relay.gmail.com with ESMTPS id d9443c01a7336-2ccc9bdce31sm8599645ad.12.2026.07.09.13.03.24
for
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Thu, 09 Jul 2026 13:03:25 -0700 (PDT)
X-Relaying-Domain: sabeng.it
From: "Incoming_Payment|Schedule| Online Review/OU=EXCHANGE ADMINISTRATIVE
GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-00620"
To: root@doctor.nl2k.ab.ca
Subject: =?UTF-8?Q?Review_Requested=3A_PO=2C_Invoice_=26_Pa?=
=?UTF-8?Q?yment_Details_=EF=BF=BD_07/09/2026_?=
=?UTF-8?Q?=EF=BF=BD_root=40doctor=2Enl2k=2Eab=2Eca?=
Message-ID: <28b24c40-97dd-9e5c-4110-1325bb983169@sabeng.it>
Content-Transfer-Encoding: quoted-printable
Date: Thu, 09 Jul 2026 20:03:23 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=utf-8
X-Spam_score: 6.3
X-Spam_score_int: 63
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview:  A document has been sent for your review View Document
Please review the attached document at your convenience. Contact the sender
if you have questions.
Content analysis details: (6.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[209.85.214.230 listed in dnsbl.ahbl.org]
[209.85.214.230 listed in dnsbl.ahbl.org]
[209.85.214.230 listed in dnsbl.ahbl.org]
[209.85.214.230 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.214.230 listed in list.dnswl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.214.230 listed in bl.score.senderscore.com]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.214.230 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
0.0 NO_RDNS2 Sending MTA has no reverse DNS
0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
Subject: {SPAM?} =?UTF-8?Q?Review_Requested=3A_PO=2C_Invoice_=26_Pa?=
=?UTF-8?Q?yment_Details_=EF=BF=BD_07/09/2026_?=
=?UTF-8?Q?=EF=BF=BD_root=40doctor=2Enl2k=2Eab=2Eca?=
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 09 Jul 2026 14:15:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from
id 1whv8K-000000000gs-19VX
for dave@doctor.nl2k.ab.ca;
Thu, 09 Jul 2026 14:14:08 -0600
Resent-From: The Doctor
Resent-Date: Thu, 9 Jul 2026 14:14:08 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pl1-f230.google.com ([209.85.214.230]:60445)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.99.3 (FreeBSD))
(envelope-from
id 1whuyo-00000000KZ5-0pB2
for root@doctor.nl2k.ab.ca;
Thu, 09 Jul 2026 14:04:26 -0600
Received: by mail-pl1-f230.google.com with SMTP id d9443c01a7336-2cc6ae3e7f1so1003195ad.0
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=sabeng.it; s=google; t=1783627405; x=1784232205; darn=doctor.nl2k.ab.ca;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=CBCnKi6yFedusYVAYEog8Pbq6nVfckjxBILUJZflDog=;
b=eRB0wWCSh64UnIwLYI8rcKDor2K0NP/3FkYYZpGeSk3+2fep+SgGL1zJzN11bzYc87
Paa8v+bbl6WVzCBwiVJkkVYzrZilztOtRr6D5qhlMKvOLkgh3Z69lV7iw6kHrrNR/yO6
AUR/Fyol8criz5PcDxM93PsgVLOscipoAtLOs=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1783627405; x=1784232205;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date
:message-id:reply-to:content-type;
bh=CBCnKi6yFedusYVAYEog8Pbq6nVfckjxBILUJZflDog=;
b=bv/pOpeMQY4K/sb10DCLzjcjQ7Z4+72yZkFzaiPZh7h74fEdXn28hOvdw1L5pi3QpV
AEPt1kNTjrPiLZ81npb0JM/d3BeLmsVtPfzz2IADk51hV+ytsVy0O+2iMTvKxIOq1kNE
5KumrkFBQ2ZJXvrFEwojS42VM1z0dimGowV4c0uWLU4GTfrEtQug/gbjd/2jbLL83l4/
nVryJyqhxomHWIds3qhucZduv+iLT+c7br1lKA/FIODlmQRcIvGV4xVDv1Gx+BTDNsSz
xRbWLNOMSZnBwhuuEJsigahB83hdTpFFhJ3D3BcaCiOPN2ox6P9PSqj/hdgr198iOzTW
HzqA==
X-Gm-Message-State: AOJu0Yym0VFrbShg0a3FhaBoLFya7TPRmSV9vBjCgeRj5G3tFZp56ECJ
tlT5QH2UwTPYFWSuBwrQGLrBKsQxyg7x9keq6tOJkI9lysaVlLwjnpqbu/HUcTh9SH3y0SoiOtk
6nxrbZNhmHu9s8KCnQcGVjAkEWknIiPTPnfkr3cVJwrzdI8g=
X-Gm-Gg: AfdE7cnOV+mNp3ofmvfOsxTExfMZaT0tGLP8/hGOLyc9p/vp56MQDwOUyaj0ITocXB2
3p6LpfMlIQrKcKT8Vkh0YDOJsYOtSZH1WGJN7DSegU+slMe0ghhDKLVKYlpyqss4l4NlSYsNbiD
swu1fwCZoRXbFwQR/pihTzak43sEVR9R6LzWTp9NOiHAN+n2hbp6OFbCmEheTR6MyqKPO5dvrQ/
i/yeJJ7z+EWzvRMhgOQPHY9Dyq3DrHr+JLvJnVGx0GmaVw1zqU6dL3BR1pn4+RumDx5dfjAtF8+
nS3rYeMwW9hTyrlZRJmKH2e09t45l5/WKwZWZoX8U5bINGaHc3p8p8QFxdMiPcLhdz5fXnTzZdS
EDi5ZDuSdoolfNzeAwBueOg==
X-Received: by 2002:a17:903:380e:b0:2c9:c083:cd50 with SMTP id d9443c01a7336-2ccea36d9demr85676775ad.17.1783627405065;
Thu, 09 Jul 2026 13:03:25 -0700 (PDT)
Received: from sabprogetti.com ([192.210.236.148])
by smtp-relay.gmail.com with ESMTPS id d9443c01a7336-2ccc9bdce31sm8599645ad.12.2026.07.09.13.03.24
for
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Thu, 09 Jul 2026 13:03:25 -0700 (PDT)
X-Relaying-Domain: sabeng.it
From: "Incoming_Payment|Schedule| Online Review/OU=EXCHANGE ADMINISTRATIVE
GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-00620"
To: root@doctor.nl2k.ab.ca
Subject: =?UTF-8?Q?Review_Requested=3A_PO=2C_Invoice_=26_Pa?=
=?UTF-8?Q?yment_Details_=EF=BF=BD_07/09/2026_?=
=?UTF-8?Q?=EF=BF=BD_root=40doctor=2Enl2k=2Eab=2Eca?=
Message-ID: <28b24c40-97dd-9e5c-4110-1325bb983169@sabeng.it>
Content-Transfer-Encoding: quoted-printable
Date: Thu, 09 Jul 2026 20:03:23 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=utf-8
X-Spam_score: 6.3
X-Spam_score_int: 63
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview:  A document has been sent for your review View Document
Please review the attached document at your convenience. Contact the sender
if you have questions.
Content analysis details: (6.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[209.85.214.230 listed in dnsbl.ahbl.org]
[209.85.214.230 listed in dnsbl.ahbl.org]
[209.85.214.230 listed in dnsbl.ahbl.org]
[209.85.214.230 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.214.230 listed in list.dnswl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.214.230 listed in bl.score.senderscore.com]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.214.230 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
0.0 NO_RDNS2 Sending MTA has no reverse DNS
0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
Subject: {SPAM?} =?UTF-8?Q?Review_Requested=3A_PO=2C_Invoice_=26_Pa?=
=?UTF-8?Q?yment_Details_=EF=BF=BD_07/09/2026_?=
=?UTF-8?Q?=EF=BF=BD_root=40doctor=2Enl2k=2Eab=2Eca?=
Docusign phish from Google Gmail Part 2
Posted by Dave Yadallee on=EF=BB=BF
name=3D"viewport" />
Docusign phish from Google Gmail Part 3
Posted by Dave Yadallee onsrc=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/email-logo.png" width=3D"116" />
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.76.=
0/email/iconFileWithCheckWhite.png" width=3D"75" />
A document has been sent for your review
target=3D"_blank">View Document
Please review the attached document at your convenience. Contact the =
sender if you have questions.
This invitation is intended only for the recipient and contains secure =
access information.
Confidential: Do not share this email or link with =
others.
Alternative signing:
class=3D"alt-sign-link" href=3D"https://app.docusign.com/documents" =
target=3D"_blank">![3D"DocuSign"]()
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/email-logo.png" /> Access documents on =
DocuSign and use code:
padding:2px 8px; border-radius:12px; font-weight:bold; =
color:#260559;">{docu-id}
class=3D"alt-sign-link" href=3D"https://app.docusign.com/documents" =
target=3D"_blank">
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/email-logo.png" /> Access documents on =
DocuSign and use code:
padding:2px 8px; border-radius:12px; font-weight:bold; =
color:#260559;">{docu-id}
About Docusign: Sign securely and legally in minutes, =
from anywhere.
Need help? Contact the sender or visit our support page=
.
com/en/guides/Declining-to-sign-DocuSign-Signer-Guide" =
target=3D"_blank">Decline to sign |
href=3D"https://support.docusign.com/en/articles/How-do-I-manage-my-email-n=
otifications" target=3D"_blank">Manage notifications
Download the app:
.com/features-and-benefits/mobile" target=3D"_blank">
height=3D"18" src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/icon-download-app.png" width=3D"18" />Get =
Docusign
Sent by Ashley Allen via Docusign. To unsubscribe, =
contact the sender.
This message contains =
confidential information. If you are not the intended recipient, please =
delete immediately.
Docusign phish from Google Gmail Part 3
Posted by Dave Yadallee onsrc=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/email-logo.png" width=3D"116" />
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.76.=
0/email/iconFileWithCheckWhite.png" width=3D"75" />
A document has been sent for your review
target=3D"_blank">View Document
Please review the attached document at your convenience. Contact the =
sender if you have questions.
This invitation is intended only for the recipient and contains secure =
access information.
Confidential: Do not share this email or link with =
others.
Alternative signing:
class=3D"alt-sign-link" href=3D"https://app.docusign.com/documents" =
target=3D"_blank">![3D"DocuSign"]()
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/email-logo.png" /> Access documents on =
DocuSign and use code:
padding:2px 8px; border-radius:12px; font-weight:bold; =
color:#260559;">{docu-id}
class=3D"alt-sign-link" href=3D"https://app.docusign.com/documents" =
target=3D"_blank">
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/email-logo.png" /> Access documents on =
DocuSign and use code:
padding:2px 8px; border-radius:12px; font-weight:bold; =
color:#260559;">{docu-id}
About Docusign: Sign securely and legally in minutes, =
from anywhere.
Need help? Contact the sender or visit our support page=
.
com/en/guides/Declining-to-sign-DocuSign-Signer-Guide" =
target=3D"_blank">Decline to sign |
href=3D"https://support.docusign.com/en/articles/How-do-I-manage-my-email-n=
otifications" target=3D"_blank">Manage notifications
Download the app:
.com/features-and-benefits/mobile" target=3D"_blank">
height=3D"18" src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/icon-download-app.png" width=3D"18" />Get =
Docusign
Sent by Ashley Allen via Docusign. To unsubscribe, =
contact the sender.
This message contains =
confidential information. If you are not the intended recipient, please =
delete immediately.
Docusign phish from Google Gmail Part 1
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 09 Jul 2026 14:14:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1whv7s-00000000OoX-4528
for dave@doctor.nl2k.ab.ca;
Thu, 09 Jul 2026 14:13:40 -0600
Resent-From: The Doctor
Resent-Date: Thu, 9 Jul 2026 14:13:40 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pl1-f230.google.com ([209.85.214.230]:54608)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1whtn8-00000000H99-0hRi
for postmaster@nl2k.ab.ca;
Thu, 09 Jul 2026 12:48:17 -0600
Received: by mail-pl1-f230.google.com with SMTP id d9443c01a7336-2cc7ef7ec27so799415ad.1
for; Thu, 09 Jul 2026 11:47:23 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=sabeng.it; s=google; t=1783622837; x=1784227637; darn=nl2k.ab.ca;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=CBCnKi6yFedusYVAYEog8Pbq6nVfckjxBILUJZflDog=;
b=H1a0eySlGr7WdYH+fNeYtQw0Tgs6mR2h7MOm+uUbwB8DctXeXKVb3Qdj67T9kIfpkM
O2IpttQ+lyx6Wxr8Ts8oQzoi4e3eCEBCBWhZIxGivEJseUtU1uafQ1SXVBgqcXwwoIxn
Yqw1g6IjjueuVesTYkzAmAoaVyCd8cOH/d4Uk=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1783622837; x=1784227637;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date
:message-id:reply-to:content-type;
bh=CBCnKi6yFedusYVAYEog8Pbq6nVfckjxBILUJZflDog=;
b=XwHsVSfOUukLE2PmctCwELCS5e+ApHsbN5QuEC2U5tM7hp6CV/ozg2RnygC39Hoht0
t7+QdPMnUJhkQFe/N1YypWUr4GtvjL/ssBgcC8tmwkTuiu2TWohN7vlyG5gIbYVrRw+T
kfxkwC2Y7v7uEK3oKOBHzapVhyyIh5boDaKXeX3MgLrreqE7RNycMQDn41LX3yjQQ3mH
pEHT/Vqu28SlBSIWxWeCNr4Kbr5JnhP5qQw/ZabmgJ5ZCRAgNeo1Th0Vmc2eQJ5wpmrv
zw7VGwP52M+pOMgSCV97KGQSV6IDknNUoCx3eOEz3t9HHTedmXDw/tO8RvmHY/8Yo93D
FBHA==
X-Gm-Message-State: AOJu0Yw7jtwscfiT67oE5zcgtpMng7YVTvukfAoqJhbxBU61X1k3AwLR
0VkQyp/A10+sopqgRQrnMF/vVJ0PAd4wvZxjoihutrI2/R2jziETIHLE70lx6UwZQ6yQgW3InGj
o6s304oJr4eqP5OqanXE0piOXhVMT2hd5dqjWaEOmzEk74is=
X-Gm-Gg: AfdE7cnCrmJdT1SJgKwB35df06SuZ790j9iem+4ZPLSHNj2eRVg7XzcHfE6qu59WzKo
MMFUwW7xzhYLh3Jk9+Rs1zUP3Fhqhg9kMdLsXcFv7TAWgwxnZJ4q97AlWx41PfyqnHIS771Q/nj
u2KnyDPG2CvRuykn82ZcT0DGAM+yPphWHfM77+zzYy0/JHTgn4JFKubNXPla7XvjC/YsUccghyM
EFxILhpdh4lo4vGPFWGpLS31yZBo5f4jOIMt+0orGfbp0aITMez7aFu/+WiLpfA5IObhI3evd93
Gtm+5Rm6DyQeDwwcr4qHTUxjuED1qzEa7KeB6fmackcyRUzT2PhhXKzKA8zpAn4NL1+h0nZjRc2
NwtaoRtmlPgqWbGvS98ShDlVW
X-Received: by 2002:a17:902:fdad:b0:2cc:8ad3:423d with SMTP id d9443c01a7336-2ccea42e977mr95823245ad.29.1783622837329;
Thu, 09 Jul 2026 11:47:17 -0700 (PDT)
Received: from sabprogetti.com ([192.210.236.148])
by smtp-relay.gmail.com with ESMTPS id d9443c01a7336-2ccc9bde021sm8640605ad.20.2026.07.09.11.47.17
for
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Thu, 09 Jul 2026 11:47:17 -0700 (PDT)
X-Relaying-Domain: sabeng.it
From: "Incoming_Payment|Schedule| Online Review/OU=EXCHANGE ADMINISTRATIVE
GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-95194"
To: postmaster@nl2k.ab.ca
Subject: =?UTF-8?Q?Request_for_Review=3A_Sortcode=2C_Invoic?=
=?UTF-8?Q?e_=26_Payment_Report_=EF=BF=BD_07/09/202?=
=?UTF-8?Q?6_=EF=BF=BD_postmaster=40nl2k=2Eab=2Eca?=
Message-ID:
Content-Transfer-Encoding: quoted-printable
Date: Thu, 09 Jul 2026 18:47:15 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=utf-8
X-Spam_score: 6.3
X-Spam_score_int: 63
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview:  A document has been sent for your review View Document
Please review the attached document at your convenience. Contact the sender
if you have questions.
Content analysis details: (6.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[209.85.214.230 listed in dnsbl.ahbl.org]
[209.85.214.230 listed in dnsbl.ahbl.org]
[209.85.214.230 listed in dnsbl.ahbl.org]
[209.85.214.230 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.214.230 listed in list.dnswl.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.214.230 listed in bl.score.senderscore.com]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.214.230 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 NO_RDNS2 Sending MTA has no reverse DNS
0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
Subject: {SPAM?} =?UTF-8?Q?Request_for_Review=3A_Sortcode=2C_Invoic?=
=?UTF-8?Q?e_=26_Payment_Report_=EF=BF=BD_07/09/202?=
=?UTF-8?Q?6_=EF=BF=BD_postmaster=40nl2k=2Eab=2Eca?=
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 09 Jul 2026 14:14:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from
id 1whv7s-00000000OoX-4528
for dave@doctor.nl2k.ab.ca;
Thu, 09 Jul 2026 14:13:40 -0600
Resent-From: The Doctor
Resent-Date: Thu, 9 Jul 2026 14:13:40 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pl1-f230.google.com ([209.85.214.230]:54608)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.99.3 (FreeBSD))
(envelope-from
id 1whtn8-00000000H99-0hRi
for postmaster@nl2k.ab.ca;
Thu, 09 Jul 2026 12:48:17 -0600
Received: by mail-pl1-f230.google.com with SMTP id d9443c01a7336-2cc7ef7ec27so799415ad.1
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=sabeng.it; s=google; t=1783622837; x=1784227637; darn=nl2k.ab.ca;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=CBCnKi6yFedusYVAYEog8Pbq6nVfckjxBILUJZflDog=;
b=H1a0eySlGr7WdYH+fNeYtQw0Tgs6mR2h7MOm+uUbwB8DctXeXKVb3Qdj67T9kIfpkM
O2IpttQ+lyx6Wxr8Ts8oQzoi4e3eCEBCBWhZIxGivEJseUtU1uafQ1SXVBgqcXwwoIxn
Yqw1g6IjjueuVesTYkzAmAoaVyCd8cOH/d4Uk=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1783622837; x=1784227637;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date
:message-id:reply-to:content-type;
bh=CBCnKi6yFedusYVAYEog8Pbq6nVfckjxBILUJZflDog=;
b=XwHsVSfOUukLE2PmctCwELCS5e+ApHsbN5QuEC2U5tM7hp6CV/ozg2RnygC39Hoht0
t7+QdPMnUJhkQFe/N1YypWUr4GtvjL/ssBgcC8tmwkTuiu2TWohN7vlyG5gIbYVrRw+T
kfxkwC2Y7v7uEK3oKOBHzapVhyyIh5boDaKXeX3MgLrreqE7RNycMQDn41LX3yjQQ3mH
pEHT/Vqu28SlBSIWxWeCNr4Kbr5JnhP5qQw/ZabmgJ5ZCRAgNeo1Th0Vmc2eQJ5wpmrv
zw7VGwP52M+pOMgSCV97KGQSV6IDknNUoCx3eOEz3t9HHTedmXDw/tO8RvmHY/8Yo93D
FBHA==
X-Gm-Message-State: AOJu0Yw7jtwscfiT67oE5zcgtpMng7YVTvukfAoqJhbxBU61X1k3AwLR
0VkQyp/A10+sopqgRQrnMF/vVJ0PAd4wvZxjoihutrI2/R2jziETIHLE70lx6UwZQ6yQgW3InGj
o6s304oJr4eqP5OqanXE0piOXhVMT2hd5dqjWaEOmzEk74is=
X-Gm-Gg: AfdE7cnCrmJdT1SJgKwB35df06SuZ790j9iem+4ZPLSHNj2eRVg7XzcHfE6qu59WzKo
MMFUwW7xzhYLh3Jk9+Rs1zUP3Fhqhg9kMdLsXcFv7TAWgwxnZJ4q97AlWx41PfyqnHIS771Q/nj
u2KnyDPG2CvRuykn82ZcT0DGAM+yPphWHfM77+zzYy0/JHTgn4JFKubNXPla7XvjC/YsUccghyM
EFxILhpdh4lo4vGPFWGpLS31yZBo5f4jOIMt+0orGfbp0aITMez7aFu/+WiLpfA5IObhI3evd93
Gtm+5Rm6DyQeDwwcr4qHTUxjuED1qzEa7KeB6fmackcyRUzT2PhhXKzKA8zpAn4NL1+h0nZjRc2
NwtaoRtmlPgqWbGvS98ShDlVW
X-Received: by 2002:a17:902:fdad:b0:2cc:8ad3:423d with SMTP id d9443c01a7336-2ccea42e977mr95823245ad.29.1783622837329;
Thu, 09 Jul 2026 11:47:17 -0700 (PDT)
Received: from sabprogetti.com ([192.210.236.148])
by smtp-relay.gmail.com with ESMTPS id d9443c01a7336-2ccc9bde021sm8640605ad.20.2026.07.09.11.47.17
for
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Thu, 09 Jul 2026 11:47:17 -0700 (PDT)
X-Relaying-Domain: sabeng.it
From: "Incoming_Payment|Schedule| Online Review/OU=EXCHANGE ADMINISTRATIVE
GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-95194"
To: postmaster@nl2k.ab.ca
Subject: =?UTF-8?Q?Request_for_Review=3A_Sortcode=2C_Invoic?=
=?UTF-8?Q?e_=26_Payment_Report_=EF=BF=BD_07/09/202?=
=?UTF-8?Q?6_=EF=BF=BD_postmaster=40nl2k=2Eab=2Eca?=
Message-ID:
Content-Transfer-Encoding: quoted-printable
Date: Thu, 09 Jul 2026 18:47:15 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=utf-8
X-Spam_score: 6.3
X-Spam_score_int: 63
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview:  A document has been sent for your review View Document
Please review the attached document at your convenience. Contact the sender
if you have questions.
Content analysis details: (6.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[209.85.214.230 listed in dnsbl.ahbl.org]
[209.85.214.230 listed in dnsbl.ahbl.org]
[209.85.214.230 listed in dnsbl.ahbl.org]
[209.85.214.230 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.214.230 listed in list.dnswl.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.214.230 listed in bl.score.senderscore.com]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.214.230 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 NO_RDNS2 Sending MTA has no reverse DNS
0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
Subject: {SPAM?} =?UTF-8?Q?Request_for_Review=3A_Sortcode=2C_Invoic?=
=?UTF-8?Q?e_=26_Payment_Report_=EF=BF=BD_07/09/202?=
=?UTF-8?Q?6_=EF=BF=BD_postmaster=40nl2k=2Eab=2Eca?=
Docusign phish from Google Gmail Part 2
Posted by Dave Yadallee on=EF=BB=BF
name=3D"viewport" />
Docusign phish from Google Gmail Part 3
Posted by Dave Yadallee onsrc=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/email-logo.png" width=3D"116" />
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.76.=
0/email/iconFileWithCheckWhite.png" width=3D"75" />
A document has been sent for your review
target=3D"_blank">View Document
Please review the attached document at your convenience. Contact the =
sender if you have questions.
This invitation is intended only for the recipient and contains secure =
access information.
Confidential: Do not share this email or link with =
others.
Alternative signing:
class=3D"alt-sign-link" href=3D"https://app.docusign.com/documents" =
target=3D"_blank">![3D"DocuSign"]()
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/email-logo.png" /> Access documents on =
DocuSign and use code:
padding:2px 8px; border-radius:12px; font-weight:bold; =
color:#260559;">{docu-id}
class=3D"alt-sign-link" href=3D"https://app.docusign.com/documents" =
target=3D"_blank">
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/email-logo.png" /> Access documents on =
DocuSign and use code:
padding:2px 8px; border-radius:12px; font-weight:bold; =
color:#260559;">{docu-id}
About Docusign: Sign securely and legally in minutes, =
from anywhere.
Need help? Contact the sender or visit our support page=
.
com/en/guides/Declining-to-sign-DocuSign-Signer-Guide" =
target=3D"_blank">Decline to sign |
href=3D"https://support.docusign.com/en/articles/How-do-I-manage-my-email-n=
otifications" target=3D"_blank">Manage notifications
Download the app:
.com/features-and-benefits/mobile" target=3D"_blank">
height=3D"18" src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/icon-download-app.png" width=3D"18" />Get =
Docusign
Sent by Ashley Allen via Docusign. To unsubscribe, =
contact the sender.
This message contains =
confidential information. If you are not the intended recipient, please =
delete immediately.
Docusign phish from Google Gmail Part 1
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 09 Jul 2026 14:14:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1whv7m-00000000O43-48Ae
for dave@doctor.nl2k.ab.ca;
Thu, 09 Jul 2026 14:13:34 -0600
Resent-From: The Doctor
Resent-Date: Thu, 9 Jul 2026 14:13:34 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-oo1-f104.google.com ([209.85.161.104]:48431)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1whtYd-00000000GUp-1jiP
for usenet@nl2k.ab.ca;
Thu, 09 Jul 2026 12:33:20 -0600
Received: by mail-oo1-f104.google.com with SMTP id 006d021491bc7-6a31b9a492aso146528eaf.1
for; Thu, 09 Jul 2026 11:32:22 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=sabeng.it; s=google; t=1783621936; x=1784226736; darn=nl2k.ab.ca;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=CBCnKi6yFedusYVAYEog8Pbq6nVfckjxBILUJZflDog=;
b=bMTwxVtMG7SJovEQzEkuUeEqbYAEC3Z/9n/GFoBmja7FGQul0Pmmd0MFHOm+ed+9Ue
FCAT5z4mivvQkry0vex7WNpxjM+vR16fJJM1J2FDzAo/isXL97nemwJ8q6/bLvOpFbon
WGgJKpGlnyJi5Ib7Q01fHd4BEPwFcuxjxs4BY=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1783621936; x=1784226736;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date
:message-id:reply-to:content-type;
bh=CBCnKi6yFedusYVAYEog8Pbq6nVfckjxBILUJZflDog=;
b=FeilZQBIEjKTnDUA+uVfquM4YpNgd7+k4xBvTks6L8LZUSSJK3I3JXquPFg5pcshDv
uk5HOo83C4hAUHQCQIErQXw2PPLt8nJnbwtdluAMqMd1gZMeA3oxPsM054vHddiC68cB
6JTdTO7nyBofQGTOqH4+PyH9Qv08wgIxV8wAmHLxvQAOVNl3f3A/FQZmk0X2n9BQrRyi
hjdKJKeGa6eBADGa9ZCD+qeDUSd+hEDIqYklR8XGYeLwYXafNs+gjVwDQ08kR2PAQXb5
DdeTTD0ZFYenRa4a3FbG5dFhS6iA4Dl/ggNQUwjeXotFzUF7G9E1DSHx2+3eLs0AGZjf
3+fg==
X-Gm-Message-State: AOJu0Yyx7G2x3Tlyqd0cgIcIhhufbqAngG75+5zUS3pql8Y6VgtMFlzK
xHBDytyWzUHT74B6bYjeHas7IfLfvOcYTC+q6su/DF9dw3JZ/97l4Wv2sCf40iBvrp9EthQYvGM
N8r+0EL/4V9qmuVZE1x7vK2xf/kodWLv6InIT562snhSMXz4=
X-Gm-Gg: AfdE7ckw7Cxsfl+1sAqZLRiE9HfjM+O+Tzqurn0TBoWooljEFQoD3QRwhTQFH/c+a1D
6y/CYqtSC044erBpUeztIhULRcYTj19z9ylBk069F4RLlMINZCfSeHw0prrZDA+d1q8nymGhD4C
F+8IQfpsrSPwGZe/vsjDcduVvicBwGLDjycWv9LQ0VdRaNYUTVSL30Q/cBefJMm6LeJBkxJ50mE
LULUpOsKCJmzBFBRGWqjtU7Kjmk4fIfYA2hODsmmGPEQLRnmsMHIqq5uSttnRBKRx9U5Yx5fwUG
jkeNK1lbwP8bwjW0SyrUsXfnYVbKnMwLlrzKksAyxrzUMjbcLCHwm9ZukGi+8239SQj0cbMy63g
gDljoRRtDKkD7bzUdAiNHGg==
X-Received: by 2002:a05:6820:16ab:b0:69d:6bfd:5a3f with SMTP id 006d021491bc7-6a36da8c1femr6534304eaf.51.1783621935951;
Thu, 09 Jul 2026 11:32:15 -0700 (PDT)
Received: from sabprogetti.com ([192.210.236.148])
by smtp-relay.gmail.com with ESMTPS id 006d021491bc7-6a382c807dasm107981eaf.13.2026.07.09.11.32.15
for
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Thu, 09 Jul 2026 11:32:15 -0700 (PDT)
X-Relaying-Domain: sabeng.it
From: "Incoming_Payment|Schedule| Online Review/OU=EXCHANGE ADMINISTRATIVE
GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-39528"
To: usenet@nl2k.ab.ca
Subject: =?UTF-8?Q?Request_for_Review=3A_Sortcode=2C_Invoic?=
=?UTF-8?Q?e_=26_Payment_Report_=EF=BF=BD_07/09/202?=
=?UTF-8?Q?6_=EF=BF=BD_usenet=40nl2k=2Eab=2Eca?=
Message-ID: <82c443b8-87f4-20be-e072-794f366b67d1@sabeng.it>
Content-Transfer-Encoding: quoted-printable
Date: Thu, 09 Jul 2026 18:32:14 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=utf-8
X-Spam_score: 6.3
X-Spam_score_int: 63
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview:  A document has been sent for your review View Document
Please review the attached document at your convenience. Contact the sender
if you have questions.
Content analysis details: (6.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[209.85.161.104 listed in dnsbl.ahbl.org]
[209.85.161.104 listed in dnsbl.ahbl.org]
[209.85.161.104 listed in dnsbl.ahbl.org]
[209.85.161.104 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[209.85.161.104 listed in will-spam-for-food.eu.org]
[209.85.161.104 listed in will-spam-for-food.eu.org]
[209.85.161.104 listed in will-spam-for-food.eu.org]
[209.85.161.104 listed in will-spam-for-food.eu.org]
[209.85.161.104 listed in will-spam-for-food.eu.org]
[209.85.161.104 listed in will-spam-for-food.eu.org]
[209.85.161.104 listed in will-spam-for-food.eu.org]
[209.85.161.104 listed in will-spam-for-food.eu.org]
1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.161.104 listed in list.dnswl.org]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.161.104 listed in wl.mailspike.net]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.161.104 listed in bl.score.senderscore.com]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
0.0 NO_RDNS2 Sending MTA has no reverse DNS
0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
Subject: {SPAM?} =?UTF-8?Q?Request_for_Review=3A_Sortcode=2C_Invoic?=
=?UTF-8?Q?e_=26_Payment_Report_=EF=BF=BD_07/09/202?=
=?UTF-8?Q?6_=EF=BF=BD_usenet=40nl2k=2Eab=2Eca?=
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 09 Jul 2026 14:14:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from
id 1whv7m-00000000O43-48Ae
for dave@doctor.nl2k.ab.ca;
Thu, 09 Jul 2026 14:13:34 -0600
Resent-From: The Doctor
Resent-Date: Thu, 9 Jul 2026 14:13:34 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-oo1-f104.google.com ([209.85.161.104]:48431)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.99.3 (FreeBSD))
(envelope-from
id 1whtYd-00000000GUp-1jiP
for usenet@nl2k.ab.ca;
Thu, 09 Jul 2026 12:33:20 -0600
Received: by mail-oo1-f104.google.com with SMTP id 006d021491bc7-6a31b9a492aso146528eaf.1
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=sabeng.it; s=google; t=1783621936; x=1784226736; darn=nl2k.ab.ca;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=CBCnKi6yFedusYVAYEog8Pbq6nVfckjxBILUJZflDog=;
b=bMTwxVtMG7SJovEQzEkuUeEqbYAEC3Z/9n/GFoBmja7FGQul0Pmmd0MFHOm+ed+9Ue
FCAT5z4mivvQkry0vex7WNpxjM+vR16fJJM1J2FDzAo/isXL97nemwJ8q6/bLvOpFbon
WGgJKpGlnyJi5Ib7Q01fHd4BEPwFcuxjxs4BY=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1783621936; x=1784226736;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date
:message-id:reply-to:content-type;
bh=CBCnKi6yFedusYVAYEog8Pbq6nVfckjxBILUJZflDog=;
b=FeilZQBIEjKTnDUA+uVfquM4YpNgd7+k4xBvTks6L8LZUSSJK3I3JXquPFg5pcshDv
uk5HOo83C4hAUHQCQIErQXw2PPLt8nJnbwtdluAMqMd1gZMeA3oxPsM054vHddiC68cB
6JTdTO7nyBofQGTOqH4+PyH9Qv08wgIxV8wAmHLxvQAOVNl3f3A/FQZmk0X2n9BQrRyi
hjdKJKeGa6eBADGa9ZCD+qeDUSd+hEDIqYklR8XGYeLwYXafNs+gjVwDQ08kR2PAQXb5
DdeTTD0ZFYenRa4a3FbG5dFhS6iA4Dl/ggNQUwjeXotFzUF7G9E1DSHx2+3eLs0AGZjf
3+fg==
X-Gm-Message-State: AOJu0Yyx7G2x3Tlyqd0cgIcIhhufbqAngG75+5zUS3pql8Y6VgtMFlzK
xHBDytyWzUHT74B6bYjeHas7IfLfvOcYTC+q6su/DF9dw3JZ/97l4Wv2sCf40iBvrp9EthQYvGM
N8r+0EL/4V9qmuVZE1x7vK2xf/kodWLv6InIT562snhSMXz4=
X-Gm-Gg: AfdE7ckw7Cxsfl+1sAqZLRiE9HfjM+O+Tzqurn0TBoWooljEFQoD3QRwhTQFH/c+a1D
6y/CYqtSC044erBpUeztIhULRcYTj19z9ylBk069F4RLlMINZCfSeHw0prrZDA+d1q8nymGhD4C
F+8IQfpsrSPwGZe/vsjDcduVvicBwGLDjycWv9LQ0VdRaNYUTVSL30Q/cBefJMm6LeJBkxJ50mE
LULUpOsKCJmzBFBRGWqjtU7Kjmk4fIfYA2hODsmmGPEQLRnmsMHIqq5uSttnRBKRx9U5Yx5fwUG
jkeNK1lbwP8bwjW0SyrUsXfnYVbKnMwLlrzKksAyxrzUMjbcLCHwm9ZukGi+8239SQj0cbMy63g
gDljoRRtDKkD7bzUdAiNHGg==
X-Received: by 2002:a05:6820:16ab:b0:69d:6bfd:5a3f with SMTP id 006d021491bc7-6a36da8c1femr6534304eaf.51.1783621935951;
Thu, 09 Jul 2026 11:32:15 -0700 (PDT)
Received: from sabprogetti.com ([192.210.236.148])
by smtp-relay.gmail.com with ESMTPS id 006d021491bc7-6a382c807dasm107981eaf.13.2026.07.09.11.32.15
for
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Thu, 09 Jul 2026 11:32:15 -0700 (PDT)
X-Relaying-Domain: sabeng.it
From: "Incoming_Payment|Schedule| Online Review/OU=EXCHANGE ADMINISTRATIVE
GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-39528"
To: usenet@nl2k.ab.ca
Subject: =?UTF-8?Q?Request_for_Review=3A_Sortcode=2C_Invoic?=
=?UTF-8?Q?e_=26_Payment_Report_=EF=BF=BD_07/09/202?=
=?UTF-8?Q?6_=EF=BF=BD_usenet=40nl2k=2Eab=2Eca?=
Message-ID: <82c443b8-87f4-20be-e072-794f366b67d1@sabeng.it>
Content-Transfer-Encoding: quoted-printable
Date: Thu, 09 Jul 2026 18:32:14 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=utf-8
X-Spam_score: 6.3
X-Spam_score_int: 63
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview:  A document has been sent for your review View Document
Please review the attached document at your convenience. Contact the sender
if you have questions.
Content analysis details: (6.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[209.85.161.104 listed in dnsbl.ahbl.org]
[209.85.161.104 listed in dnsbl.ahbl.org]
[209.85.161.104 listed in dnsbl.ahbl.org]
[209.85.161.104 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[209.85.161.104 listed in will-spam-for-food.eu.org]
[209.85.161.104 listed in will-spam-for-food.eu.org]
[209.85.161.104 listed in will-spam-for-food.eu.org]
[209.85.161.104 listed in will-spam-for-food.eu.org]
[209.85.161.104 listed in will-spam-for-food.eu.org]
[209.85.161.104 listed in will-spam-for-food.eu.org]
[209.85.161.104 listed in will-spam-for-food.eu.org]
[209.85.161.104 listed in will-spam-for-food.eu.org]
1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.161.104 listed in list.dnswl.org]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.161.104 listed in wl.mailspike.net]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.161.104 listed in bl.score.senderscore.com]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
0.0 NO_RDNS2 Sending MTA has no reverse DNS
0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
Subject: {SPAM?} =?UTF-8?Q?Request_for_Review=3A_Sortcode=2C_Invoic?=
=?UTF-8?Q?e_=26_Payment_Report_=EF=BF=BD_07/09/202?=
=?UTF-8?Q?6_=EF=BF=BD_usenet=40nl2k=2Eab=2Eca?=
Docusign phish from Google Gmail Part 3
Posted by Dave Yadallee onsrc=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/email-logo.png" width=3D"116" />
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.76.=
0/email/iconFileWithCheckWhite.png" width=3D"75" />
A document has been sent for your review
target=3D"_blank">View Document
Please review the attached document at your convenience. Contact the =
sender if you have questions.
This invitation is intended only for the recipient and contains secure =
access information.
Confidential: Do not share this email or link with =
others.
Alternative signing:
class=3D"alt-sign-link" href=3D"https://app.docusign.com/documents" =
target=3D"_blank">![3D"DocuSign"]()
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/email-logo.png" /> Access documents on =
DocuSign and use code:
padding:2px 8px; border-radius:12px; font-weight:bold; =
color:#260559;">{docu-id}
class=3D"alt-sign-link" href=3D"https://app.docusign.com/documents" =
target=3D"_blank">
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/email-logo.png" /> Access documents on =
DocuSign and use code:
padding:2px 8px; border-radius:12px; font-weight:bold; =
color:#260559;">{docu-id}
About Docusign: Sign securely and legally in minutes, =
from anywhere.
Need help? Contact the sender or visit our support page=
.
com/en/guides/Declining-to-sign-DocuSign-Signer-Guide" =
target=3D"_blank">Decline to sign |
href=3D"https://support.docusign.com/en/articles/How-do-I-manage-my-email-n=
otifications" target=3D"_blank">Manage notifications
Download the app:
.com/features-and-benefits/mobile" target=3D"_blank">
height=3D"18" src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/icon-download-app.png" width=3D"18" />Get =
Docusign
Sent by Ashley Allen via Docusign. To unsubscribe, =
contact the sender.
This message contains =
confidential information. If you are not the intended recipient, please =
delete immediately.
Docusign phish from Google Gmail Part 2
Posted by Dave Yadallee on=EF=BB=BF
name=3D"viewport" />
Docusign phish from Google Gmail Part 1
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 09 Jul 2026 14:12:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1whv61-00000000Lss-0U65
for dave@doctor.nl2k.ab.ca;
Thu, 09 Jul 2026 14:11:45 -0600
Resent-From: The Doctor
Resent-Date: Thu, 9 Jul 2026 14:11:45 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-oa1-f102.google.com ([209.85.160.102]:53473)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1whsUL-00000000CFE-0oC2
for support@nk.ca;
Thu, 09 Jul 2026 11:24:53 -0600
Received: by mail-oa1-f102.google.com with SMTP id 586e51a60fabf-448b89f700fso1095661fac.2
for; Thu, 09 Jul 2026 10:23:54 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=sabeng.it; s=google; t=1783617828; x=1784222628; darn=nk.ca;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=CBCnKi6yFedusYVAYEog8Pbq6nVfckjxBILUJZflDog=;
b=CZlrJaStO4BWs5V0y+HgT4rlO9RG2ao7w6HwSiU/CErCl0q2B8mXsJOn+5C0mnyeYJ
ryxfcvtchzPdbF88NhwdO0dbRRJnmLIoK9Q+4N+mDeid7KD5X57Zq3M4v4n2ryafr8ls
Y/AfHJpALo+1XEwQ6yG+skgMrwKAY+XMMZv1Q=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1783617828; x=1784222628;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date
:message-id:reply-to:content-type;
bh=CBCnKi6yFedusYVAYEog8Pbq6nVfckjxBILUJZflDog=;
b=MnCaYFolcC9WGpCZuAXF4N9RZPuKKgfD3vRHig8BFZ9nujTQsNP++TMoAe5ZoqOrsQ
sucHAL5btzdoQ9bZymxV787pcXeQ+GG7VxDUfJQ+r9bVjJR6PK+FaR3H+wsgR4qVnuoi
dQJEwLD3tRCDMqZLKA4w5DWBWGs6dy2YcAF3LeDS+uf2cOuNGOuOwzP77E9pSgrUsFQF
4WR4tJEZHfhu/CGehn77bC8RGqTNwjYRikmSbDB464j6S6p4aRqq8Ff5kEFK2NyrFcK0
5phnPttm11Nazog+cRNVVQF1RFrQDbHLJtHJzjK2VyLorAQ3Si13rSPjB4xwT5TP3bJ0
R6+A==
X-Gm-Message-State: AOJu0YyVrvBeAyzmNZANNrkbsOZblL0rqMUf+JbMDhafOOxGGSHtTW3q
EKlTljGCrllxVEARqwXRBGteGP+oKqUmYfDLn2A6S7F+b+hzg4jqTf8JSfXj7qlJh2C1ylj08F3
8w12kIyWqFD4zxtDt0ZuxSCZDMtYrteuWAfW+yBMyzsZitqM=
X-Gm-Gg: AfdE7cmSWaPC4COvimD4+PouFKnk56IKuDYZWFl0G6dqGWslusVMLY9lLL0rd0zrfkE
oWhxwjHZiFdLhDOs2XtHsET46JgzZa8CtJ/70i9YqJew+cHFIpKM/oGpN7q/dd9nR1WMTCPacA/
6dQI1U2wyk+D/meW34OSxAB+ttkiud8HkLUpnaXw78vR9ow17dI9RCtAIvKMPJnT+jb8YuG4ob6
hfHl0vlZLIuYfHihHRWYI5oBJxBVERkOXLNwDxv8q3k8RrtiWJ4/3dZeVHr8mvyokXU3MOdB5CR
InG5dKNwONLV//kwpLIGOQKfqwkS2oSYGqUKQmwMu7budRDAu2EF2GcaG9EnnYfpQ+Oy1bm4pF2
ENxl+ErU3ZSPuUzeq5A==
X-Received: by 2002:a05:6870:231a:b0:440:67b1:b59b with SMTP id 586e51a60fabf-45162e399c1mr5318395fac.0.1783617828058;
Thu, 09 Jul 2026 10:23:48 -0700 (PDT)
Received: from sabprogetti.com ([192.210.236.148])
by smtp-relay.gmail.com with ESMTPS id 586e51a60fabf-451913f8914sm285696fac.8.2026.07.09.10.23.47
for
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Thu, 09 Jul 2026 10:23:48 -0700 (PDT)
X-Relaying-Domain: sabeng.it
From: "Incoming_Payment|Schedule| Online Review/OU=EXCHANGE ADMINISTRATIVE
GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-61941"
To: support@nk.ca
Subject: =?UTF-8?Q?Attached_Financial_and_Swift_Documentati?=
=?UTF-8?Q?on_=EF=BF=BD_07/09/2026_=EF=BF=BD_suppor?=
=?UTF-8?Q?t=40nk=2Eca?=
Message-ID: <67d83905-a343-4b1f-6fa8-c016c48097a5@sabeng.it>
Content-Transfer-Encoding: quoted-printable
Date: Thu, 09 Jul 2026 17:23:46 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=utf-8
X-Spam_score: 6.3
X-Spam_score_int: 63
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview:  A document has been sent for your review View Document
Please review the attached document at your convenience. Contact the sender
if you have questions.
Content analysis details: (6.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[209.85.160.102 listed in dnsbl.ahbl.org]
[209.85.160.102 listed in dnsbl.ahbl.org]
[209.85.160.102 listed in dnsbl.ahbl.org]
[209.85.160.102 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[209.85.160.102 listed in will-spam-for-food.eu.org]
[209.85.160.102 listed in will-spam-for-food.eu.org]
[209.85.160.102 listed in will-spam-for-food.eu.org]
[209.85.160.102 listed in will-spam-for-food.eu.org]
[209.85.160.102 listed in will-spam-for-food.eu.org]
[209.85.160.102 listed in will-spam-for-food.eu.org]
[209.85.160.102 listed in will-spam-for-food.eu.org]
[209.85.160.102 listed in will-spam-for-food.eu.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.160.102 listed in list.dnswl.org]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.160.102 listed in bl.score.senderscore.com]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.160.102 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
0.0 NO_RDNS2 Sending MTA has no reverse DNS
Subject: {SPAM?} =?UTF-8?Q?Attached_Financial_and_Swift_Documentati?=
=?UTF-8?Q?on_=EF=BF=BD_07/09/2026_=EF=BF=BD_suppor?=
=?UTF-8?Q?t=40nk=2Eca?=
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 09 Jul 2026 14:12:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from
id 1whv61-00000000Lss-0U65
for dave@doctor.nl2k.ab.ca;
Thu, 09 Jul 2026 14:11:45 -0600
Resent-From: The Doctor
Resent-Date: Thu, 9 Jul 2026 14:11:45 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-oa1-f102.google.com ([209.85.160.102]:53473)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.99.3 (FreeBSD))
(envelope-from
id 1whsUL-00000000CFE-0oC2
for support@nk.ca;
Thu, 09 Jul 2026 11:24:53 -0600
Received: by mail-oa1-f102.google.com with SMTP id 586e51a60fabf-448b89f700fso1095661fac.2
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=sabeng.it; s=google; t=1783617828; x=1784222628; darn=nk.ca;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=CBCnKi6yFedusYVAYEog8Pbq6nVfckjxBILUJZflDog=;
b=CZlrJaStO4BWs5V0y+HgT4rlO9RG2ao7w6HwSiU/CErCl0q2B8mXsJOn+5C0mnyeYJ
ryxfcvtchzPdbF88NhwdO0dbRRJnmLIoK9Q+4N+mDeid7KD5X57Zq3M4v4n2ryafr8ls
Y/AfHJpALo+1XEwQ6yG+skgMrwKAY+XMMZv1Q=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1783617828; x=1784222628;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date
:message-id:reply-to:content-type;
bh=CBCnKi6yFedusYVAYEog8Pbq6nVfckjxBILUJZflDog=;
b=MnCaYFolcC9WGpCZuAXF4N9RZPuKKgfD3vRHig8BFZ9nujTQsNP++TMoAe5ZoqOrsQ
sucHAL5btzdoQ9bZymxV787pcXeQ+GG7VxDUfJQ+r9bVjJR6PK+FaR3H+wsgR4qVnuoi
dQJEwLD3tRCDMqZLKA4w5DWBWGs6dy2YcAF3LeDS+uf2cOuNGOuOwzP77E9pSgrUsFQF
4WR4tJEZHfhu/CGehn77bC8RGqTNwjYRikmSbDB464j6S6p4aRqq8Ff5kEFK2NyrFcK0
5phnPttm11Nazog+cRNVVQF1RFrQDbHLJtHJzjK2VyLorAQ3Si13rSPjB4xwT5TP3bJ0
R6+A==
X-Gm-Message-State: AOJu0YyVrvBeAyzmNZANNrkbsOZblL0rqMUf+JbMDhafOOxGGSHtTW3q
EKlTljGCrllxVEARqwXRBGteGP+oKqUmYfDLn2A6S7F+b+hzg4jqTf8JSfXj7qlJh2C1ylj08F3
8w12kIyWqFD4zxtDt0ZuxSCZDMtYrteuWAfW+yBMyzsZitqM=
X-Gm-Gg: AfdE7cmSWaPC4COvimD4+PouFKnk56IKuDYZWFl0G6dqGWslusVMLY9lLL0rd0zrfkE
oWhxwjHZiFdLhDOs2XtHsET46JgzZa8CtJ/70i9YqJew+cHFIpKM/oGpN7q/dd9nR1WMTCPacA/
6dQI1U2wyk+D/meW34OSxAB+ttkiud8HkLUpnaXw78vR9ow17dI9RCtAIvKMPJnT+jb8YuG4ob6
hfHl0vlZLIuYfHihHRWYI5oBJxBVERkOXLNwDxv8q3k8RrtiWJ4/3dZeVHr8mvyokXU3MOdB5CR
InG5dKNwONLV//kwpLIGOQKfqwkS2oSYGqUKQmwMu7budRDAu2EF2GcaG9EnnYfpQ+Oy1bm4pF2
ENxl+ErU3ZSPuUzeq5A==
X-Received: by 2002:a05:6870:231a:b0:440:67b1:b59b with SMTP id 586e51a60fabf-45162e399c1mr5318395fac.0.1783617828058;
Thu, 09 Jul 2026 10:23:48 -0700 (PDT)
Received: from sabprogetti.com ([192.210.236.148])
by smtp-relay.gmail.com with ESMTPS id 586e51a60fabf-451913f8914sm285696fac.8.2026.07.09.10.23.47
for
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Thu, 09 Jul 2026 10:23:48 -0700 (PDT)
X-Relaying-Domain: sabeng.it
From: "Incoming_Payment|Schedule| Online Review/OU=EXCHANGE ADMINISTRATIVE
GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-61941"
To: support@nk.ca
Subject: =?UTF-8?Q?Attached_Financial_and_Swift_Documentati?=
=?UTF-8?Q?on_=EF=BF=BD_07/09/2026_=EF=BF=BD_suppor?=
=?UTF-8?Q?t=40nk=2Eca?=
Message-ID: <67d83905-a343-4b1f-6fa8-c016c48097a5@sabeng.it>
Content-Transfer-Encoding: quoted-printable
Date: Thu, 09 Jul 2026 17:23:46 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=utf-8
X-Spam_score: 6.3
X-Spam_score_int: 63
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview:  A document has been sent for your review View Document
Please review the attached document at your convenience. Contact the sender
if you have questions.
Content analysis details: (6.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[209.85.160.102 listed in dnsbl.ahbl.org]
[209.85.160.102 listed in dnsbl.ahbl.org]
[209.85.160.102 listed in dnsbl.ahbl.org]
[209.85.160.102 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[209.85.160.102 listed in will-spam-for-food.eu.org]
[209.85.160.102 listed in will-spam-for-food.eu.org]
[209.85.160.102 listed in will-spam-for-food.eu.org]
[209.85.160.102 listed in will-spam-for-food.eu.org]
[209.85.160.102 listed in will-spam-for-food.eu.org]
[209.85.160.102 listed in will-spam-for-food.eu.org]
[209.85.160.102 listed in will-spam-for-food.eu.org]
[209.85.160.102 listed in will-spam-for-food.eu.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.160.102 listed in list.dnswl.org]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.160.102 listed in bl.score.senderscore.com]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.160.102 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
0.0 NO_RDNS2 Sending MTA has no reverse DNS
Subject: {SPAM?} =?UTF-8?Q?Attached_Financial_and_Swift_Documentati?=
=?UTF-8?Q?on_=EF=BF=BD_07/09/2026_=EF=BF=BD_suppor?=
=?UTF-8?Q?t=40nk=2Eca?=