Docusign Phish from Google Gmail Part 2
Posted by Dave Yadallee on=EF=BB=BF
name=3D"viewport" />
=EF=BB=BF
name=3D"viewport" />
Docusign Phish from Google Gmail Part 3
Posted by Dave Yadallee onsrc=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/email-logo.png" width=3D"116" />
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.76.=
0/email/iconFileWithCheckWhite.png" width=3D"75" />
A document has been sent for your review
target=3D"_blank">View Document
Please review the attached document at your convenience. Contact the =
sender if you have questions.
This invitation is intended only for the recipient and contains secure =
access information.
Confidential: Do not share this email or link with =
others.
Alternative signing:
class=3D"alt-sign-link" href=3D"https://app.docusign.com/documents" =
target=3D"_blank">![3D"DocuSign"]()
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/email-logo.png" /> Access documents on =
DocuSign and use code:
padding:2px 8px; border-radius:12px; font-weight:bold; =
color:#260559;">{docu-id}
class=3D"alt-sign-link" href=3D"https://app.docusign.com/documents" =
target=3D"_blank">
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/email-logo.png" /> Access documents on =
DocuSign and use code:
padding:2px 8px; border-radius:12px; font-weight:bold; =
color:#260559;">{docu-id}
About Docusign: Sign securely and legally in minutes, =
from anywhere.
Need help? Contact the sender or visit our support page=
.
com/en/guides/Declining-to-sign-DocuSign-Signer-Guide" =
target=3D"_blank">Decline to sign |
href=3D"https://support.docusign.com/en/articles/How-do-I-manage-my-email-n=
otifications" target=3D"_blank">Manage notifications
Download the app:
.com/features-and-benefits/mobile" target=3D"_blank">
height=3D"18" src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/icon-download-app.png" width=3D"18" />Get =
Docusign
Sent by Ashley Allen via Docusign. To unsubscribe, =
contact the sender.
This message contains =
confidential information. If you are not the intended recipient, please =
delete immediately.
Docusign Phish from Google Gmail Part 1
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 07 Jul 2026 20:16:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1whHob-00000000M1R-2f3o
for dave@doctor.nl2k.ab.ca;
Tue, 07 Jul 2026 20:15:09 -0600
Resent-From: The Doctor
Resent-Date: Tue, 7 Jul 2026 20:15:09 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pj1-f103.google.com ([209.85.216.103]:58499)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1whG5m-00000000GtM-0uzf
for games@nl2k.ab.ca;
Tue, 07 Jul 2026 18:24:55 -0600
Received: by mail-pj1-f103.google.com with SMTP id 98e67ed59e1d1-381b831d535so150441a91.0
for; Tue, 07 Jul 2026 17:23:58 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=sabeng.it; s=google; t=1783470232; x=1784075032; darn=nl2k.ab.ca;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=EWV8XmCUvffytCAcw2TyXcQCDCinzlDmbMB2SDY4DX4=;
b=SCp5xMR1I83OvKRm+V6Wp3eYwUUExN5Q9VDYRizckZ4s/OYk9QddZUdBVQZPd5vomb
3HQmTjjEJj3PHBcUR1yrpDMujlnHMS5+wQgkp0l009veoNroGDcWz5KcIioQflHNkFaN
CRrSx5abWYCDZ9Fa86KAVuphxNAm1cURlXQAw=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1783470232; x=1784075032;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date
:message-id:reply-to:content-type;
bh=EWV8XmCUvffytCAcw2TyXcQCDCinzlDmbMB2SDY4DX4=;
b=TkMMZjYxZZwkL1hv/VGKg8MtVPlsJkKei7+aP5eUoraYs8ajmkkTO9bnsQmko/lp2k
0+LHx/BoWCDw3mEwRnNdk4xsiDoI+n5B82hH/K2ZdiN832s9K160s7UPufPWZ9mCiRHK
lyHdDgeu3EQKs2fEtdfFFnLiw1VHwD9OU4/Fdw79MxsYK0UxX15aB5Z5HUbV7O2EO5NY
E1I6pGOJUSeoyc+ZxBW40wU1+AIt5ShMTuMsnSLzoRVoVPnoEmoZTc2s847R4CYzmHer
o+EZpzNyeTn4tvSeILJ6+qdxJtmomxa7ZlC2xqHQV0QMZzIRRE7eIDUHCFUZ5+6A6wB2
Nlrw==
X-Gm-Message-State: AOJu0YyeEKcTI6lTKeK7Ra5xgIbiykv94CKDr2XWPggQhjRYYoEjKyvE
W0KYUzZtiWn4iHqRQZpJ0lWIH4hJvkVSkBQfT3NkifSx/1cp5hNNV1o74zgp6CO2822EhswFdhG
RJ0D5yDm01Ql4ggfMM5SF8qaf4nS95E5D1q5TXa+Uv3utUpw=
X-Gm-Gg: AfdE7cmxuk0MU1oaZALI3HZpl4JZOKzcPSGhG8ZgAnZ9EgBtraVy4zZAaJINMWla442
FV0nQlnePz23WP55ls+uzPYqbsHySolG33upmT0rRWWZe08HD8rMMGL1xIlVZOnuK3w2eXF+rm3
QE8/Mc78nUXURY3gJzK/vE1PHuQo6mhmGLGufhV1NWwU//a8ctBAPby7kB/l5aVlRnDviYKO58C
QtvQ0pdfadHP8wSnN17drv7mSDbgctXpCKG2PAIGmx/G5hPsgDuJ3iuKA9baU56EFvUrur6XeKg
jnBMMZh74zvMz4Jr8nSSQdqG28KOW1PmALv9sfoFfrQl9yWgN6VIN+XYHYStl05zCIjZgnb5m3q
MsAK62e4B+Ir99Tu0NQ==
X-Received: by 2002:a17:90b:4a11:b0:366:132:fda7 with SMTP id 98e67ed59e1d1-38940150894mr161299a91.10.1783470232524;
Tue, 07 Jul 2026 17:23:52 -0700 (PDT)
Received: from sabprogetti.com ([192.210.236.148])
by smtp-relay.gmail.com with ESMTPS id 98e67ed59e1d1-387d3c6bee2sm373673a91.8.2026.07.07.17.23.52
for
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Tue, 07 Jul 2026 17:23:52 -0700 (PDT)
X-Relaying-Domain: sabeng.it
From: "Incoming_Remittance| Scheduled | Online/OU=EXCHANGE ADMINISTRATIVE
GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-51036"
To: games@nl2k.ab.ca
Subject: =?UTF-8?Q?Request_for_Review=3A_Sortcode=2C_Invoic?=
=?UTF-8?Q?e_=26_Payment_Report_=EF=BF=BD_07/07/202?=
=?UTF-8?Q?6_=EF=BF=BD_games=40nl2k=2Eab=2Eca?=
Message-ID: <5e816cae-6587-96bc-848c-39711f4f75a1@sabeng.it>
Content-Transfer-Encoding: quoted-printable
Date: Wed, 08 Jul 2026 00:23:50 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=utf-8
X-Spam_score: 6.3
X-Spam_score_int: 63
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview:  A document has been sent for your review View Document
Please review the attached document at your convenience. Contact the sender
if you have questions.
Content analysis details: (6.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.216.103 listed in dnsbl.ahbl.org]
[209.85.216.103 listed in dnsbl.ahbl.org]
[209.85.216.103 listed in dnsbl.ahbl.org]
[209.85.216.103 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.216.103 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.216.103 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.216.103 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.216.103 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[209.85.216.103 listed in will-spam-for-food.eu.org]
[209.85.216.103 listed in will-spam-for-food.eu.org]
[209.85.216.103 listed in will-spam-for-food.eu.org]
[209.85.216.103 listed in will-spam-for-food.eu.org]
[209.85.216.103 listed in will-spam-for-food.eu.org]
[209.85.216.103 listed in will-spam-for-food.eu.org]
[209.85.216.103 listed in will-spam-for-food.eu.org]
[209.85.216.103 listed in will-spam-for-food.eu.org]
1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.216.103 listed in list.dnswl.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.216.103 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 NO_RDNS2 Sending MTA has no reverse DNS
0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.216.103 listed in bl.score.senderscore.com]
Subject: {SPAM?} =?UTF-8?Q?Request_for_Review=3A_Sortcode=2C_Invoic?=
=?UTF-8?Q?e_=26_Payment_Report_=EF=BF=BD_07/07/202?=
=?UTF-8?Q?6_=EF=BF=BD_games=40nl2k=2Eab=2Eca?=
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 07 Jul 2026 20:16:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from
id 1whHob-00000000M1R-2f3o
for dave@doctor.nl2k.ab.ca;
Tue, 07 Jul 2026 20:15:09 -0600
Resent-From: The Doctor
Resent-Date: Tue, 7 Jul 2026 20:15:09 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pj1-f103.google.com ([209.85.216.103]:58499)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.99.3 (FreeBSD))
(envelope-from
id 1whG5m-00000000GtM-0uzf
for games@nl2k.ab.ca;
Tue, 07 Jul 2026 18:24:55 -0600
Received: by mail-pj1-f103.google.com with SMTP id 98e67ed59e1d1-381b831d535so150441a91.0
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=sabeng.it; s=google; t=1783470232; x=1784075032; darn=nl2k.ab.ca;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=EWV8XmCUvffytCAcw2TyXcQCDCinzlDmbMB2SDY4DX4=;
b=SCp5xMR1I83OvKRm+V6Wp3eYwUUExN5Q9VDYRizckZ4s/OYk9QddZUdBVQZPd5vomb
3HQmTjjEJj3PHBcUR1yrpDMujlnHMS5+wQgkp0l009veoNroGDcWz5KcIioQflHNkFaN
CRrSx5abWYCDZ9Fa86KAVuphxNAm1cURlXQAw=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1783470232; x=1784075032;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date
:message-id:reply-to:content-type;
bh=EWV8XmCUvffytCAcw2TyXcQCDCinzlDmbMB2SDY4DX4=;
b=TkMMZjYxZZwkL1hv/VGKg8MtVPlsJkKei7+aP5eUoraYs8ajmkkTO9bnsQmko/lp2k
0+LHx/BoWCDw3mEwRnNdk4xsiDoI+n5B82hH/K2ZdiN832s9K160s7UPufPWZ9mCiRHK
lyHdDgeu3EQKs2fEtdfFFnLiw1VHwD9OU4/Fdw79MxsYK0UxX15aB5Z5HUbV7O2EO5NY
E1I6pGOJUSeoyc+ZxBW40wU1+AIt5ShMTuMsnSLzoRVoVPnoEmoZTc2s847R4CYzmHer
o+EZpzNyeTn4tvSeILJ6+qdxJtmomxa7ZlC2xqHQV0QMZzIRRE7eIDUHCFUZ5+6A6wB2
Nlrw==
X-Gm-Message-State: AOJu0YyeEKcTI6lTKeK7Ra5xgIbiykv94CKDr2XWPggQhjRYYoEjKyvE
W0KYUzZtiWn4iHqRQZpJ0lWIH4hJvkVSkBQfT3NkifSx/1cp5hNNV1o74zgp6CO2822EhswFdhG
RJ0D5yDm01Ql4ggfMM5SF8qaf4nS95E5D1q5TXa+Uv3utUpw=
X-Gm-Gg: AfdE7cmxuk0MU1oaZALI3HZpl4JZOKzcPSGhG8ZgAnZ9EgBtraVy4zZAaJINMWla442
FV0nQlnePz23WP55ls+uzPYqbsHySolG33upmT0rRWWZe08HD8rMMGL1xIlVZOnuK3w2eXF+rm3
QE8/Mc78nUXURY3gJzK/vE1PHuQo6mhmGLGufhV1NWwU//a8ctBAPby7kB/l5aVlRnDviYKO58C
QtvQ0pdfadHP8wSnN17drv7mSDbgctXpCKG2PAIGmx/G5hPsgDuJ3iuKA9baU56EFvUrur6XeKg
jnBMMZh74zvMz4Jr8nSSQdqG28KOW1PmALv9sfoFfrQl9yWgN6VIN+XYHYStl05zCIjZgnb5m3q
MsAK62e4B+Ir99Tu0NQ==
X-Received: by 2002:a17:90b:4a11:b0:366:132:fda7 with SMTP id 98e67ed59e1d1-38940150894mr161299a91.10.1783470232524;
Tue, 07 Jul 2026 17:23:52 -0700 (PDT)
Received: from sabprogetti.com ([192.210.236.148])
by smtp-relay.gmail.com with ESMTPS id 98e67ed59e1d1-387d3c6bee2sm373673a91.8.2026.07.07.17.23.52
for
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Tue, 07 Jul 2026 17:23:52 -0700 (PDT)
X-Relaying-Domain: sabeng.it
From: "Incoming_Remittance| Scheduled | Online/OU=EXCHANGE ADMINISTRATIVE
GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-51036"
To: games@nl2k.ab.ca
Subject: =?UTF-8?Q?Request_for_Review=3A_Sortcode=2C_Invoic?=
=?UTF-8?Q?e_=26_Payment_Report_=EF=BF=BD_07/07/202?=
=?UTF-8?Q?6_=EF=BF=BD_games=40nl2k=2Eab=2Eca?=
Message-ID: <5e816cae-6587-96bc-848c-39711f4f75a1@sabeng.it>
Content-Transfer-Encoding: quoted-printable
Date: Wed, 08 Jul 2026 00:23:50 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=utf-8
X-Spam_score: 6.3
X-Spam_score_int: 63
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview:  A document has been sent for your review View Document
Please review the attached document at your convenience. Contact the sender
if you have questions.
Content analysis details: (6.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.216.103 listed in dnsbl.ahbl.org]
[209.85.216.103 listed in dnsbl.ahbl.org]
[209.85.216.103 listed in dnsbl.ahbl.org]
[209.85.216.103 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.216.103 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.216.103 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.216.103 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.216.103 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[209.85.216.103 listed in will-spam-for-food.eu.org]
[209.85.216.103 listed in will-spam-for-food.eu.org]
[209.85.216.103 listed in will-spam-for-food.eu.org]
[209.85.216.103 listed in will-spam-for-food.eu.org]
[209.85.216.103 listed in will-spam-for-food.eu.org]
[209.85.216.103 listed in will-spam-for-food.eu.org]
[209.85.216.103 listed in will-spam-for-food.eu.org]
[209.85.216.103 listed in will-spam-for-food.eu.org]
1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.216.103 listed in list.dnswl.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.216.103 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 NO_RDNS2 Sending MTA has no reverse DNS
0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.216.103 listed in bl.score.senderscore.com]
Subject: {SPAM?} =?UTF-8?Q?Request_for_Review=3A_Sortcode=2C_Invoic?=
=?UTF-8?Q?e_=26_Payment_Report_=EF=BF=BD_07/07/202?=
=?UTF-8?Q?6_=EF=BF=BD_games=40nl2k=2Eab=2Eca?=
Docusign Phish from Google Gmail Part 3
Posted by Dave Yadallee onsrc=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/email-logo.png" width=3D"116" />
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.76.=
0/email/iconFileWithCheckWhite.png" width=3D"75" />
A document has been sent for your review
target=3D"_blank">View Document
Please review the attached document at your convenience. Contact the =
sender if you have questions.
This invitation is intended only for the recipient and contains secure =
access information.
Confidential: Do not share this email or link with =
others.
Alternative signing:
class=3D"alt-sign-link" href=3D"https://app.docusign.com/documents" =
target=3D"_blank">![3D"DocuSign"]()
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/email-logo.png" /> Access documents on =
DocuSign and use code:
padding:2px 8px; border-radius:12px; font-weight:bold; =
color:#260559;">{docu-id}
class=3D"alt-sign-link" href=3D"https://app.docusign.com/documents" =
target=3D"_blank">
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/email-logo.png" /> Access documents on =
DocuSign and use code:
padding:2px 8px; border-radius:12px; font-weight:bold; =
color:#260559;">{docu-id}
About Docusign: Sign securely and legally in minutes, =
from anywhere.
Need help? Contact the sender or visit our support page=
.
com/en/guides/Declining-to-sign-DocuSign-Signer-Guide" =
target=3D"_blank">Decline to sign |
href=3D"https://support.docusign.com/en/articles/How-do-I-manage-my-email-n=
otifications" target=3D"_blank">Manage notifications
Download the app:
.com/features-and-benefits/mobile" target=3D"_blank">
height=3D"18" src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/icon-download-app.png" width=3D"18" />Get =
Docusign
Sent by Ashley Allen via Docusign. To unsubscribe, =
contact the sender.
This message contains =
confidential information. If you are not the intended recipient, please =
delete immediately.
Docusign Phish from Google Gmail Part 1
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 07 Jul 2026 17:44:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1whFRa-00000000EGz-1SII
for dave@doctor.nl2k.ab.ca;
Tue, 07 Jul 2026 17:43:14 -0600
Resent-From: The Doctor
Resent-Date: Tue, 7 Jul 2026 17:43:14 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pl1-f229.google.com ([209.85.214.229]:56404)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1whEfM-00000000I6M-1hvA
for doctor@nk.ca;
Tue, 07 Jul 2026 16:53:36 -0600
Received: by mail-pl1-f229.google.com with SMTP id d9443c01a7336-2cca0c5799eso747575ad.0
for; Tue, 07 Jul 2026 15:52:36 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=sabeng.it; s=google; t=1783464750; x=1784069550; darn=nk.ca;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=EWV8XmCUvffytCAcw2TyXcQCDCinzlDmbMB2SDY4DX4=;
b=e90ZA+Gol0yXRXQCRjT+RRivkK6H7zgqbGa20p41vBjRC6eKLzvnlOG6kXO9PtDHJ9
pWxiCXrB3TSXkHA29l35b2XN4sGmR/SID4nBhWaBoF47qfsvD59nIUqryitR5tL6Dho9
uaURnz7rKnNe8UXfhb70l1ck/1s/pshiIt5wc=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1783464750; x=1784069550;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date
:message-id:reply-to:content-type;
bh=EWV8XmCUvffytCAcw2TyXcQCDCinzlDmbMB2SDY4DX4=;
b=tBP39U9kuba+lya+6grO9u2/76PUlYu1l3cGFQTvUacIv5Y/We82xtolkSXF9Ri/8V
HOs+K0CEyp7XZ6N91NhbQ8RGGW+nlVrvFMKse/XhNTAWoOBg3VeEcPKQyWAxCerQ/oem
h8YaEI2f6T4i9XgQLP73i25SsLqVLO3DLM8Av4ePc6dBmOIXBF2DFVV4yr3wzp+LMMbP
6SsYyjGE+7XYK4ANx87pvY+gijTwTdBJDYVQib6loFhLW/sG+xkGIgxDyJbBVZ8fNG+z
l4hBVI9t8/YP5q1fYzY18liRgGS83BcqXXrwVqe01Khq44BFL6z5VPttBUvvsh+m+5Qa
YRgw==
X-Gm-Message-State: AOJu0YxULub1rLrejIy4sJdMc9TRGvlJ0sbRNgL/hn0cK8LjxWu0wcLR
AsfNIMAGcD46AIpPsoJB3RcLSU5vuaT4sz0FRKUMEiAywI0NKcnXa8ViBdunvKatzTYWI1ix0FD
pDv4l5Fl5CpemhZH/lvoJ+t6fTYuRAzHQVkNe73yKyi8Vn8Q=
X-Gm-Gg: AfdE7ckgEKENE6zSoMkgdNudRIeuj62P5YBcRtHJk9o9+QueKd3wpOfdew0fmFhZ4iw
nVplVhod8nWQrqhYr1bwJXoFuyMQZ2nPdogbWbfrufC4R6t2MERU/6biaq4l1JCMKygvLE63X8V
m6m1x26H/ZHJBeYjuvtm5fmSHhEGEFuRhxTJJTrfI7Bvblx3f8kNgZqME5VM/6WSu6Pn5iYyt2c
bi+ta7+b8ZYYh5KKG7QxXxKR3soskmulEhUaEwjEeSZ0mkcPW35Bgjny9hgOhWzfKXv9EGgrTVo
c1lFJT//fRJxtjbOyM2jdBjQ1fBq/nSdZ4r5N8DhFrqVh9UzS92cg3LxELuG9+mlHrZOeAyohsq
9gHkXqQJwu17xhRpgpg==
X-Received: by 2002:a17:902:ebd1:b0:2c9:ed16:8d8d with SMTP id d9443c01a7336-2ccbf1890d3mr68975175ad.38.1783464750587;
Tue, 07 Jul 2026 15:52:30 -0700 (PDT)
Received: from sabprogetti.com ([192.210.236.148])
by smtp-relay.gmail.com with ESMTPS id d9443c01a7336-2ccc9bdd019sm3313665ad.13.2026.07.07.15.52.30
for
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Tue, 07 Jul 2026 15:52:30 -0700 (PDT)
X-Relaying-Domain: sabeng.it
From: "Incoming_Payment | EFT Portal/OU=EXCHANGE ADMINISTRATIVE GROUP
(FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-27559"
To: doctor@nk.ca
Subject: =?UTF-8?Q?Attached_Payment_Report_for_Your_Review_?=
=?UTF-8?Q?=EF=BF=BD_07/07/2026_=EF=BF=BD_doctor=40?= =?UTF-8?Q?nk=2Eca?=
Message-ID: <31213b49-f665-fd68-977f-edfe928d705a@sabeng.it>
Content-Transfer-Encoding: quoted-printable
Date: Tue, 07 Jul 2026 22:52:29 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=utf-8
X-Spam_score: 6.3
X-Spam_score_int: 63
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview:  A document has been sent for your review View Document
Please review the attached document at your convenience. Contact the sender
if you have questions.
Content analysis details: (6.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[209.85.214.229 listed in dnsbl.ahbl.org]
[209.85.214.229 listed in dnsbl.ahbl.org]
[209.85.214.229 listed in dnsbl.ahbl.org]
[209.85.214.229 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[209.85.214.229 listed in will-spam-for-food.eu.org]
[209.85.214.229 listed in will-spam-for-food.eu.org]
[209.85.214.229 listed in will-spam-for-food.eu.org]
[209.85.214.229 listed in will-spam-for-food.eu.org]
[209.85.214.229 listed in will-spam-for-food.eu.org]
[209.85.214.229 listed in will-spam-for-food.eu.org]
[209.85.214.229 listed in will-spam-for-food.eu.org]
[209.85.214.229 listed in will-spam-for-food.eu.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.214.229 listed in list.dnswl.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.214.229 listed in bl.score.senderscore.com]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.214.229 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 NO_RDNS2 Sending MTA has no reverse DNS
0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
Subject: {SPAM?} =?UTF-8?Q?Attached_Payment_Report_for_Your_Review_?=
=?UTF-8?Q?=EF=BF=BD_07/07/2026_=EF=BF=BD_doctor=40?= =?UTF-8?Q?nk=2Eca?=
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 07 Jul 2026 17:44:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from
id 1whFRa-00000000EGz-1SII
for dave@doctor.nl2k.ab.ca;
Tue, 07 Jul 2026 17:43:14 -0600
Resent-From: The Doctor
Resent-Date: Tue, 7 Jul 2026 17:43:14 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pl1-f229.google.com ([209.85.214.229]:56404)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.99.3 (FreeBSD))
(envelope-from
id 1whEfM-00000000I6M-1hvA
for doctor@nk.ca;
Tue, 07 Jul 2026 16:53:36 -0600
Received: by mail-pl1-f229.google.com with SMTP id d9443c01a7336-2cca0c5799eso747575ad.0
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=sabeng.it; s=google; t=1783464750; x=1784069550; darn=nk.ca;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=EWV8XmCUvffytCAcw2TyXcQCDCinzlDmbMB2SDY4DX4=;
b=e90ZA+Gol0yXRXQCRjT+RRivkK6H7zgqbGa20p41vBjRC6eKLzvnlOG6kXO9PtDHJ9
pWxiCXrB3TSXkHA29l35b2XN4sGmR/SID4nBhWaBoF47qfsvD59nIUqryitR5tL6Dho9
uaURnz7rKnNe8UXfhb70l1ck/1s/pshiIt5wc=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1783464750; x=1784069550;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date
:message-id:reply-to:content-type;
bh=EWV8XmCUvffytCAcw2TyXcQCDCinzlDmbMB2SDY4DX4=;
b=tBP39U9kuba+lya+6grO9u2/76PUlYu1l3cGFQTvUacIv5Y/We82xtolkSXF9Ri/8V
HOs+K0CEyp7XZ6N91NhbQ8RGGW+nlVrvFMKse/XhNTAWoOBg3VeEcPKQyWAxCerQ/oem
h8YaEI2f6T4i9XgQLP73i25SsLqVLO3DLM8Av4ePc6dBmOIXBF2DFVV4yr3wzp+LMMbP
6SsYyjGE+7XYK4ANx87pvY+gijTwTdBJDYVQib6loFhLW/sG+xkGIgxDyJbBVZ8fNG+z
l4hBVI9t8/YP5q1fYzY18liRgGS83BcqXXrwVqe01Khq44BFL6z5VPttBUvvsh+m+5Qa
YRgw==
X-Gm-Message-State: AOJu0YxULub1rLrejIy4sJdMc9TRGvlJ0sbRNgL/hn0cK8LjxWu0wcLR
AsfNIMAGcD46AIpPsoJB3RcLSU5vuaT4sz0FRKUMEiAywI0NKcnXa8ViBdunvKatzTYWI1ix0FD
pDv4l5Fl5CpemhZH/lvoJ+t6fTYuRAzHQVkNe73yKyi8Vn8Q=
X-Gm-Gg: AfdE7ckgEKENE6zSoMkgdNudRIeuj62P5YBcRtHJk9o9+QueKd3wpOfdew0fmFhZ4iw
nVplVhod8nWQrqhYr1bwJXoFuyMQZ2nPdogbWbfrufC4R6t2MERU/6biaq4l1JCMKygvLE63X8V
m6m1x26H/ZHJBeYjuvtm5fmSHhEGEFuRhxTJJTrfI7Bvblx3f8kNgZqME5VM/6WSu6Pn5iYyt2c
bi+ta7+b8ZYYh5KKG7QxXxKR3soskmulEhUaEwjEeSZ0mkcPW35Bgjny9hgOhWzfKXv9EGgrTVo
c1lFJT//fRJxtjbOyM2jdBjQ1fBq/nSdZ4r5N8DhFrqVh9UzS92cg3LxELuG9+mlHrZOeAyohsq
9gHkXqQJwu17xhRpgpg==
X-Received: by 2002:a17:902:ebd1:b0:2c9:ed16:8d8d with SMTP id d9443c01a7336-2ccbf1890d3mr68975175ad.38.1783464750587;
Tue, 07 Jul 2026 15:52:30 -0700 (PDT)
Received: from sabprogetti.com ([192.210.236.148])
by smtp-relay.gmail.com with ESMTPS id d9443c01a7336-2ccc9bdd019sm3313665ad.13.2026.07.07.15.52.30
for
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Tue, 07 Jul 2026 15:52:30 -0700 (PDT)
X-Relaying-Domain: sabeng.it
From: "Incoming_Payment | EFT Portal/OU=EXCHANGE ADMINISTRATIVE GROUP
(FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-27559"
To: doctor@nk.ca
Subject: =?UTF-8?Q?Attached_Payment_Report_for_Your_Review_?=
=?UTF-8?Q?=EF=BF=BD_07/07/2026_=EF=BF=BD_doctor=40?= =?UTF-8?Q?nk=2Eca?=
Message-ID: <31213b49-f665-fd68-977f-edfe928d705a@sabeng.it>
Content-Transfer-Encoding: quoted-printable
Date: Tue, 07 Jul 2026 22:52:29 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=utf-8
X-Spam_score: 6.3
X-Spam_score_int: 63
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview:  A document has been sent for your review View Document
Please review the attached document at your convenience. Contact the sender
if you have questions.
Content analysis details: (6.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[209.85.214.229 listed in dnsbl.ahbl.org]
[209.85.214.229 listed in dnsbl.ahbl.org]
[209.85.214.229 listed in dnsbl.ahbl.org]
[209.85.214.229 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[209.85.214.229 listed in will-spam-for-food.eu.org]
[209.85.214.229 listed in will-spam-for-food.eu.org]
[209.85.214.229 listed in will-spam-for-food.eu.org]
[209.85.214.229 listed in will-spam-for-food.eu.org]
[209.85.214.229 listed in will-spam-for-food.eu.org]
[209.85.214.229 listed in will-spam-for-food.eu.org]
[209.85.214.229 listed in will-spam-for-food.eu.org]
[209.85.214.229 listed in will-spam-for-food.eu.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.214.229 listed in list.dnswl.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.214.229 listed in bl.score.senderscore.com]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.214.229 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 NO_RDNS2 Sending MTA has no reverse DNS
0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
Subject: {SPAM?} =?UTF-8?Q?Attached_Payment_Report_for_Your_Review_?=
=?UTF-8?Q?=EF=BF=BD_07/07/2026_=EF=BF=BD_doctor=40?= =?UTF-8?Q?nk=2Eca?=
Docusign Phish from Google Gmail Part 2
Posted by Dave Yadallee on=EF=BB=BF
name=3D"viewport" />
Docusign Phish from Google Gmail Part 3
Posted by Dave Yadallee onsrc=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/email-logo.png" width=3D"116" />
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.76.=
0/email/iconFileWithCheckWhite.png" width=3D"75" />
A document has been sent for your review
target=3D"_blank">View Document
Please review the attached document at your convenience. Contact the =
sender if you have questions.
This invitation is intended only for the recipient and contains secure =
access information.
Confidential: Do not share this email or link with =
others.
Alternative signing:
class=3D"alt-sign-link" href=3D"https://app.docusign.com/documents" =
target=3D"_blank">![3D"DocuSign"]()
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/email-logo.png" /> Access documents on =
DocuSign and use code:
padding:2px 8px; border-radius:12px; font-weight:bold; =
color:#260559;">{docu-id}
class=3D"alt-sign-link" href=3D"https://app.docusign.com/documents" =
target=3D"_blank">
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/email-logo.png" /> Access documents on =
DocuSign and use code:
padding:2px 8px; border-radius:12px; font-weight:bold; =
color:#260559;">{docu-id}
About Docusign: Sign securely and legally in minutes, =
from anywhere.
Need help? Contact the sender or visit our support page=
.
com/en/guides/Declining-to-sign-DocuSign-Signer-Guide" =
target=3D"_blank">Decline to sign |
href=3D"https://support.docusign.com/en/articles/How-do-I-manage-my-email-n=
otifications" target=3D"_blank">Manage notifications
Download the app:
.com/features-and-benefits/mobile" target=3D"_blank">
height=3D"18" src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/icon-download-app.png" width=3D"18" />Get =
Docusign
Sent by Ashley Allen via Docusign. To unsubscribe, =
contact the sender.
This message contains =
confidential information. If you are not the intended recipient, please =
delete immediately.
Docusign Phish from Google Gmail Part 2
Posted by Dave Yadallee on=EF=BB=BF
name=3D"viewport" />
Docusign Phish from Google Gmail Part 1
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 07 Jul 2026 17:44:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1whFRi-00000000EHP-2763
for dave@doctor.nl2k.ab.ca;
Tue, 07 Jul 2026 17:43:22 -0600
Resent-From: The Doctor
Resent-Date: Tue, 7 Jul 2026 17:43:22 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-oo1-f102.google.com ([209.85.161.102]:51236)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1whEfM-00000000I6N-1gOo
for doctor@nl2k.ab.ca;
Tue, 07 Jul 2026 16:53:36 -0600
Received: by mail-oo1-f102.google.com with SMTP id 006d021491bc7-6a347ec19a5so5832eaf.2
for; Tue, 07 Jul 2026 15:52:36 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=sabeng.it; s=google; t=1783464750; x=1784069550; darn=nl2k.ab.ca;
h=mime-version:date:content-transfer-encoding:message-id:subject:to
:from:from:to:cc:subject:date:message-id:reply-to;
bh=EWV8XmCUvffytCAcw2TyXcQCDCinzlDmbMB2SDY4DX4=;
b=dnOl+qkYD+HZxgg1apTc6ph1mbmbHgDVP/R6Nq3JDgFI7KyF1mL3otTMXFtqx+Gwc9
sw8Hx9nd/dBHVY/MVyoNHvRmsaywQJhyJg0B5jeZ6imwjl7SY37OVGtEoKGUg0CTvEzg
3AeRjf74xvs0HC8hxW8P1mbfcQOq0hRYqIS6E=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1783464750; x=1784069550;
h=mime-version:date:content-transfer-encoding:message-id:subject:to
:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id
:reply-to;
bh=EWV8XmCUvffytCAcw2TyXcQCDCinzlDmbMB2SDY4DX4=;
b=OMhlrsWo3PE5ASsWDzEC9ItNVyFBnRDvMzZvVKGXglgKIAVg8mYUGhvIETKm+KD0Vj
lCIaa9BJ7Vntg6Exr9rHe7H65x/q0SiyfdfekihM8s88paLJwbdibZyQ6qT1NKqY7FJE
oqx3OhN1RNEHl2Sf6Iko9U6M1ROmBO6siiXsjPKf+GxZxamapGWkP3EO/tPIOMZ3bJVC
6vOzyOrDY0cT6Qx92cq0AMzoVKe+wXvD0yyy6UAn5XgI3i8BqYFhf6wYsBBIh2u8gR/H
YgsDWxS2t+nMtmcAOLe9f4GKu7JwoxSammSHeRCyHBa8hzAVjSyh1qFRPaZxH08F2QKh
y1/A==
X-Gm-Message-State: AOJu0Yw9FTjDRKbhOCeDtxy6fhGabgPMv/cL5AqrzIv3zUH6P2tdCCup
FtJFbyQADZuykfZfUhJcrXnH303wMBvLmfS1bu8szWaPosKkEWVo8+r4ifdrqW43WSBjgPXGlqA
RriJ5PZPekywCAq/g/VkCrj7x+cegyy3XMW0gkeNtfQ7giu4=
X-Gm-Gg: AfdE7cn3MULtH5gvp2pl8JkQOqB6YgFHaSGSlIhGaYGkCc128sBBr6n9VblcKVNAVKA
5keJWAv/NU6GzlqcL4CKmeWHrRzridD3hZUumg6BgcpxxOnetWPUZrWwE3gAdqQa338WBqZ5kh+
jFMEA1TZVZ7TqkDuHGMWvTNI+UTRdJmluqYyMPF2Q0UGbroS2CVJ01PHeraN8dhsEfGl5Qr2GlI
Pn9zeSwSFESZViOB9laILvNvMtSxwCEK6b4BBjabfwelhByeHqpOzA+RqbjCaLLPi/qj1BA4xx8
UIxJEl/VoS5kH3hHUhL/1dBuQSgZKRSWH1K539RNRb+kQzlYhdp52nDBZhkybLmga+5biUdnuh2
MgXUX/sKC5osHlcCv/iUkBE0=
X-Received: by 2002:a05:6820:60c:b0:6a3:66dd:ca10 with SMTP id 006d021491bc7-6a36da170b0mr7005eaf.53.1783464750653;
Tue, 07 Jul 2026 15:52:30 -0700 (PDT)
Received: from sabprogetti.com ([192.210.236.148])
by smtp-relay.gmail.com with ESMTPS id 586e51a60fabf-44cfb5ab52asm1591009fac.3.2026.07.07.15.52.30
for
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Tue, 07 Jul 2026 15:52:30 -0700 (PDT)
X-Relaying-Domain: sabeng.it
From: "Incoming_Payment|Schedule| Online Review/OU=EXCHANGE ADMINISTRATIVE
GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-45027"
To: doctor@nl2k.ab.ca
Subject: =?UTF-8?Q?Please_Review_the_Attached_Slip=2C_Invoi?=
=?UTF-8?Q?ce_=26_Payment_Report_=EF=BF=BD_07/07/20?=
=?UTF-8?Q?26_=EF=BF=BD_doctor=40nl2k=2Eab=2Eca?=
Message-ID:
Content-Transfer-Encoding: quoted-printable
Date: Tue, 07 Jul 2026 22:52:29 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=utf-8
X-Spam_score: 6.3
X-Spam_score_int: 63
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview:  A document has been sent for your review View Document
Please review the attached document at your convenience. Contact the sender
if you have questions.
Content analysis details: (6.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[209.85.161.102 listed in dnsbl.ahbl.org]
[209.85.161.102 listed in dnsbl.ahbl.org]
[209.85.161.102 listed in dnsbl.ahbl.org]
[209.85.161.102 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[209.85.161.102 listed in will-spam-for-food.eu.org]
[209.85.161.102 listed in will-spam-for-food.eu.org]
[209.85.161.102 listed in will-spam-for-food.eu.org]
[209.85.161.102 listed in will-spam-for-food.eu.org]
[209.85.161.102 listed in will-spam-for-food.eu.org]
[209.85.161.102 listed in will-spam-for-food.eu.org]
[209.85.161.102 listed in will-spam-for-food.eu.org]
[209.85.161.102 listed in will-spam-for-food.eu.org]
1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.161.102 listed in list.dnswl.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.161.102 listed in bl.score.senderscore.com]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.161.102 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 NO_RDNS2 Sending MTA has no reverse DNS
0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
Subject: {SPAM?} =?UTF-8?Q?Please_Review_the_Attached_Slip=2C_Invoi?=
=?UTF-8?Q?ce_=26_Payment_Report_=EF=BF=BD_07/07/20?=
=?UTF-8?Q?26_=EF=BF=BD_doctor=40nl2k=2Eab=2Eca?=
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 07 Jul 2026 17:44:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from
id 1whFRi-00000000EHP-2763
for dave@doctor.nl2k.ab.ca;
Tue, 07 Jul 2026 17:43:22 -0600
Resent-From: The Doctor
Resent-Date: Tue, 7 Jul 2026 17:43:22 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-oo1-f102.google.com ([209.85.161.102]:51236)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.99.3 (FreeBSD))
(envelope-from
id 1whEfM-00000000I6N-1gOo
for doctor@nl2k.ab.ca;
Tue, 07 Jul 2026 16:53:36 -0600
Received: by mail-oo1-f102.google.com with SMTP id 006d021491bc7-6a347ec19a5so5832eaf.2
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=sabeng.it; s=google; t=1783464750; x=1784069550; darn=nl2k.ab.ca;
h=mime-version:date:content-transfer-encoding:message-id:subject:to
:from:from:to:cc:subject:date:message-id:reply-to;
bh=EWV8XmCUvffytCAcw2TyXcQCDCinzlDmbMB2SDY4DX4=;
b=dnOl+qkYD+HZxgg1apTc6ph1mbmbHgDVP/R6Nq3JDgFI7KyF1mL3otTMXFtqx+Gwc9
sw8Hx9nd/dBHVY/MVyoNHvRmsaywQJhyJg0B5jeZ6imwjl7SY37OVGtEoKGUg0CTvEzg
3AeRjf74xvs0HC8hxW8P1mbfcQOq0hRYqIS6E=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1783464750; x=1784069550;
h=mime-version:date:content-transfer-encoding:message-id:subject:to
:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id
:reply-to;
bh=EWV8XmCUvffytCAcw2TyXcQCDCinzlDmbMB2SDY4DX4=;
b=OMhlrsWo3PE5ASsWDzEC9ItNVyFBnRDvMzZvVKGXglgKIAVg8mYUGhvIETKm+KD0Vj
lCIaa9BJ7Vntg6Exr9rHe7H65x/q0SiyfdfekihM8s88paLJwbdibZyQ6qT1NKqY7FJE
oqx3OhN1RNEHl2Sf6Iko9U6M1ROmBO6siiXsjPKf+GxZxamapGWkP3EO/tPIOMZ3bJVC
6vOzyOrDY0cT6Qx92cq0AMzoVKe+wXvD0yyy6UAn5XgI3i8BqYFhf6wYsBBIh2u8gR/H
YgsDWxS2t+nMtmcAOLe9f4GKu7JwoxSammSHeRCyHBa8hzAVjSyh1qFRPaZxH08F2QKh
y1/A==
X-Gm-Message-State: AOJu0Yw9FTjDRKbhOCeDtxy6fhGabgPMv/cL5AqrzIv3zUH6P2tdCCup
FtJFbyQADZuykfZfUhJcrXnH303wMBvLmfS1bu8szWaPosKkEWVo8+r4ifdrqW43WSBjgPXGlqA
RriJ5PZPekywCAq/g/VkCrj7x+cegyy3XMW0gkeNtfQ7giu4=
X-Gm-Gg: AfdE7cn3MULtH5gvp2pl8JkQOqB6YgFHaSGSlIhGaYGkCc128sBBr6n9VblcKVNAVKA
5keJWAv/NU6GzlqcL4CKmeWHrRzridD3hZUumg6BgcpxxOnetWPUZrWwE3gAdqQa338WBqZ5kh+
jFMEA1TZVZ7TqkDuHGMWvTNI+UTRdJmluqYyMPF2Q0UGbroS2CVJ01PHeraN8dhsEfGl5Qr2GlI
Pn9zeSwSFESZViOB9laILvNvMtSxwCEK6b4BBjabfwelhByeHqpOzA+RqbjCaLLPi/qj1BA4xx8
UIxJEl/VoS5kH3hHUhL/1dBuQSgZKRSWH1K539RNRb+kQzlYhdp52nDBZhkybLmga+5biUdnuh2
MgXUX/sKC5osHlcCv/iUkBE0=
X-Received: by 2002:a05:6820:60c:b0:6a3:66dd:ca10 with SMTP id 006d021491bc7-6a36da170b0mr7005eaf.53.1783464750653;
Tue, 07 Jul 2026 15:52:30 -0700 (PDT)
Received: from sabprogetti.com ([192.210.236.148])
by smtp-relay.gmail.com with ESMTPS id 586e51a60fabf-44cfb5ab52asm1591009fac.3.2026.07.07.15.52.30
for
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Tue, 07 Jul 2026 15:52:30 -0700 (PDT)
X-Relaying-Domain: sabeng.it
From: "Incoming_Payment|Schedule| Online Review/OU=EXCHANGE ADMINISTRATIVE
GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-45027"
To: doctor@nl2k.ab.ca
Subject: =?UTF-8?Q?Please_Review_the_Attached_Slip=2C_Invoi?=
=?UTF-8?Q?ce_=26_Payment_Report_=EF=BF=BD_07/07/20?=
=?UTF-8?Q?26_=EF=BF=BD_doctor=40nl2k=2Eab=2Eca?=
Message-ID:
Content-Transfer-Encoding: quoted-printable
Date: Tue, 07 Jul 2026 22:52:29 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=utf-8
X-Spam_score: 6.3
X-Spam_score_int: 63
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview:  A document has been sent for your review View Document
Please review the attached document at your convenience. Contact the sender
if you have questions.
Content analysis details: (6.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[209.85.161.102 listed in dnsbl.ahbl.org]
[209.85.161.102 listed in dnsbl.ahbl.org]
[209.85.161.102 listed in dnsbl.ahbl.org]
[209.85.161.102 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[209.85.161.102 listed in will-spam-for-food.eu.org]
[209.85.161.102 listed in will-spam-for-food.eu.org]
[209.85.161.102 listed in will-spam-for-food.eu.org]
[209.85.161.102 listed in will-spam-for-food.eu.org]
[209.85.161.102 listed in will-spam-for-food.eu.org]
[209.85.161.102 listed in will-spam-for-food.eu.org]
[209.85.161.102 listed in will-spam-for-food.eu.org]
[209.85.161.102 listed in will-spam-for-food.eu.org]
1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.161.102 listed in list.dnswl.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.161.102 listed in bl.score.senderscore.com]
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.161.102 listed in wl.mailspike.net]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 NO_RDNS2 Sending MTA has no reverse DNS
0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
Subject: {SPAM?} =?UTF-8?Q?Please_Review_the_Attached_Slip=2C_Invoi?=
=?UTF-8?Q?ce_=26_Payment_Report_=EF=BF=BD_07/07/20?=
=?UTF-8?Q?26_=EF=BF=BD_doctor=40nl2k=2Eab=2Eca?=
Docusign Phish from Google Gmail Part 3
Posted by Dave Yadallee onsrc=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/email-logo.png" width=3D"116" />
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.76.=
0/email/iconFileWithCheckWhite.png" width=3D"75" />
A document has been sent for your review
target=3D"_blank">View Document
Please review the attached document at your convenience. Contact the =
sender if you have questions.
This invitation is intended only for the recipient and contains secure =
access information.
Confidential: Do not share this email or link with =
others.
Alternative signing:
class=3D"alt-sign-link" href=3D"https://app.docusign.com/documents" =
target=3D"_blank">![3D"DocuSign"]()
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/email-logo.png" /> Access documents on =
DocuSign and use code:
padding:2px 8px; border-radius:12px; font-weight:bold; =
color:#260559;">{docu-id}
class=3D"alt-sign-link" href=3D"https://app.docusign.com/documents" =
target=3D"_blank">
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/email-logo.png" /> Access documents on =
DocuSign and use code:
padding:2px 8px; border-radius:12px; font-weight:bold; =
color:#260559;">{docu-id}
About Docusign: Sign securely and legally in minutes, =
from anywhere.
Need help? Contact the sender or visit our support page=
.
com/en/guides/Declining-to-sign-DocuSign-Signer-Guide" =
target=3D"_blank">Decline to sign |
href=3D"https://support.docusign.com/en/articles/How-do-I-manage-my-email-n=
otifications" target=3D"_blank">Manage notifications
Download the app:
.com/features-and-benefits/mobile" target=3D"_blank">
height=3D"18" src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=
0/global-assets/email-templates/icon-download-app.png" width=3D"18" />Get =
Docusign
Sent by Ashley Allen via Docusign. To unsubscribe, =
contact the sender.
This message contains =
confidential information. If you are not the intended recipient, please =
delete immediately.
Docusign Phish from Google Gmail Part 1
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 07 Jul 2026 17:44:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1whFRX-00000000EGi-0PGO
for dave@doctor.nl2k.ab.ca;
Tue, 07 Jul 2026 17:43:11 -0600
Resent-From: The Doctor
Resent-Date: Tue, 7 Jul 2026 17:43:11 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pl1-f230.google.com ([209.85.214.230]:57808)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.99.3 (FreeBSD))
(envelope-from)
id 1whEfM-00000000I4m-1NPh
for doctor@doctor.nl2k.ab.ca;
Tue, 07 Jul 2026 16:53:32 -0600
Received: by mail-pl1-f230.google.com with SMTP id d9443c01a7336-2ccdb73f0e1so695885ad.3
for; Tue, 07 Jul 2026 15:52:36 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=sabeng.it; s=google; t=1783464750; x=1784069550; darn=doctor.nl2k.ab.ca;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=EWV8XmCUvffytCAcw2TyXcQCDCinzlDmbMB2SDY4DX4=;
b=aPKQvhBmSgrZXFNrLW9rN9WPibtjSpslhVzOk2KMzJW+ofJf9/G2OO3jiCxnCjHdhq
2WCZx1+jyih5Iedp6D7CWZPw9BVFTfirRKD725kj4MBO3Xmq2Q7mdTn4iuG4Lx2kAXnV
d4XRdLNibaIr0KJvHgs4lNLVvfN3SbjXE6BRI=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1783464750; x=1784069550;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date
:message-id:reply-to:content-type;
bh=EWV8XmCUvffytCAcw2TyXcQCDCinzlDmbMB2SDY4DX4=;
b=e/RokYSR2R+VvRaUv66gq383j/fJ9n6t/lOF2qtnNDIJcxEssp/yQiT0mWHjFNKmRw
gr8823K7DqsnnGxNsMZKmu0mgvHGVtS0dfXeM6aHzr2tfCVlLVH25hFRghEqCKrXeWux
ADAqJysqyCT0xbi6yLrA1fPS43dNT+Kp/DyKL8Au9QUS0NHUGH7/MRpjZf1NJm/QLC3g
+RTrP56b4ddResVbpPoSyHXmjzm5LjaLajHR9FC9iqaBVU2UGehZqBR6WmhBdeVx606I
jcHN81f2x2SKZJl0VACNWY9wFeE8OXewFrs0tjsnx6F9runFHH0sOx/uQzZ9Vl/JGmU0
+kTg==
X-Gm-Message-State: AOJu0Yx/E9lvozW9KdqqJjowXRA5SJfSWizXqbN5fgQpoWvNB8qA1I1m
kIqXwHp3aFFKPxtejnEQFsZ/muw4BYtjy+ABD8Q9CyJNvqgL9JeNr9lP0VglXWAlnX9xLOH1uh6
1wFdgVBm5i1Rg3bWqOLwwRWBTvqgqyivGvdImQAasw3d5xCg=
X-Gm-Gg: AfdE7ck1PRdcCUO7dacEPM1K+KUSUzqxWNgFB+mRlu7Fav91BZhAw1mftrDY/3cU/10
E2dbOFDNPkCxpxar3DNCRMusIFSIZ/cL7ejhv7GPzrtOcMJowoXJtuZVkjvRXbDZtqIlQFKqDid
kkKOYIRH8fQ7AN4YX7zDVBbYSWP7sRlMAMmluEOKFvdQU268UEuCms8ro6NaLt/hqwEHWhp278y
1itWDXS7/o5q/oLTDnWsGecgYRR4sUHsXOhMjc33tNRiFrvLc0JxnT8xDbdKMezk51Hq8KGcRDm
NT37rfOskjGTWnjtioCQ+OY4UNzDi1aiaBkhGRAYch2HnVySsCsufhvEbRRJESF1dGZZQ5QQ4pX
Qx7YY1W0MWOE9qqU9toku5w==
X-Received: by 2002:a17:902:ecc8:b0:2c9:97a8:aff5 with SMTP id d9443c01a7336-2ccbf1ae62cmr59058425ad.46.1783464750120;
Tue, 07 Jul 2026 15:52:30 -0700 (PDT)
Received: from sabprogetti.com ([192.210.236.148])
by smtp-relay.gmail.com with ESMTPS id d9443c01a7336-2ccc9bdd019sm3313665ad.13.2026.07.07.15.52.29
for
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Tue, 07 Jul 2026 15:52:30 -0700 (PDT)
X-Relaying-Domain: sabeng.it
From: "Incoming_Payment | EFT Portal/OU=EXCHANGE ADMINISTRATIVE GROUP
(FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-53861"
To: doctor@doctor.nl2k.ab.ca
Subject: =?UTF-8?Q?Invoice_and_Payment_Documentation_Enclos?=
=?UTF-8?Q?ed_for_Review_=EF=BF=BD_07/07/2026_?=
=?UTF-8?Q?=EF=BF=BD_doctor=40doctor=2Enl2k=2Eab=2E?= =?UTF-8?Q?ca?=
Message-ID: <3852d459-669b-1062-0b1c-409a1c985537@sabeng.it>
Content-Transfer-Encoding: quoted-printable
Date: Tue, 07 Jul 2026 22:52:28 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=utf-8
X-Spam_score: 8.8
X-Spam_score_int: 88
X-Spam_bar: ++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview:  A document has been sent for your review View Document
Please review the attached document at your convenience. Contact the sender
if you have questions.
Content analysis details: (8.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[209.85.214.230 listed in dnsbl.ahbl.org]
[209.85.214.230 listed in dnsbl.ahbl.org]
[209.85.214.230 listed in dnsbl.ahbl.org]
[209.85.214.230 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.214.230 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 NO_RDNS2 Sending MTA has no reverse DNS
0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
Subject: {SPAM?} =?UTF-8?Q?Invoice_and_Payment_Documentation_Enclos?=
=?UTF-8?Q?ed_for_Review_=EF=BF=BD_07/07/2026_?=
=?UTF-8?Q?=EF=BF=BD_doctor=40doctor=2Enl2k=2Eab=2E?= =?UTF-8?Q?ca?=
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 07 Jul 2026 17:44:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))
(envelope-from
id 1whFRX-00000000EGi-0PGO
for dave@doctor.nl2k.ab.ca;
Tue, 07 Jul 2026 17:43:11 -0600
Resent-From: The Doctor
Resent-Date: Tue, 7 Jul 2026 17:43:11 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pl1-f230.google.com ([209.85.214.230]:57808)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.99.3 (FreeBSD))
(envelope-from
id 1whEfM-00000000I4m-1NPh
for doctor@doctor.nl2k.ab.ca;
Tue, 07 Jul 2026 16:53:32 -0600
Received: by mail-pl1-f230.google.com with SMTP id d9443c01a7336-2ccdb73f0e1so695885ad.3
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=sabeng.it; s=google; t=1783464750; x=1784069550; darn=doctor.nl2k.ab.ca;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=EWV8XmCUvffytCAcw2TyXcQCDCinzlDmbMB2SDY4DX4=;
b=aPKQvhBmSgrZXFNrLW9rN9WPibtjSpslhVzOk2KMzJW+ofJf9/G2OO3jiCxnCjHdhq
2WCZx1+jyih5Iedp6D7CWZPw9BVFTfirRKD725kj4MBO3Xmq2Q7mdTn4iuG4Lx2kAXnV
d4XRdLNibaIr0KJvHgs4lNLVvfN3SbjXE6BRI=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1783464750; x=1784069550;
h=content-type:mime-version:date:content-transfer-encoding:message-id
:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date
:message-id:reply-to:content-type;
bh=EWV8XmCUvffytCAcw2TyXcQCDCinzlDmbMB2SDY4DX4=;
b=e/RokYSR2R+VvRaUv66gq383j/fJ9n6t/lOF2qtnNDIJcxEssp/yQiT0mWHjFNKmRw
gr8823K7DqsnnGxNsMZKmu0mgvHGVtS0dfXeM6aHzr2tfCVlLVH25hFRghEqCKrXeWux
ADAqJysqyCT0xbi6yLrA1fPS43dNT+Kp/DyKL8Au9QUS0NHUGH7/MRpjZf1NJm/QLC3g
+RTrP56b4ddResVbpPoSyHXmjzm5LjaLajHR9FC9iqaBVU2UGehZqBR6WmhBdeVx606I
jcHN81f2x2SKZJl0VACNWY9wFeE8OXewFrs0tjsnx6F9runFHH0sOx/uQzZ9Vl/JGmU0
+kTg==
X-Gm-Message-State: AOJu0Yx/E9lvozW9KdqqJjowXRA5SJfSWizXqbN5fgQpoWvNB8qA1I1m
kIqXwHp3aFFKPxtejnEQFsZ/muw4BYtjy+ABD8Q9CyJNvqgL9JeNr9lP0VglXWAlnX9xLOH1uh6
1wFdgVBm5i1Rg3bWqOLwwRWBTvqgqyivGvdImQAasw3d5xCg=
X-Gm-Gg: AfdE7ck1PRdcCUO7dacEPM1K+KUSUzqxWNgFB+mRlu7Fav91BZhAw1mftrDY/3cU/10
E2dbOFDNPkCxpxar3DNCRMusIFSIZ/cL7ejhv7GPzrtOcMJowoXJtuZVkjvRXbDZtqIlQFKqDid
kkKOYIRH8fQ7AN4YX7zDVBbYSWP7sRlMAMmluEOKFvdQU268UEuCms8ro6NaLt/hqwEHWhp278y
1itWDXS7/o5q/oLTDnWsGecgYRR4sUHsXOhMjc33tNRiFrvLc0JxnT8xDbdKMezk51Hq8KGcRDm
NT37rfOskjGTWnjtioCQ+OY4UNzDi1aiaBkhGRAYch2HnVySsCsufhvEbRRJESF1dGZZQ5QQ4pX
Qx7YY1W0MWOE9qqU9toku5w==
X-Received: by 2002:a17:902:ecc8:b0:2c9:97a8:aff5 with SMTP id d9443c01a7336-2ccbf1ae62cmr59058425ad.46.1783464750120;
Tue, 07 Jul 2026 15:52:30 -0700 (PDT)
Received: from sabprogetti.com ([192.210.236.148])
by smtp-relay.gmail.com with ESMTPS id d9443c01a7336-2ccc9bdd019sm3313665ad.13.2026.07.07.15.52.29
for
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Tue, 07 Jul 2026 15:52:30 -0700 (PDT)
X-Relaying-Domain: sabeng.it
From: "Incoming_Payment | EFT Portal/OU=EXCHANGE ADMINISTRATIVE GROUP
(FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-53861"
To: doctor@doctor.nl2k.ab.ca
Subject: =?UTF-8?Q?Invoice_and_Payment_Documentation_Enclos?=
=?UTF-8?Q?ed_for_Review_=EF=BF=BD_07/07/2026_?=
=?UTF-8?Q?=EF=BF=BD_doctor=40doctor=2Enl2k=2Eab=2E?= =?UTF-8?Q?ca?=
Message-ID: <3852d459-669b-1062-0b1c-409a1c985537@sabeng.it>
Content-Transfer-Encoding: quoted-printable
Date: Tue, 07 Jul 2026 22:52:28 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=utf-8
X-Spam_score: 8.8
X-Spam_score_int: 88
X-Spam_bar: ++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview:  A document has been sent for your review View Document
Please review the attached document at your convenience. Contact the sender
if you have questions.
Content analysis details: (8.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[192.210.236.148 listed in dnsbl.ahbl.org]
[209.85.214.230 listed in dnsbl.ahbl.org]
[209.85.214.230 listed in dnsbl.ahbl.org]
[209.85.214.230 listed in dnsbl.ahbl.org]
[209.85.214.230 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[192.210.236.148 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[192.210.236.148 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
[209.85.214.230 listed in will-spam-for-food.eu.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.214.230 listed in list.dnswl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 NO_RDNS2 Sending MTA has no reverse DNS
0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
Subject: {SPAM?} =?UTF-8?Q?Invoice_and_Payment_Documentation_Enclos?=
=?UTF-8?Q?ed_for_Review_=EF=BF=BD_07/07/2026_?=
=?UTF-8?Q?=EF=BF=BD_doctor=40doctor=2Enl2k=2Eab=2E?= =?UTF-8?Q?ca?=