Docusign phish from Google Gmial
Posted by Dave Yadallee onX-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 03 Sep 2026 04:27:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))
(envelope-from
id 1x24eh-00000000O1O-25Tl
for dave@doctor.nl2k.ab.ca;
Thu, 03 Sep 2026 04:26:51 -0600
Resent-From: The Doctor
Resent-Date: Thu, 3 Sep 2026 04:26:51 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pg1-f229.google.com ([209.85.215.229]:42161)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.100 (FreeBSD))
(envelope-from
id 1x1yYM-000000008oL-0vTZ
for support@nk.ca;
Wed, 02 Sep 2026 21:56:03 -0600
Received: by mail-pg1-f229.google.com with SMTP id 41be03b00d2f7-cc147d86bebso653851a12.0
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=sabeng.it; s=google; t=1788407701; x=1789012501; darn=nk.ca;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=fLci6kGwqvQh10ghtYFACGPjzK7cMarYH0pyzJd3Wrg=;
b=ntKyc9B7we2bpzBxxdCbZbOVzsnXPpVfeFPl3eRzV3bCfyoyMcYHaHb78rCCKDNoJ6
Ol2pSkhAU7gdTXpfIOa/Hi3eMBOGL2DSw9J8jhMQ3Tjtsebar37bgCLfgULwJsH0n9x3
becH/MIw0B0JbzK6sIMJi1wLxhRfW9zLlo2MY=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1788407701; x=1789012501;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date
:message-id:reply-to:content-type;
bh=fLci6kGwqvQh10ghtYFACGPjzK7cMarYH0pyzJd3Wrg=;
b=nSShe3BVVIDtU+bl6zDBDJY4wLU1EoRoMerh2Pwl551LJ856tPz5AbE61w4EwoVWvp
9mhPG5E46E2cDo8xzvO7mXRr8S+vjceb+ePGhhDqgFplfObwSzG7V5KuCB1NybLG7b6M
0oIDFFMWMT2ibhdsl3AMOBvD99UQpuS/6i+Dxgx9wSLtVfHyiFe24Zg2GIyPH7EF1jI1
h/qYsLSHZzD5ZShBRGEKnpKYu35pEvpqPdwfeJaFdOSEfaZfx6YjOFEcebZGVpq2roae
yaHdgFOjdVlB9gn0qibdBSylb1JV0KmsGKKgdFEHE2y1XW7EIL9zB7rBcPbdTQAvIcHu
Xj1A==
X-Gm-Message-State: AFuF++n+OM6bDXhx4EEl5KhhPveKjF1BJ5GyBUZeySto/KkRI4nsMNPB
htZtqSGgaBiPVKfWhUQdAlFNJITogp7x+Orv2hGDl0BXoLE/z5KtkuNRx8nwlaN9lv44td7wNfh
Wbs8KbqMQCFnLAuYUn61MAh9TDo3xyyH3+6T4QRZFqsVML+A=
X-Gm-Gg: AYBFou17jCLGP6Xy5TNKv92g9RdDPdpTFGxoIIzusNEhJR2+nQ1bGjhvvMD/dYPgIVA
edxvIkG0k0Vu4uHWjIAxsX+Zevyss2kd/xuayN9y2c8R8KQFtms2hTmFHfJ09cGGK9KoDFoOBIu
RIqO4fV+/UpWbYmL0io8I5F79XkecU5SCKxgkvDAbFfAAzxs0UIyNiI7V27zHY1hrXqijA81vBc
qhXrLHJ8ESXdhb4vMlOVS0lDwUW/U1/Se7Wa0mRBaemLgQMrrOKxpsRN93mdF8fRI4ue84gBASp
Bo/fFEb/SiRUBYqHUAx54GI5Q7SlOrnSnY4F2AF0/doyQ7GuaB1hZ4f5gSJLjDj6Bf2x/L/MFP8
ybwsGjFMSXkM=
X-Received: by 2002:a17:90b:538c:b0:398:9beb:a2b4 with SMTP id 98e67ed59e1d1-39b087992ddmr3634138a91.22.1788407700915;
Wed, 02 Sep 2026 20:55:00 -0700 (PDT)
Received: from sabprogetti.com ([172.245.244.90])
by smtp-relay.gmail.com with ESMTPS id 98e67ed59e1d1-39b165af650sm186918a91.0.2026.09.02.20.55.00
for
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Wed, 02 Sep 2026 20:55:00 -0700 (PDT)
X-Relaying-Domain: sabeng.it
From: DocuSign Via Docusign
To: support@nk.ca
Subject: New Vendor Payment Pending Review
Message-ID:
Content-Transfer-Encoding: quoted-printable
Date: Thu, 03 Sep 2026 03:54:58 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=utf-8
X-Spam_score: 7.7
X-Spam_score_int: 77
X-Spam_bar: +++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview:  A document has been sent for your review View Document
Please review the attached document at your convenience. Contact the sender
if you have questions.
Content analysis details: (7.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[172.245.244.90 listed in will-spam-for-food.eu.org]
[172.245.244.90 listed in will-spam-for-food.eu.org]
[172.245.244.90 listed in will-spam-for-food.eu.org]
[172.245.244.90 listed in will-spam-for-food.eu.org]
[172.245.244.90 listed in will-spam-for-food.eu.org]
[172.245.244.90 listed in will-spam-for-food.eu.org]
[172.245.244.90 listed in will-spam-for-food.eu.org]
[172.245.244.90 listed in will-spam-for-food.eu.org]
[209.85.215.229 listed in will-spam-for-food.eu.org]
[209.85.215.229 listed in will-spam-for-food.eu.org]
[209.85.215.229 listed in will-spam-for-food.eu.org]
[209.85.215.229 listed in will-spam-for-food.eu.org]
[209.85.215.229 listed in will-spam-for-food.eu.org]
[209.85.215.229 listed in will-spam-for-food.eu.org]
[209.85.215.229 listed in will-spam-for-food.eu.org]
[209.85.215.229 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[172.245.244.90 listed in dnsbl.ahbl.org]
[172.245.244.90 listed in dnsbl.ahbl.org]
[172.245.244.90 listed in dnsbl.ahbl.org]
[172.245.244.90 listed in dnsbl.ahbl.org]
[209.85.215.229 listed in dnsbl.ahbl.org]
[209.85.215.229 listed in dnsbl.ahbl.org]
[209.85.215.229 listed in dnsbl.ahbl.org]
[209.85.215.229 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[172.245.244.90 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[172.245.244.90 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[172.245.244.90 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[172.245.244.90 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.215.229 listed in list.dnswl.org]
1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.215.229 listed in bl.score.senderscore.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.215.229 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
1.5 MR_STRANGE_QUESTION URI: No description available.
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 NO_RDNS2 Sending MTA has no reverse DNS
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
0.1 MXG_SPOOFED_DOCUSIGN Docusign spoofing
Subject: {SPAM?} New Vendor Payment Pending Review
=EF=BB=BF
name=3D"viewport" />
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/email-logo.png" width=3D"116" />
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.76.=
0/email/iconFileWithCheckWhite.png" width=3D"75" />
com/wis/clicktime/v1/query?url=3Dhttps%3a%2f%2fus%2deast%2d2.protection.=
sophos.com%2f%3fd%3dpstmrk.it%26u%3daHR0cHM6Ly90cmFjay5wc3RtcmsuaXQvM3MvdHJ=
hY2sucHN0bXJrLml0JTJGM3MlMkZzbGFzaG1haWxtYXJrZXRpbmcuY29tJTI1MkZlbmN5cHRlZC=
UyNTJGbGVnYWwlMkYyLXd0QVElMkZMOHJIQVElMkZBUSUyRjgwZTUwMzFkLWVmZDQtNDYyNy1iM=
jk5LWFmZWVlYWIxYmRjZCUyRjElMkYyS3hVOThHcl92LzItd3RBUS9PTXJIQVEvQVEvYmQ3NjY4=
YzQtNmNiNy00MmM4LThkZjUtYmQ2YzIzMWZmN2M1LzEvVUZGWjIxVzI5OQ%3d%3d%26i%3dNWVh=
MGI5Y2FiMDIzNGIxMTk2NTJjMmFm%26t%3dR1ovMUxVMHdRUzJvamxDWWRyekRNbG1VNHVYb25v=
VmRadDdPSDdQbnVmcz0%3d%26h%3d5506811278cf49338489187e182d8ae2%26s%3dAVNPUEh=
UT0NFTkNSWVBUSVbhY%2dTOPsmii3hW%2dRraAIB4SyY2N%2dwq5x527Tzk6h2PNQ&umid=3De8=
0e0ef3-dd43-4e31-aea7-48f45a1f5df2&rct=3D1788351520&auth=3D6ce738278ddfa182=
90e808d7f7ea6e1d71763812-c72f2aa2a71823cdf05af3f9e2fc01e7bafc92c6" =
target=3D"_blank">View Document