Docusign Phish from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 07 Jul 2026 17:44:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whFRf-00000000EHC-0WlL

for dave@doctor.nl2k.ab.ca;

Tue, 07 Jul 2026 17:43:19 -0600

Resent-From: The Doctor

Resent-Date: Tue, 7 Jul 2026 17:43:19 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qt1-f231.google.com ([209.85.160.231]:57620)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whEfM-00000000I7C-1MdU

for doctor@nl2k.ca;

Tue, 07 Jul 2026 16:53:36 -0600

Received: by mail-qt1-f231.google.com with SMTP id d75a77b69052e-51c0c68aa31so28774341cf.3

for ; Tue, 07 Jul 2026 15:52:37 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1783464751; x=1784069551; darn=nl2k.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=EWV8XmCUvffytCAcw2TyXcQCDCinzlDmbMB2SDY4DX4=;

b=FK9BPAX5X3SymWbqXUwS0uS4Orz9mmXHuQLNi/82cvcBV0sOU6r2RjeWUwhH2IRH9e

P/XrZpRsEM2OGDlsmC3vXgpSBp26OzgGPhnPYZf9etzyTwsa7ketOSB8XHFIQeOdjtuR

iVQamOan8o0TzSWczZhtsyS71+PUDmfLOqLH8=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783464751; x=1784069551;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=EWV8XmCUvffytCAcw2TyXcQCDCinzlDmbMB2SDY4DX4=;

b=ix46rFRTxb877Ou1wiCPROm73V+jXjAnQphMWk6D0DLj0lqm6KrXwKUMVxCllRGXeO

sK1fX+HNsnEKoe0cZH72WoGfOmogPKx+Esp6egQmPVooIurANUduQIJslLlZFX/w1xLF

9EQbCsCaR93OkqIrPUJir0EsC/J6t73gnOsHV3CANjmyslgIn6j3L5EkmIKo77DKn7I3

K3t95PywicftoBfAfhlXomUbtr2cEsj0K8eZf2H28GNzlBargEM8lNEJMZpFmF9/lNGu

azOySa1KXe6IF9LkrGg2zAIgsQDJv+hRIMBSa8gm9VwSnTqBXbUyRcAYFMmgAw548hxI

emvg==

X-Gm-Message-State: AOJu0YyNUfOkcMon8OiAlL9rF3HKnzon9KUXQe+5476pfmmpar+yF7xy

UFSF2IYUyOh9reX7nnrRoKcjzHU/YDvIvRVtvyRDiQXFTUjR51JnPfrR4RBwzeIKPFUzsc378bo

NF4/X0Rtylkl0hBsB/Xqndf5EqKgyAKfbuBb2PxSiD0LT6HY=

X-Gm-Gg: AfdE7cl6gzSoskxY3Tji0TkcE2c7i551knPmg6htk4sm+SS1vnyHaQXF/RIJ14lTvhp

sZfM8mSCAa/gKObdq6iUMTwvw7Bqv5n4FjAlSoaDKmg+et4JNKvbgQkECxHEORObgpfQDj7a/KH

o/hUqd03EcgFdo+xbJhK1Se72XWN6v94wJXCKOrIznwpZyGDGh8Wkc1tzLifG8RsB8IpcNMsoS3

+YfXlO5lIuwKTXEBOJCoAI07g/IHK7JVOx44nOUhcx21XcVXgp3lRz46nIkpOSHC51U6VJOttjO

O3maGKyDrJqqmOZyiKsLHNS0h3fMjRuzmhB43WIWduh1U087eVzswSWqH1mQgpaoqdII9IRn8vk

gpfcWwc8XSCBkHPJ98XPnFEZL

X-Received: by 2002:a05:622a:201:b0:51c:1b22:b855 with SMTP id d75a77b69052e-51c8b40f3fcmr1824451cf.62.1783464750648;

Tue, 07 Jul 2026 15:52:30 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id d75a77b69052e-51c41cb32a4sm7702111cf.15.2026.07.07.15.52.30

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Tue, 07 Jul 2026 15:52:30 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "Incoming_Payment|Schedule| Online Review/OU=EXCHANGE ADMINISTRATIVE

GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-24060"



To: doctor@nl2k.ca

Subject: =?UTF-8?Q?ETA/Invoice_for_Payment_Records_Attached?=

=?UTF-8?Q?_=EF=BF=BD_07/07/2026_=EF=BF=BD_doctor?=

=?UTF-8?Q?=40nl2k=2Eca?=

Message-ID: <23816e79-4578-35e1-557d-4a4958dc7e8b@sabeng.it>

Content-Transfer-Encoding: quoted-printable

Date: Tue, 07 Jul 2026 22:52:29 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 6.1

X-Spam_score_int: 61

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  A document has been sent for your review View Document

Please review the attached document at your convenience. Contact the sender

if you have questions.



Content analysis details: (6.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.160.231 listed in dnsbl.ahbl.org]

[209.85.160.231 listed in dnsbl.ahbl.org]

[209.85.160.231 listed in dnsbl.ahbl.org]

[209.85.160.231 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.160.231 listed in list.dnswl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.160.231 listed in will-spam-for-food.eu.org]

[209.85.160.231 listed in will-spam-for-food.eu.org]

[209.85.160.231 listed in will-spam-for-food.eu.org]

[209.85.160.231 listed in will-spam-for-food.eu.org]

[209.85.160.231 listed in will-spam-for-food.eu.org]

[209.85.160.231 listed in will-spam-for-food.eu.org]

[209.85.160.231 listed in will-spam-for-food.eu.org]

[209.85.160.231 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.160.231 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.160.231 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 NO_RDNS2 Sending MTA has no reverse DNS

Subject: {SPAM?} =?UTF-8?Q?ETA/Invoice_for_Payment_Records_Attached?=

=?UTF-8?Q?_=EF=BF=BD_07/07/2026_=EF=BF=BD_doctor?=

=?UTF-8?Q?=40nl2k=2Eca?=

Docusign Phish from Google Gmail Part 3

Posted by Dave Yadallee on








3D"Logo"
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/email-logo.png" width=3D"116" />






3D""
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.76.=

0/email/iconFileWithCheckWhite.png" width=3D"75" />

A document has been sent for your review



target=3D"_blank">View Document








Please review the attached document at your convenience. Contact the =

sender if you have questions.





This invitation is intended only for the recipient and contains secure =

access information.











Confidential: Do not share this email or link with =

others.





Alternative signing:
class=3D"alt-sign-link" href=3D"https://app.docusign.com/documents" =

target=3D"_blank"> 3D"DocuSign"
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/email-logo.png" /> Access documents on =

DocuSign and use code:
padding:2px 8px; border-radius:12px; font-weight:bold; =

color:#260559;">{docu-id}




About Docusign: Sign securely and legally in minutes, =

from anywhere.





Need help? Contact the sender or visit our support page=

.






com/en/guides/Declining-to-sign-DocuSign-Signer-Guide" =

target=3D"_blank">Decline to sign |
href=3D"https://support.docusign.com/en/articles/How-do-I-manage-my-email-n=

otifications" target=3D"_blank">Manage notifications




Download the app:
.com/features-and-benefits/mobile" target=3D"_blank"> 3D""
height=3D"18" src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/icon-download-app.png" width=3D"18" />Get =

Docusign





Sent by Ashley Allen via Docusign. To unsubscribe, =

contact the sender.





This message contains =

confidential information. If you are not the intended recipient, please =

delete immediately.











Docusign Phish from Google Gmail Part 2

Posted by Dave Yadallee on




=EF=BB=BF


name=3D"viewport" />

Docusign Phish from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 07 Jul 2026 17:44:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whFRi-00000000EHP-2763

for dave@doctor.nl2k.ab.ca;

Tue, 07 Jul 2026 17:43:22 -0600

Resent-From: The Doctor

Resent-Date: Tue, 7 Jul 2026 17:43:22 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f102.google.com ([209.85.161.102]:51236)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whEfM-00000000I6N-1gOo

for doctor@nl2k.ab.ca;

Tue, 07 Jul 2026 16:53:36 -0600

Received: by mail-oo1-f102.google.com with SMTP id 006d021491bc7-6a347ec19a5so5832eaf.2

for ; Tue, 07 Jul 2026 15:52:36 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1783464750; x=1784069550; darn=nl2k.ab.ca;

h=mime-version:date:content-transfer-encoding:message-id:subject:to

:from:from:to:cc:subject:date:message-id:reply-to;

bh=EWV8XmCUvffytCAcw2TyXcQCDCinzlDmbMB2SDY4DX4=;

b=dnOl+qkYD+HZxgg1apTc6ph1mbmbHgDVP/R6Nq3JDgFI7KyF1mL3otTMXFtqx+Gwc9

sw8Hx9nd/dBHVY/MVyoNHvRmsaywQJhyJg0B5jeZ6imwjl7SY37OVGtEoKGUg0CTvEzg

3AeRjf74xvs0HC8hxW8P1mbfcQOq0hRYqIS6E=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783464750; x=1784069550;

h=mime-version:date:content-transfer-encoding:message-id:subject:to

:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=EWV8XmCUvffytCAcw2TyXcQCDCinzlDmbMB2SDY4DX4=;

b=OMhlrsWo3PE5ASsWDzEC9ItNVyFBnRDvMzZvVKGXglgKIAVg8mYUGhvIETKm+KD0Vj

lCIaa9BJ7Vntg6Exr9rHe7H65x/q0SiyfdfekihM8s88paLJwbdibZyQ6qT1NKqY7FJE

oqx3OhN1RNEHl2Sf6Iko9U6M1ROmBO6siiXsjPKf+GxZxamapGWkP3EO/tPIOMZ3bJVC

6vOzyOrDY0cT6Qx92cq0AMzoVKe+wXvD0yyy6UAn5XgI3i8BqYFhf6wYsBBIh2u8gR/H

YgsDWxS2t+nMtmcAOLe9f4GKu7JwoxSammSHeRCyHBa8hzAVjSyh1qFRPaZxH08F2QKh

y1/A==

X-Gm-Message-State: AOJu0Yw9FTjDRKbhOCeDtxy6fhGabgPMv/cL5AqrzIv3zUH6P2tdCCup

FtJFbyQADZuykfZfUhJcrXnH303wMBvLmfS1bu8szWaPosKkEWVo8+r4ifdrqW43WSBjgPXGlqA

RriJ5PZPekywCAq/g/VkCrj7x+cegyy3XMW0gkeNtfQ7giu4=

X-Gm-Gg: AfdE7cn3MULtH5gvp2pl8JkQOqB6YgFHaSGSlIhGaYGkCc128sBBr6n9VblcKVNAVKA

5keJWAv/NU6GzlqcL4CKmeWHrRzridD3hZUumg6BgcpxxOnetWPUZrWwE3gAdqQa338WBqZ5kh+

jFMEA1TZVZ7TqkDuHGMWvTNI+UTRdJmluqYyMPF2Q0UGbroS2CVJ01PHeraN8dhsEfGl5Qr2GlI

Pn9zeSwSFESZViOB9laILvNvMtSxwCEK6b4BBjabfwelhByeHqpOzA+RqbjCaLLPi/qj1BA4xx8

UIxJEl/VoS5kH3hHUhL/1dBuQSgZKRSWH1K539RNRb+kQzlYhdp52nDBZhkybLmga+5biUdnuh2

MgXUX/sKC5osHlcCv/iUkBE0=

X-Received: by 2002:a05:6820:60c:b0:6a3:66dd:ca10 with SMTP id 006d021491bc7-6a36da170b0mr7005eaf.53.1783464750653;

Tue, 07 Jul 2026 15:52:30 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id 586e51a60fabf-44cfb5ab52asm1591009fac.3.2026.07.07.15.52.30

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Tue, 07 Jul 2026 15:52:30 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "Incoming_Payment|Schedule| Online Review/OU=EXCHANGE ADMINISTRATIVE

GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-45027"



To: doctor@nl2k.ab.ca

Subject: =?UTF-8?Q?Please_Review_the_Attached_Slip=2C_Invoi?=

=?UTF-8?Q?ce_=26_Payment_Report_=EF=BF=BD_07/07/20?=

=?UTF-8?Q?26_=EF=BF=BD_doctor=40nl2k=2Eab=2Eca?=

Message-ID:

Content-Transfer-Encoding: quoted-printable

Date: Tue, 07 Jul 2026 22:52:29 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 6.3

X-Spam_score_int: 63

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  A document has been sent for your review View Document

Please review the attached document at your convenience. Contact the sender

if you have questions.



Content analysis details: (6.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.161.102 listed in dnsbl.ahbl.org]

[209.85.161.102 listed in dnsbl.ahbl.org]

[209.85.161.102 listed in dnsbl.ahbl.org]

[209.85.161.102 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.161.102 listed in will-spam-for-food.eu.org]

[209.85.161.102 listed in will-spam-for-food.eu.org]

[209.85.161.102 listed in will-spam-for-food.eu.org]

[209.85.161.102 listed in will-spam-for-food.eu.org]

[209.85.161.102 listed in will-spam-for-food.eu.org]

[209.85.161.102 listed in will-spam-for-food.eu.org]

[209.85.161.102 listed in will-spam-for-food.eu.org]

[209.85.161.102 listed in will-spam-for-food.eu.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.161.102 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.161.102 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.161.102 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

Subject: {SPAM?} =?UTF-8?Q?Please_Review_the_Attached_Slip=2C_Invoi?=

=?UTF-8?Q?ce_=26_Payment_Report_=EF=BF=BD_07/07/20?=

=?UTF-8?Q?26_=EF=BF=BD_doctor=40nl2k=2Eab=2Eca?=

Docusign Phish from Google Gmail Part 3

Posted by Dave Yadallee on








3D"Logo"
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/email-logo.png" width=3D"116" />






3D""
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.76.=

0/email/iconFileWithCheckWhite.png" width=3D"75" />

A document has been sent for your review



target=3D"_blank">View Document








Please review the attached document at your convenience. Contact the =

sender if you have questions.





This invitation is intended only for the recipient and contains secure =

access information.











Confidential: Do not share this email or link with =

others.





Alternative signing:
class=3D"alt-sign-link" href=3D"https://app.docusign.com/documents" =

target=3D"_blank"> 3D"DocuSign"
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/email-logo.png" /> Access documents on =

DocuSign and use code:
padding:2px 8px; border-radius:12px; font-weight:bold; =

color:#260559;">{docu-id}




About Docusign: Sign securely and legally in minutes, =

from anywhere.





Need help? Contact the sender or visit our support page=

.






com/en/guides/Declining-to-sign-DocuSign-Signer-Guide" =

target=3D"_blank">Decline to sign |
href=3D"https://support.docusign.com/en/articles/How-do-I-manage-my-email-n=

otifications" target=3D"_blank">Manage notifications




Download the app:
.com/features-and-benefits/mobile" target=3D"_blank"> 3D""
height=3D"18" src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/icon-download-app.png" width=3D"18" />Get =

Docusign





Sent by Ashley Allen via Docusign. To unsubscribe, =

contact the sender.





This message contains =

confidential information. If you are not the intended recipient, please =

delete immediately.











Docusign Phish from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 07 Jul 2026 17:44:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whFRX-00000000EGi-0PGO

for dave@doctor.nl2k.ab.ca;

Tue, 07 Jul 2026 17:43:11 -0600

Resent-From: The Doctor

Resent-Date: Tue, 7 Jul 2026 17:43:11 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f230.google.com ([209.85.214.230]:57808)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whEfM-00000000I4m-1NPh

for doctor@doctor.nl2k.ab.ca;

Tue, 07 Jul 2026 16:53:32 -0600

Received: by mail-pl1-f230.google.com with SMTP id d9443c01a7336-2ccdb73f0e1so695885ad.3

for ; Tue, 07 Jul 2026 15:52:36 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1783464750; x=1784069550; darn=doctor.nl2k.ab.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=EWV8XmCUvffytCAcw2TyXcQCDCinzlDmbMB2SDY4DX4=;

b=aPKQvhBmSgrZXFNrLW9rN9WPibtjSpslhVzOk2KMzJW+ofJf9/G2OO3jiCxnCjHdhq

2WCZx1+jyih5Iedp6D7CWZPw9BVFTfirRKD725kj4MBO3Xmq2Q7mdTn4iuG4Lx2kAXnV

d4XRdLNibaIr0KJvHgs4lNLVvfN3SbjXE6BRI=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783464750; x=1784069550;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=EWV8XmCUvffytCAcw2TyXcQCDCinzlDmbMB2SDY4DX4=;

b=e/RokYSR2R+VvRaUv66gq383j/fJ9n6t/lOF2qtnNDIJcxEssp/yQiT0mWHjFNKmRw

gr8823K7DqsnnGxNsMZKmu0mgvHGVtS0dfXeM6aHzr2tfCVlLVH25hFRghEqCKrXeWux

ADAqJysqyCT0xbi6yLrA1fPS43dNT+Kp/DyKL8Au9QUS0NHUGH7/MRpjZf1NJm/QLC3g

+RTrP56b4ddResVbpPoSyHXmjzm5LjaLajHR9FC9iqaBVU2UGehZqBR6WmhBdeVx606I

jcHN81f2x2SKZJl0VACNWY9wFeE8OXewFrs0tjsnx6F9runFHH0sOx/uQzZ9Vl/JGmU0

+kTg==

X-Gm-Message-State: AOJu0Yx/E9lvozW9KdqqJjowXRA5SJfSWizXqbN5fgQpoWvNB8qA1I1m

kIqXwHp3aFFKPxtejnEQFsZ/muw4BYtjy+ABD8Q9CyJNvqgL9JeNr9lP0VglXWAlnX9xLOH1uh6

1wFdgVBm5i1Rg3bWqOLwwRWBTvqgqyivGvdImQAasw3d5xCg=

X-Gm-Gg: AfdE7ck1PRdcCUO7dacEPM1K+KUSUzqxWNgFB+mRlu7Fav91BZhAw1mftrDY/3cU/10

E2dbOFDNPkCxpxar3DNCRMusIFSIZ/cL7ejhv7GPzrtOcMJowoXJtuZVkjvRXbDZtqIlQFKqDid

kkKOYIRH8fQ7AN4YX7zDVBbYSWP7sRlMAMmluEOKFvdQU268UEuCms8ro6NaLt/hqwEHWhp278y

1itWDXS7/o5q/oLTDnWsGecgYRR4sUHsXOhMjc33tNRiFrvLc0JxnT8xDbdKMezk51Hq8KGcRDm

NT37rfOskjGTWnjtioCQ+OY4UNzDi1aiaBkhGRAYch2HnVySsCsufhvEbRRJESF1dGZZQ5QQ4pX

Qx7YY1W0MWOE9qqU9toku5w==

X-Received: by 2002:a17:902:ecc8:b0:2c9:97a8:aff5 with SMTP id d9443c01a7336-2ccbf1ae62cmr59058425ad.46.1783464750120;

Tue, 07 Jul 2026 15:52:30 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id d9443c01a7336-2ccc9bdd019sm3313665ad.13.2026.07.07.15.52.29

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Tue, 07 Jul 2026 15:52:30 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "Incoming_Payment | EFT Portal/OU=EXCHANGE ADMINISTRATIVE GROUP

(FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-53861"



To: doctor@doctor.nl2k.ab.ca

Subject: =?UTF-8?Q?Invoice_and_Payment_Documentation_Enclos?=

=?UTF-8?Q?ed_for_Review_=EF=BF=BD_07/07/2026_?=

=?UTF-8?Q?=EF=BF=BD_doctor=40doctor=2Enl2k=2Eab=2E?= =?UTF-8?Q?ca?=

Message-ID: <3852d459-669b-1062-0b1c-409a1c985537@sabeng.it>

Content-Transfer-Encoding: quoted-printable

Date: Tue, 07 Jul 2026 22:52:28 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 8.8

X-Spam_score_int: 88

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  A document has been sent for your review View Document

Please review the attached document at your convenience. Contact the sender

if you have questions.



Content analysis details: (8.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.214.230 listed in dnsbl.ahbl.org]

[209.85.214.230 listed in dnsbl.ahbl.org]

[209.85.214.230 listed in dnsbl.ahbl.org]

[209.85.214.230 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.214.230 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

Subject: {SPAM?} =?UTF-8?Q?Invoice_and_Payment_Documentation_Enclos?=

=?UTF-8?Q?ed_for_Review_=EF=BF=BD_07/07/2026_?=

=?UTF-8?Q?=EF=BF=BD_doctor=40doctor=2Enl2k=2Eab=2E?= =?UTF-8?Q?ca?=

Docusign Phish from Google Gmail Part 2

Posted by Dave Yadallee on




=EF=BB=BF


name=3D"viewport" />

Docusign Phish from Google Gmail Part 3

Posted by Dave Yadallee on








3D"Logo"
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/email-logo.png" width=3D"116" />






3D""
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.76.=

0/email/iconFileWithCheckWhite.png" width=3D"75" />

A document has been sent for your review



target=3D"_blank">View Document








Please review the attached document at your convenience. Contact the =

sender if you have questions.





This invitation is intended only for the recipient and contains secure =

access information.











Confidential: Do not share this email or link with =

others.





Alternative signing:
class=3D"alt-sign-link" href=3D"https://app.docusign.com/documents" =

target=3D"_blank"> 3D"DocuSign"
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/email-logo.png" /> Access documents on =

DocuSign and use code:
padding:2px 8px; border-radius:12px; font-weight:bold; =

color:#260559;">{docu-id}




About Docusign: Sign securely and legally in minutes, =

from anywhere.





Need help? Contact the sender or visit our support page=

.






com/en/guides/Declining-to-sign-DocuSign-Signer-Guide" =

target=3D"_blank">Decline to sign |
href=3D"https://support.docusign.com/en/articles/How-do-I-manage-my-email-n=

otifications" target=3D"_blank">Manage notifications




Download the app:
.com/features-and-benefits/mobile" target=3D"_blank"> 3D""
height=3D"18" src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/icon-download-app.png" width=3D"18" />Get =

Docusign





Sent by Ashley Allen via Docusign. To unsubscribe, =

contact the sender.





This message contains =

confidential information. If you are not the intended recipient, please =

delete immediately.











Docusign Phish from Google Gmail Part 2

Posted by Dave Yadallee on


=EF=BB=BF


name=3D"viewport" />

Docusign Phish from Google Gmail Part 2

Posted by Dave Yadallee on


=EF=BB=BF


name=3D"viewport" />

Docusign Phish from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 07 Jul 2026 17:44:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whFRN-00000000EGG-2qEX

for dave@doctor.nl2k.ab.ca;

Tue, 07 Jul 2026 17:43:01 -0600

Resent-From: The Doctor

Resent-Date: Tue, 7 Jul 2026 17:43:01 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qt1-f231.google.com ([209.85.160.231]:44052)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whEfM-00000000I6L-1MgR

for doctor@mail.nl2k.ab.ca;

Tue, 07 Jul 2026 16:53:36 -0600

Received: by mail-qt1-f231.google.com with SMTP id d75a77b69052e-51c0c45c580so45541cf.0

for ; Tue, 07 Jul 2026 15:52:36 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1783464750; x=1784069550; darn=mail.nl2k.ab.ca;

h=mime-version:date:content-transfer-encoding:message-id:subject:to

:from:from:to:cc:subject:date:message-id:reply-to;

bh=EWV8XmCUvffytCAcw2TyXcQCDCinzlDmbMB2SDY4DX4=;

b=aPkBxf3+4gPyhhzjYYmIZUSQTJxnhGc0JbD9cvuRA+IGnpIOWUUt6ax3s9dBZQm+OS

AQhXO9h59Ho8n+49039GKx71tBSDD1qZ9MdhN2Tfr9VGwMxY3cLg/E1uTcyxOwRH36Th

ThTqAPCjLeqnBZfWnU5ae/LV/XIpjrNE9MagY=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783464750; x=1784069550;

h=mime-version:date:content-transfer-encoding:message-id:subject:to

:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=EWV8XmCUvffytCAcw2TyXcQCDCinzlDmbMB2SDY4DX4=;

b=LbdKKJegiAfJmxWMJKbahsTELsgX8sBH7q0r+jCd3MImcgGF8KQR16sjl5zkzf9zeO

6NVEV44jchrv/q08yz6EoLPjP1R2fPnqLFAcwOj3qwZgepERgL6zu2vzdUxNc7poeBlD

qjaiK1xLOn5MsxUpvs2vci5eU8O2/Am9MWDSnIBaxBcRbetxj/qshdzljHDaT3mkp3I0

pN45BxgyehmIuQPnsUpbLnWfX2S7ga9dIgA8l76PmSrIzrUNFhaUFScnxDPqyCt8jopH

ivxldLiQ2RX/XS/ei2XrE2IioUsnwEyzttdnBbwzfbHxkcUQHT4T/CiEvAc90ULK8biz

E7jw==

X-Gm-Message-State: AOJu0Yx161qSAZ0Tx/tgfAX+5mNqXgsnB8emyLwTrUKL22jnE+zy4+gL

g/7GoMjLXWXp7JGAtfkI4y15QLGOb0tTnJ0uCsWIFE1aZuP0ht2S9GAp5QAM0kms7kLTTPcWAYo

chMZlqO1ayjgsanXo4PdvrPGPYMahjf1Qff8YulzR1RfsM7M=

X-Gm-Gg: AfdE7cnaDfl//Dgg8BRo+B1KckyFSwdIqxQACgIQpCLMVVqLSSoBnkbohCLLLdZ1eFZ

hBfWWh2ooPIL8c7tb1W9Q+/xt3ZvyPxrx+f61B1POclRCQ6FC21USK/rmk0NZeImSaKHRosRS82

f4h2mY5A30TuWcxL4HJ0jimerdHLka2lpqVvwkVv6EcUjNKtQRA9YC/2HVEY9zXG4ij2ngU7m0A

QU3QFyN29TTczlhYvkjwUCy6mGJvM0yYmLiyqiIRLm3J6YqrPxL9O4VQhPWqLSCnoi0K6tUf2TO

P2BnWRCmRrbExgZxLlX3gwMlViWpW879hxkpO7tQCJ8Q4QC9dNqFr5/1e/RDE8O2tU1avN5v6xW

4GG6VCOEWst/7ZfvpMqjAQM8=

X-Received: by 2002:a05:622a:1e0d:b0:51c:136a:c870 with SMTP id d75a77b69052e-51c8b2e2fecmr2076071cf.26.1783464750325;

Tue, 07 Jul 2026 15:52:30 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id d75a77b69052e-51c41cb32a4sm7702111cf.15.2026.07.07.15.52.30

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Tue, 07 Jul 2026 15:52:30 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "Incoming_Payment | EFT Portal/OU=EXCHANGE ADMINISTRATIVE GROUP

(FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-57042"



To: doctor@mail.nl2k.ab.ca

Subject: =?UTF-8?Q?Attached_Payment_Report_for_Your_Review_?=

=?UTF-8?Q?=EF=BF=BD_07/07/2026_=EF=BF=BD_doctor=40?=

=?UTF-8?Q?mail=2Enl2k=2Eab=2Eca?=

Message-ID: <6f7146d8-bed0-4ed3-b053-2a408a471643@sabeng.it>

Content-Transfer-Encoding: quoted-printable

Date: Tue, 07 Jul 2026 22:52:28 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 8.8

X-Spam_score_int: 88

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  A document has been sent for your review View Document

Please review the attached document at your convenience. Contact the sender

if you have questions.



Content analysis details: (8.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.160.231 listed in dnsbl.ahbl.org]

[209.85.160.231 listed in dnsbl.ahbl.org]

[209.85.160.231 listed in dnsbl.ahbl.org]

[209.85.160.231 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.160.231 listed in list.dnswl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.160.231 listed in will-spam-for-food.eu.org]

[209.85.160.231 listed in will-spam-for-food.eu.org]

[209.85.160.231 listed in will-spam-for-food.eu.org]

[209.85.160.231 listed in will-spam-for-food.eu.org]

[209.85.160.231 listed in will-spam-for-food.eu.org]

[209.85.160.231 listed in will-spam-for-food.eu.org]

[209.85.160.231 listed in will-spam-for-food.eu.org]

[209.85.160.231 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} =?UTF-8?Q?Attached_Payment_Report_for_Your_Review_?=

=?UTF-8?Q?=EF=BF=BD_07/07/2026_=EF=BF=BD_doctor=40?=

=?UTF-8?Q?mail=2Enl2k=2Eab=2Eca?=

Docusign phish from Google Gmail Part 3

Posted by Dave Yadallee on










3D"Logo"
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/email-logo.png" width=3D"116" />






3D""
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.76.=

0/email/iconFileWithCheckWhite.png" width=3D"75" />

A document has been sent for your review



target=3D"_blank">View Document








Please review the attached document at your convenience. Contact the =

sender if you have questions.





This invitation is intended only for the recipient and contains secure =

access information.











Confidential: Do not share this email or link with =

others.





Alternative signing:
class=3D"alt-sign-link" href=3D"https://app.docusign.com/documents" =

target=3D"_blank"> 3D"DocuSign"
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/email-logo.png" /> Access documents on =

DocuSign and use code:
padding:2px 8px; border-radius:12px; font-weight:bold; =

color:#260559;">{docu-id}




About Docusign: Sign securely and legally in minutes, =

from anywhere.





Need help? Contact the sender or visit our support page=

.






com/en/guides/Declining-to-sign-DocuSign-Signer-Guide" =

target=3D"_blank">Decline to sign |
href=3D"https://support.docusign.com/en/articles/How-do-I-manage-my-email-n=

otifications" target=3D"_blank">Manage notifications




Download the app:
.com/features-and-benefits/mobile" target=3D"_blank"> 3D""
height=3D"18" src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/icon-download-app.png" width=3D"18" />Get =

Docusign





Sent by Ashley Allen via Docusign. To unsubscribe, =

contact the sender.





This message contains =

confidential information. If you are not the intended recipient, please =

delete immediately.











Docusign phish from Google Gmail Part 2

Posted by Dave Yadallee on


=EF=BB=BF


name=3D"viewport" />

Docusign phish from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 07 Jul 2026 17:44:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whFRT-00000000EGW-0C5P

for dave@doctor.nl2k.ab.ca;

Tue, 07 Jul 2026 17:43:07 -0600

Resent-From: The Doctor

Resent-Date: Tue, 7 Jul 2026 17:43:06 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oa1-f103.google.com ([209.85.160.103]:44088)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whEfM-00000000I5n-1eMI

for doctor@netknow.ca;

Tue, 07 Jul 2026 16:53:36 -0600

Received: by mail-oa1-f103.google.com with SMTP id 586e51a60fabf-44cb057311bso47222fac.0

for ; Tue, 07 Jul 2026 15:52:36 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1783464750; x=1784069550; darn=netknow.ca;

h=mime-version:date:content-transfer-encoding:message-id:subject:to

:from:from:to:cc:subject:date:message-id:reply-to;

bh=EWV8XmCUvffytCAcw2TyXcQCDCinzlDmbMB2SDY4DX4=;

b=TxUiOsRG5ygsTTp2Rem1eBNX6+1Xz5n4OuY64F5df7ztgP2AaIlbN9KXJVt58Y5dOI

c3C/JGRTuM32pBOtHhFA7htCRgPLJQZnnDucgcKQPzMdIDdL3IwdRJljHUhyN6bz90yL

rER8P6jzMoGcqcrCjpKJ5WlYn48cF5JaU8pAM=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783464750; x=1784069550;

h=mime-version:date:content-transfer-encoding:message-id:subject:to

:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=EWV8XmCUvffytCAcw2TyXcQCDCinzlDmbMB2SDY4DX4=;

b=sBppQyZ4EiAXEX11IYOudUKF6qztdUVnoCLv+yqBCL5tWiVh+eh23mKcATD4aTA8wB

wxN5kVfGfxburGz5z4FRlyLxCyv0sTKI1TA+PXNP4tJIAW5MgWRS8hAhZx7wH6l06yvI

1yTsgX6BHVE0XK391T8hCkdU5k03E10E1APd6P8M+Su5FQRbKyuZoAHY1USfwBmGRc1U

GDcK9UNIpp/w3bu/S9I9uKn1YpwxiAkUHHNp4692Iw9mb4LR767ibfWMFliCZJkyWBxF

YsoBcMmSFVFB8T0NQqFLbJ6KXM657nvPN+2vKoiuKG1mhzT1hxnHne0y9l8aDvnRUVjE

ZB0w==

X-Gm-Message-State: AOJu0Yw6UrylTifmhetURbAosa7pD+huhNKEgZiHmLsZRakV+dfkpgxW

OPKtmugX7RW7qwjoiRhcp8YCZxNyVLQpPPs8D/GXS0ErtzyJfTJrvYmQ5D1XNprcgGpKTilmf3H

LlyyClRC7TtOrcvAxxJZHBAvrlSTbauRiCiIEtDWFXlotQ58=

X-Gm-Gg: AfdE7ckzm0bLM6hoAEFvGDPZvwYTjR3dOd9TDZDWV+GUDOjPS6K3/Sjm4RVimbVXwZa

Hkz7fUiYJvKgzTtW27+HWBT/Zib4RE682ldor2Qj6T0nkLp2sMiU1XFKaXFIMmb9o7GGPMmRY4/

a9wasBM+nG8Jxae4mXQm4cMgC6X4GLQdBJS58N9/Fg8F3h745APHzAYRWBgdCOcc1AOPwrUZx6s

455dg2F8HOtk9dmlA8Eg2yWgsUG2SjRKV8vpKoFtzC5meXoEmLj/O0MxS4dJpvdhdu4vllFoO+V

nYG3WrMN+0Crs2CdAKMgolqatZP9yl5Av/wGQcblQivfP9uZ3mQUWumJacV3EFFQFulOwa+Muo1

LIz90rhNxVkUGKmvEabjmwNk=

X-Received: by 2002:a05:6871:2e94:b0:448:558c:d850 with SMTP id 586e51a60fabf-4510637007fmr4485748fac.43.1783464750358;

Tue, 07 Jul 2026 15:52:30 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id 586e51a60fabf-44cfb5ab52asm1591009fac.3.2026.07.07.15.52.30

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Tue, 07 Jul 2026 15:52:30 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "Incoming_Payment|Schedule| Online Review/OU=EXCHANGE ADMINISTRATIVE

GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-55757"



To: doctor@netknow.ca

Subject: =?UTF-8?Q?Invoice_and_Payment_Documentation_Enclos?=

=?UTF-8?Q?ed_for_Review_=EF=BF=BD_07/07/2026_?=

=?UTF-8?Q?=EF=BF=BD_doctor=40netknow=2Eca?=

Message-ID: <8d32afef-ddf7-68df-e16d-9a0dadf3d89b@sabeng.it>

Content-Transfer-Encoding: quoted-printable

Date: Tue, 07 Jul 2026 22:52:28 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 6.1

X-Spam_score_int: 61

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  A document has been sent for your review View Document

Please review the attached document at your convenience. Contact the sender

if you have questions.



Content analysis details: (6.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.160.103 listed in dnsbl.ahbl.org]

[209.85.160.103 listed in dnsbl.ahbl.org]

[209.85.160.103 listed in dnsbl.ahbl.org]

[209.85.160.103 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.160.103 listed in will-spam-for-food.eu.org]

[209.85.160.103 listed in will-spam-for-food.eu.org]

[209.85.160.103 listed in will-spam-for-food.eu.org]

[209.85.160.103 listed in will-spam-for-food.eu.org]

[209.85.160.103 listed in will-spam-for-food.eu.org]

[209.85.160.103 listed in will-spam-for-food.eu.org]

[209.85.160.103 listed in will-spam-for-food.eu.org]

[209.85.160.103 listed in will-spam-for-food.eu.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.160.103 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.160.103 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.160.103 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

Subject: {SPAM?} =?UTF-8?Q?Invoice_and_Payment_Documentation_Enclos?=

=?UTF-8?Q?ed_for_Review_=EF=BF=BD_07/07/2026_?=

=?UTF-8?Q?=EF=BF=BD_doctor=40netknow=2Eca?=

Docusign phish from Google Gmail Part 3

Posted by Dave Yadallee on








3D"Logo"
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/email-logo.png" width=3D"116" />






3D""
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.76.=

0/email/iconFileWithCheckWhite.png" width=3D"75" />

A document has been sent for your review



target=3D"_blank">View Document








Please review the attached document at your convenience. Contact the =

sender if you have questions.





This invitation is intended only for the recipient and contains secure =

access information.











Confidential: Do not share this email or link with =

others.





Alternative signing:
class=3D"alt-sign-link" href=3D"https://app.docusign.com/documents" =

target=3D"_blank"> 3D"DocuSign"
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/email-logo.png" /> Access documents on =

DocuSign and use code:
padding:2px 8px; border-radius:12px; font-weight:bold; =

color:#260559;">{docu-id}




About Docusign: Sign securely and legally in minutes, =

from anywhere.





Need help? Contact the sender or visit our support page=

.






com/en/guides/Declining-to-sign-DocuSign-Signer-Guide" =

target=3D"_blank">Decline to sign |
href=3D"https://support.docusign.com/en/articles/How-do-I-manage-my-email-n=

otifications" target=3D"_blank">Manage notifications




Download the app:
.com/features-and-benefits/mobile" target=3D"_blank"> 3D""
height=3D"18" src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/icon-download-app.png" width=3D"18" />Get =

Docusign





Sent by Ashley Allen via Docusign. To unsubscribe, =

contact the sender.





This message contains =

confidential information. If you are not the intended recipient, please =

delete immediately.