Docusign phish from Google Gmail part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 Jul 2026 14:15:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whv8V-000000000n1-1unK

for dave@doctor.nl2k.ab.ca;

Thu, 09 Jul 2026 14:14:19 -0600

Resent-From: The Doctor

Resent-Date: Thu, 9 Jul 2026 14:14:19 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qv1-f104.google.com ([209.85.219.104]:46166)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whuyp-00000000KZ8-45C8

for root@nl2k.ab.ca;

Thu, 09 Jul 2026 14:04:29 -0600

Received: by mail-qv1-f104.google.com with SMTP id 6a1803df08f44-8f0d6853360so2605506d6.0

for ; Thu, 09 Jul 2026 13:03:32 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1783627406; x=1784232206; darn=nl2k.ab.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=CBCnKi6yFedusYVAYEog8Pbq6nVfckjxBILUJZflDog=;

b=UJBmP9bjf1fxV94IBKqeiCLjKXWwdtfj+SBMT4sfuGx1JoteDw9AF7Z4lJ37QT1Jk/

3yJpzpJ7YleH5b4bU+G5R67cY+64aqJy5CvD7I73AcL8vwpizL51ruGQFswrXOLNLzYt

OBnYZw+8xYhVvt/czXSjiwlwM+yea8y8Kof3s=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783627406; x=1784232206;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=CBCnKi6yFedusYVAYEog8Pbq6nVfckjxBILUJZflDog=;

b=W8y1L4QW04OiGrvp7+lSDbDIWak6ORjboQNbQK3zv5QFAFFHl8RpjjcQPTy7CmVnga

fbmNme0Ht7fPyJKa8EuJM5lDnfyutWeQOuyBCcxV6TOaLPLQLSm5aFBdCZgcOXSyyR3e

32FIdM5Q2gx7Lqo+zkghFw0hsXMgQPpLPblzSCv8HfAnJC15e5U37/vW875aLptK5z3k

cPBS7kPE7xuFnsGvRCLl5xjcpRX6L5RXf1tXlGjM/hKR8B1SrEagiCtvNy4oaLD+l8xe

62fdnVMyqk0DjMZRHS/0y/QgnK3JmST9l67mEPgn42QRduulh7tqStBClWEy01IbKQXs

T3hA==

X-Gm-Message-State: AOJu0YwhQ/X4zfZ/5EyGCtgPWoNxcyMmg94jh3Nngbawsa5Cwmf8+gmN

Q5haeU2Fqj5MKsnL68MqJs0eE2vFjVbcyjIv8Edzz7FNaCJ6L+Y/5VhyBi0EXTN6XlxjWYpfpAL

dPEfyF5DRhqRTTDIcyglONJEtA+Bo9O5k4oeP9DnFWsPJGS8=

X-Gm-Gg: AfdE7cmu8bgJSskNzTkq+95KV2Rm7pa1kbJMKBdxetoSIPfpZLOFTnBfdQ6Xkf4iHaO

aZFTnx/cihtDv57w1SNzVDFIfbvMc0Ko7enULVWmI3XUJQV9xAdeQ9aspDAUL0UFqKghWCUwHZx

ICOKM+JQ3sjkkVEivErHOcqVZqQY8i01OAzGwNGJZ24YP19UWzRYeoBsGRuIX/37R7VeoEyrjF7

kZXAAQha+jpyzP6KulGnq6tXzQTrzBys9yr/6CEvYyzI3MY6d0gWF31AulfdoinEEnzhQ7xsAat

s/1eHVAm+1eYxzj25wA3kRWDs5X5ZiMB8cAURqYLQa1FEVFDCIMW2H9dunQt9ng8f/SIyskOpgC

Z0ViL6HgYXz8uJqjGQn51AQ==

X-Received: by 2002:a05:6214:2347:b0:8f1:4bff:3a55 with SMTP id 6a1803df08f44-8fec693a73bmr91116096d6.38.1783627405634;

Thu, 09 Jul 2026 13:03:25 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id 6a1803df08f44-8ffd9751461sm1877466d6.26.2026.07.09.13.03.25

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Thu, 09 Jul 2026 13:03:25 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "Incoming_Remittance| Scheduled | Online/OU=EXCHANGE ADMINISTRATIVE

GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-49098"



To: root@nl2k.ab.ca

Subject: =?UTF-8?Q?Please_Review_the_Attached_Slip=2C_Invoi?=

=?UTF-8?Q?ce_=26_Payment_Report_=EF=BF=BD_07/09/20?=

=?UTF-8?Q?26_=EF=BF=BD_root=40nl2k=2Eab=2Eca?=

Message-ID: <4bd9ba81-66f8-369f-01fe-5b1fb4e6c450@sabeng.it>

Content-Transfer-Encoding: quoted-printable

Date: Thu, 09 Jul 2026 20:03:24 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 6.1

X-Spam_score_int: 61

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  A document has been sent for your review View Document

Please review the attached document at your convenience. Contact the sender

if you have questions.



Content analysis details: (6.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.219.104 listed in dnsbl.ahbl.org]

[209.85.219.104 listed in dnsbl.ahbl.org]

[209.85.219.104 listed in dnsbl.ahbl.org]

[209.85.219.104 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.219.104 listed in will-spam-for-food.eu.org]

[209.85.219.104 listed in will-spam-for-food.eu.org]

[209.85.219.104 listed in will-spam-for-food.eu.org]

[209.85.219.104 listed in will-spam-for-food.eu.org]

[209.85.219.104 listed in will-spam-for-food.eu.org]

[209.85.219.104 listed in will-spam-for-food.eu.org]

[209.85.219.104 listed in will-spam-for-food.eu.org]

[209.85.219.104 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.219.104 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.219.104 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.219.104 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} =?UTF-8?Q?Please_Review_the_Attached_Slip=2C_Invoi?=

=?UTF-8?Q?ce_=26_Payment_Report_=EF=BF=BD_07/09/20?=

=?UTF-8?Q?26_=EF=BF=BD_root=40nl2k=2Eab=2Eca?=

Docusign phish from Google Gmail Part 3

Posted by Dave Yadallee on








3D"Logo"
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/email-logo.png" width=3D"116" />






3D""
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.76.=

0/email/iconFileWithCheckWhite.png" width=3D"75" />

A document has been sent for your review



target=3D"_blank">View Document








Please review the attached document at your convenience. Contact the =

sender if you have questions.





This invitation is intended only for the recipient and contains secure =

access information.











Confidential: Do not share this email or link with =

others.





Alternative signing:
class=3D"alt-sign-link" href=3D"https://app.docusign.com/documents" =

target=3D"_blank"> 3D"DocuSign"
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/email-logo.png" /> Access documents on =

DocuSign and use code:
padding:2px 8px; border-radius:12px; font-weight:bold; =

color:#260559;">{docu-id}




About Docusign: Sign securely and legally in minutes, =

from anywhere.





Need help? Contact the sender or visit our support page=

.






com/en/guides/Declining-to-sign-DocuSign-Signer-Guide" =

target=3D"_blank">Decline to sign |
href=3D"https://support.docusign.com/en/articles/How-do-I-manage-my-email-n=

otifications" target=3D"_blank">Manage notifications




Download the app:
.com/features-and-benefits/mobile" target=3D"_blank"> 3D""
height=3D"18" src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/icon-download-app.png" width=3D"18" />Get =

Docusign





Sent by Ashley Allen via Docusign. To unsubscribe, =

contact the sender.





This message contains =

confidential information. If you are not the intended recipient, please =

delete immediately.











Docusign phish from Google Gmail Part 2

Posted by Dave Yadallee on


=EF=BB=BF


name=3D"viewport" />

Docusign phish from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 Jul 2026 14:15:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whv8K-000000000gs-19VX

for dave@doctor.nl2k.ab.ca;

Thu, 09 Jul 2026 14:14:08 -0600

Resent-From: The Doctor

Resent-Date: Thu, 9 Jul 2026 14:14:08 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f230.google.com ([209.85.214.230]:60445)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whuyo-00000000KZ5-0pB2

for root@doctor.nl2k.ab.ca;

Thu, 09 Jul 2026 14:04:26 -0600

Received: by mail-pl1-f230.google.com with SMTP id d9443c01a7336-2cc6ae3e7f1so1003195ad.0

for ; Thu, 09 Jul 2026 13:03:30 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1783627405; x=1784232205; darn=doctor.nl2k.ab.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=CBCnKi6yFedusYVAYEog8Pbq6nVfckjxBILUJZflDog=;

b=eRB0wWCSh64UnIwLYI8rcKDor2K0NP/3FkYYZpGeSk3+2fep+SgGL1zJzN11bzYc87

Paa8v+bbl6WVzCBwiVJkkVYzrZilztOtRr6D5qhlMKvOLkgh3Z69lV7iw6kHrrNR/yO6

AUR/Fyol8criz5PcDxM93PsgVLOscipoAtLOs=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783627405; x=1784232205;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=CBCnKi6yFedusYVAYEog8Pbq6nVfckjxBILUJZflDog=;

b=bv/pOpeMQY4K/sb10DCLzjcjQ7Z4+72yZkFzaiPZh7h74fEdXn28hOvdw1L5pi3QpV

AEPt1kNTjrPiLZ81npb0JM/d3BeLmsVtPfzz2IADk51hV+ytsVy0O+2iMTvKxIOq1kNE

5KumrkFBQ2ZJXvrFEwojS42VM1z0dimGowV4c0uWLU4GTfrEtQug/gbjd/2jbLL83l4/

nVryJyqhxomHWIds3qhucZduv+iLT+c7br1lKA/FIODlmQRcIvGV4xVDv1Gx+BTDNsSz

xRbWLNOMSZnBwhuuEJsigahB83hdTpFFhJ3D3BcaCiOPN2ox6P9PSqj/hdgr198iOzTW

HzqA==

X-Gm-Message-State: AOJu0Yym0VFrbShg0a3FhaBoLFya7TPRmSV9vBjCgeRj5G3tFZp56ECJ

tlT5QH2UwTPYFWSuBwrQGLrBKsQxyg7x9keq6tOJkI9lysaVlLwjnpqbu/HUcTh9SH3y0SoiOtk

6nxrbZNhmHu9s8KCnQcGVjAkEWknIiPTPnfkr3cVJwrzdI8g=

X-Gm-Gg: AfdE7cnOV+mNp3ofmvfOsxTExfMZaT0tGLP8/hGOLyc9p/vp56MQDwOUyaj0ITocXB2

3p6LpfMlIQrKcKT8Vkh0YDOJsYOtSZH1WGJN7DSegU+slMe0ghhDKLVKYlpyqss4l4NlSYsNbiD

swu1fwCZoRXbFwQR/pihTzak43sEVR9R6LzWTp9NOiHAN+n2hbp6OFbCmEheTR6MyqKPO5dvrQ/

i/yeJJ7z+EWzvRMhgOQPHY9Dyq3DrHr+JLvJnVGx0GmaVw1zqU6dL3BR1pn4+RumDx5dfjAtF8+

nS3rYeMwW9hTyrlZRJmKH2e09t45l5/WKwZWZoX8U5bINGaHc3p8p8QFxdMiPcLhdz5fXnTzZdS

EDi5ZDuSdoolfNzeAwBueOg==

X-Received: by 2002:a17:903:380e:b0:2c9:c083:cd50 with SMTP id d9443c01a7336-2ccea36d9demr85676775ad.17.1783627405065;

Thu, 09 Jul 2026 13:03:25 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id d9443c01a7336-2ccc9bdce31sm8599645ad.12.2026.07.09.13.03.24

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Thu, 09 Jul 2026 13:03:25 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "Incoming_Payment|Schedule| Online Review/OU=EXCHANGE ADMINISTRATIVE

GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-00620"



To: root@doctor.nl2k.ab.ca

Subject: =?UTF-8?Q?Review_Requested=3A_PO=2C_Invoice_=26_Pa?=

=?UTF-8?Q?yment_Details_=EF=BF=BD_07/09/2026_?=

=?UTF-8?Q?=EF=BF=BD_root=40doctor=2Enl2k=2Eab=2Eca?=

Message-ID: <28b24c40-97dd-9e5c-4110-1325bb983169@sabeng.it>

Content-Transfer-Encoding: quoted-printable

Date: Thu, 09 Jul 2026 20:03:23 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 6.3

X-Spam_score_int: 63

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  A document has been sent for your review View Document

Please review the attached document at your convenience. Contact the sender

if you have questions.



Content analysis details: (6.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.214.230 listed in dnsbl.ahbl.org]

[209.85.214.230 listed in dnsbl.ahbl.org]

[209.85.214.230 listed in dnsbl.ahbl.org]

[209.85.214.230 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.214.230 listed in list.dnswl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.214.230 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.214.230 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

Subject: {SPAM?} =?UTF-8?Q?Review_Requested=3A_PO=2C_Invoice_=26_Pa?=

=?UTF-8?Q?yment_Details_=EF=BF=BD_07/09/2026_?=

=?UTF-8?Q?=EF=BF=BD_root=40doctor=2Enl2k=2Eab=2Eca?=

Docusign phish from Google Gmail Part 2

Posted by Dave Yadallee on




=EF=BB=BF


name=3D"viewport" />

Docusign phish from Google Gmail Part 3

Posted by Dave Yadallee on








3D"Logo"
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/email-logo.png" width=3D"116" />






3D""
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.76.=

0/email/iconFileWithCheckWhite.png" width=3D"75" />

A document has been sent for your review



target=3D"_blank">View Document








Please review the attached document at your convenience. Contact the =

sender if you have questions.





This invitation is intended only for the recipient and contains secure =

access information.











Confidential: Do not share this email or link with =

others.





Alternative signing:
class=3D"alt-sign-link" href=3D"https://app.docusign.com/documents" =

target=3D"_blank"> 3D"DocuSign"
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/email-logo.png" /> Access documents on =

DocuSign and use code:
padding:2px 8px; border-radius:12px; font-weight:bold; =

color:#260559;">{docu-id}




About Docusign: Sign securely and legally in minutes, =

from anywhere.





Need help? Contact the sender or visit our support page=

.






com/en/guides/Declining-to-sign-DocuSign-Signer-Guide" =

target=3D"_blank">Decline to sign |
href=3D"https://support.docusign.com/en/articles/How-do-I-manage-my-email-n=

otifications" target=3D"_blank">Manage notifications




Download the app:
.com/features-and-benefits/mobile" target=3D"_blank"> 3D""
height=3D"18" src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/icon-download-app.png" width=3D"18" />Get =

Docusign





Sent by Ashley Allen via Docusign. To unsubscribe, =

contact the sender.





This message contains =

confidential information. If you are not the intended recipient, please =

delete immediately.











Docusign phish from Google Gmail Part 3

Posted by Dave Yadallee on








3D"Logo"
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/email-logo.png" width=3D"116" />






3D""
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.76.=

0/email/iconFileWithCheckWhite.png" width=3D"75" />

A document has been sent for your review



target=3D"_blank">View Document








Please review the attached document at your convenience. Contact the =

sender if you have questions.





This invitation is intended only for the recipient and contains secure =

access information.











Confidential: Do not share this email or link with =

others.





Alternative signing:
class=3D"alt-sign-link" href=3D"https://app.docusign.com/documents" =

target=3D"_blank"> 3D"DocuSign"
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/email-logo.png" /> Access documents on =

DocuSign and use code:
padding:2px 8px; border-radius:12px; font-weight:bold; =

color:#260559;">{docu-id}




About Docusign: Sign securely and legally in minutes, =

from anywhere.





Need help? Contact the sender or visit our support page=

.






com/en/guides/Declining-to-sign-DocuSign-Signer-Guide" =

target=3D"_blank">Decline to sign |
href=3D"https://support.docusign.com/en/articles/How-do-I-manage-my-email-n=

otifications" target=3D"_blank">Manage notifications




Download the app:
.com/features-and-benefits/mobile" target=3D"_blank"> 3D""
height=3D"18" src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/icon-download-app.png" width=3D"18" />Get =

Docusign





Sent by Ashley Allen via Docusign. To unsubscribe, =

contact the sender.





This message contains =

confidential information. If you are not the intended recipient, please =

delete immediately.











Docusign phish from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 Jul 2026 14:14:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whv7s-00000000OoX-4528

for dave@doctor.nl2k.ab.ca;

Thu, 09 Jul 2026 14:13:40 -0600

Resent-From: The Doctor

Resent-Date: Thu, 9 Jul 2026 14:13:40 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f230.google.com ([209.85.214.230]:54608)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whtn8-00000000H99-0hRi

for postmaster@nl2k.ab.ca;

Thu, 09 Jul 2026 12:48:17 -0600

Received: by mail-pl1-f230.google.com with SMTP id d9443c01a7336-2cc7ef7ec27so799415ad.1

for ; Thu, 09 Jul 2026 11:47:23 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1783622837; x=1784227637; darn=nl2k.ab.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=CBCnKi6yFedusYVAYEog8Pbq6nVfckjxBILUJZflDog=;

b=H1a0eySlGr7WdYH+fNeYtQw0Tgs6mR2h7MOm+uUbwB8DctXeXKVb3Qdj67T9kIfpkM

O2IpttQ+lyx6Wxr8Ts8oQzoi4e3eCEBCBWhZIxGivEJseUtU1uafQ1SXVBgqcXwwoIxn

Yqw1g6IjjueuVesTYkzAmAoaVyCd8cOH/d4Uk=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783622837; x=1784227637;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=CBCnKi6yFedusYVAYEog8Pbq6nVfckjxBILUJZflDog=;

b=XwHsVSfOUukLE2PmctCwELCS5e+ApHsbN5QuEC2U5tM7hp6CV/ozg2RnygC39Hoht0

t7+QdPMnUJhkQFe/N1YypWUr4GtvjL/ssBgcC8tmwkTuiu2TWohN7vlyG5gIbYVrRw+T

kfxkwC2Y7v7uEK3oKOBHzapVhyyIh5boDaKXeX3MgLrreqE7RNycMQDn41LX3yjQQ3mH

pEHT/Vqu28SlBSIWxWeCNr4Kbr5JnhP5qQw/ZabmgJ5ZCRAgNeo1Th0Vmc2eQJ5wpmrv

zw7VGwP52M+pOMgSCV97KGQSV6IDknNUoCx3eOEz3t9HHTedmXDw/tO8RvmHY/8Yo93D

FBHA==

X-Gm-Message-State: AOJu0Yw7jtwscfiT67oE5zcgtpMng7YVTvukfAoqJhbxBU61X1k3AwLR

0VkQyp/A10+sopqgRQrnMF/vVJ0PAd4wvZxjoihutrI2/R2jziETIHLE70lx6UwZQ6yQgW3InGj

o6s304oJr4eqP5OqanXE0piOXhVMT2hd5dqjWaEOmzEk74is=

X-Gm-Gg: AfdE7cnCrmJdT1SJgKwB35df06SuZ790j9iem+4ZPLSHNj2eRVg7XzcHfE6qu59WzKo

MMFUwW7xzhYLh3Jk9+Rs1zUP3Fhqhg9kMdLsXcFv7TAWgwxnZJ4q97AlWx41PfyqnHIS771Q/nj

u2KnyDPG2CvRuykn82ZcT0DGAM+yPphWHfM77+zzYy0/JHTgn4JFKubNXPla7XvjC/YsUccghyM

EFxILhpdh4lo4vGPFWGpLS31yZBo5f4jOIMt+0orGfbp0aITMez7aFu/+WiLpfA5IObhI3evd93

Gtm+5Rm6DyQeDwwcr4qHTUxjuED1qzEa7KeB6fmackcyRUzT2PhhXKzKA8zpAn4NL1+h0nZjRc2

NwtaoRtmlPgqWbGvS98ShDlVW

X-Received: by 2002:a17:902:fdad:b0:2cc:8ad3:423d with SMTP id d9443c01a7336-2ccea42e977mr95823245ad.29.1783622837329;

Thu, 09 Jul 2026 11:47:17 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id d9443c01a7336-2ccc9bde021sm8640605ad.20.2026.07.09.11.47.17

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Thu, 09 Jul 2026 11:47:17 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "Incoming_Payment|Schedule| Online Review/OU=EXCHANGE ADMINISTRATIVE

GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-95194"



To: postmaster@nl2k.ab.ca

Subject: =?UTF-8?Q?Request_for_Review=3A_Sortcode=2C_Invoic?=

=?UTF-8?Q?e_=26_Payment_Report_=EF=BF=BD_07/09/202?=

=?UTF-8?Q?6_=EF=BF=BD_postmaster=40nl2k=2Eab=2Eca?=

Message-ID:

Content-Transfer-Encoding: quoted-printable

Date: Thu, 09 Jul 2026 18:47:15 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 6.3

X-Spam_score_int: 63

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  A document has been sent for your review View Document

Please review the attached document at your convenience. Contact the sender

if you have questions.



Content analysis details: (6.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.214.230 listed in dnsbl.ahbl.org]

[209.85.214.230 listed in dnsbl.ahbl.org]

[209.85.214.230 listed in dnsbl.ahbl.org]

[209.85.214.230 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.214.230 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.214.230 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.214.230 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} =?UTF-8?Q?Request_for_Review=3A_Sortcode=2C_Invoic?=

=?UTF-8?Q?e_=26_Payment_Report_=EF=BF=BD_07/09/202?=

=?UTF-8?Q?6_=EF=BF=BD_postmaster=40nl2k=2Eab=2Eca?=

Docusign phish from Google Gmail Part 2

Posted by Dave Yadallee on




=EF=BB=BF


name=3D"viewport" />

Docusign phish from Google Gmail Part 3

Posted by Dave Yadallee on








3D"Logo"
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/email-logo.png" width=3D"116" />






3D""
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.76.=

0/email/iconFileWithCheckWhite.png" width=3D"75" />

A document has been sent for your review



target=3D"_blank">View Document








Please review the attached document at your convenience. Contact the =

sender if you have questions.





This invitation is intended only for the recipient and contains secure =

access information.











Confidential: Do not share this email or link with =

others.





Alternative signing:
class=3D"alt-sign-link" href=3D"https://app.docusign.com/documents" =

target=3D"_blank"> 3D"DocuSign"
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/email-logo.png" /> Access documents on =

DocuSign and use code:
padding:2px 8px; border-radius:12px; font-weight:bold; =

color:#260559;">{docu-id}




About Docusign: Sign securely and legally in minutes, =

from anywhere.





Need help? Contact the sender or visit our support page=

.






com/en/guides/Declining-to-sign-DocuSign-Signer-Guide" =

target=3D"_blank">Decline to sign |
href=3D"https://support.docusign.com/en/articles/How-do-I-manage-my-email-n=

otifications" target=3D"_blank">Manage notifications




Download the app:
.com/features-and-benefits/mobile" target=3D"_blank"> 3D""
height=3D"18" src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/icon-download-app.png" width=3D"18" />Get =

Docusign





Sent by Ashley Allen via Docusign. To unsubscribe, =

contact the sender.





This message contains =

confidential information. If you are not the intended recipient, please =

delete immediately.











Docusign phish from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 Jul 2026 14:14:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whv7m-00000000O43-48Ae

for dave@doctor.nl2k.ab.ca;

Thu, 09 Jul 2026 14:13:34 -0600

Resent-From: The Doctor

Resent-Date: Thu, 9 Jul 2026 14:13:34 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f104.google.com ([209.85.161.104]:48431)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whtYd-00000000GUp-1jiP

for usenet@nl2k.ab.ca;

Thu, 09 Jul 2026 12:33:20 -0600

Received: by mail-oo1-f104.google.com with SMTP id 006d021491bc7-6a31b9a492aso146528eaf.1

for ; Thu, 09 Jul 2026 11:32:22 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1783621936; x=1784226736; darn=nl2k.ab.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=CBCnKi6yFedusYVAYEog8Pbq6nVfckjxBILUJZflDog=;

b=bMTwxVtMG7SJovEQzEkuUeEqbYAEC3Z/9n/GFoBmja7FGQul0Pmmd0MFHOm+ed+9Ue

FCAT5z4mivvQkry0vex7WNpxjM+vR16fJJM1J2FDzAo/isXL97nemwJ8q6/bLvOpFbon

WGgJKpGlnyJi5Ib7Q01fHd4BEPwFcuxjxs4BY=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783621936; x=1784226736;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=CBCnKi6yFedusYVAYEog8Pbq6nVfckjxBILUJZflDog=;

b=FeilZQBIEjKTnDUA+uVfquM4YpNgd7+k4xBvTks6L8LZUSSJK3I3JXquPFg5pcshDv

uk5HOo83C4hAUHQCQIErQXw2PPLt8nJnbwtdluAMqMd1gZMeA3oxPsM054vHddiC68cB

6JTdTO7nyBofQGTOqH4+PyH9Qv08wgIxV8wAmHLxvQAOVNl3f3A/FQZmk0X2n9BQrRyi

hjdKJKeGa6eBADGa9ZCD+qeDUSd+hEDIqYklR8XGYeLwYXafNs+gjVwDQ08kR2PAQXb5

DdeTTD0ZFYenRa4a3FbG5dFhS6iA4Dl/ggNQUwjeXotFzUF7G9E1DSHx2+3eLs0AGZjf

3+fg==

X-Gm-Message-State: AOJu0Yyx7G2x3Tlyqd0cgIcIhhufbqAngG75+5zUS3pql8Y6VgtMFlzK

xHBDytyWzUHT74B6bYjeHas7IfLfvOcYTC+q6su/DF9dw3JZ/97l4Wv2sCf40iBvrp9EthQYvGM

N8r+0EL/4V9qmuVZE1x7vK2xf/kodWLv6InIT562snhSMXz4=

X-Gm-Gg: AfdE7ckw7Cxsfl+1sAqZLRiE9HfjM+O+Tzqurn0TBoWooljEFQoD3QRwhTQFH/c+a1D

6y/CYqtSC044erBpUeztIhULRcYTj19z9ylBk069F4RLlMINZCfSeHw0prrZDA+d1q8nymGhD4C

F+8IQfpsrSPwGZe/vsjDcduVvicBwGLDjycWv9LQ0VdRaNYUTVSL30Q/cBefJMm6LeJBkxJ50mE

LULUpOsKCJmzBFBRGWqjtU7Kjmk4fIfYA2hODsmmGPEQLRnmsMHIqq5uSttnRBKRx9U5Yx5fwUG

jkeNK1lbwP8bwjW0SyrUsXfnYVbKnMwLlrzKksAyxrzUMjbcLCHwm9ZukGi+8239SQj0cbMy63g

gDljoRRtDKkD7bzUdAiNHGg==

X-Received: by 2002:a05:6820:16ab:b0:69d:6bfd:5a3f with SMTP id 006d021491bc7-6a36da8c1femr6534304eaf.51.1783621935951;

Thu, 09 Jul 2026 11:32:15 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id 006d021491bc7-6a382c807dasm107981eaf.13.2026.07.09.11.32.15

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Thu, 09 Jul 2026 11:32:15 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "Incoming_Payment|Schedule| Online Review/OU=EXCHANGE ADMINISTRATIVE

GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-39528"



To: usenet@nl2k.ab.ca

Subject: =?UTF-8?Q?Request_for_Review=3A_Sortcode=2C_Invoic?=

=?UTF-8?Q?e_=26_Payment_Report_=EF=BF=BD_07/09/202?=

=?UTF-8?Q?6_=EF=BF=BD_usenet=40nl2k=2Eab=2Eca?=

Message-ID: <82c443b8-87f4-20be-e072-794f366b67d1@sabeng.it>

Content-Transfer-Encoding: quoted-printable

Date: Thu, 09 Jul 2026 18:32:14 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 6.3

X-Spam_score_int: 63

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  A document has been sent for your review View Document

Please review the attached document at your convenience. Contact the sender

if you have questions.



Content analysis details: (6.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.161.104 listed in dnsbl.ahbl.org]

[209.85.161.104 listed in dnsbl.ahbl.org]

[209.85.161.104 listed in dnsbl.ahbl.org]

[209.85.161.104 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.161.104 listed in will-spam-for-food.eu.org]

[209.85.161.104 listed in will-spam-for-food.eu.org]

[209.85.161.104 listed in will-spam-for-food.eu.org]

[209.85.161.104 listed in will-spam-for-food.eu.org]

[209.85.161.104 listed in will-spam-for-food.eu.org]

[209.85.161.104 listed in will-spam-for-food.eu.org]

[209.85.161.104 listed in will-spam-for-food.eu.org]

[209.85.161.104 listed in will-spam-for-food.eu.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.161.104 listed in list.dnswl.org]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.161.104 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.161.104 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

Subject: {SPAM?} =?UTF-8?Q?Request_for_Review=3A_Sortcode=2C_Invoic?=

=?UTF-8?Q?e_=26_Payment_Report_=EF=BF=BD_07/09/202?=

=?UTF-8?Q?6_=EF=BF=BD_usenet=40nl2k=2Eab=2Eca?=

Docusign phish from Google Gmail Part 3

Posted by Dave Yadallee on








3D"Logo"
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/email-logo.png" width=3D"116" />






3D""
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.76.=

0/email/iconFileWithCheckWhite.png" width=3D"75" />

A document has been sent for your review



target=3D"_blank">View Document








Please review the attached document at your convenience. Contact the =

sender if you have questions.





This invitation is intended only for the recipient and contains secure =

access information.











Confidential: Do not share this email or link with =

others.





Alternative signing:
class=3D"alt-sign-link" href=3D"https://app.docusign.com/documents" =

target=3D"_blank"> 3D"DocuSign"
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/email-logo.png" /> Access documents on =

DocuSign and use code:
padding:2px 8px; border-radius:12px; font-weight:bold; =

color:#260559;">{docu-id}




About Docusign: Sign securely and legally in minutes, =

from anywhere.





Need help? Contact the sender or visit our support page=

.






com/en/guides/Declining-to-sign-DocuSign-Signer-Guide" =

target=3D"_blank">Decline to sign |
href=3D"https://support.docusign.com/en/articles/How-do-I-manage-my-email-n=

otifications" target=3D"_blank">Manage notifications




Download the app:
.com/features-and-benefits/mobile" target=3D"_blank"> 3D""
height=3D"18" src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/icon-download-app.png" width=3D"18" />Get =

Docusign





Sent by Ashley Allen via Docusign. To unsubscribe, =

contact the sender.





This message contains =

confidential information. If you are not the intended recipient, please =

delete immediately.











Docusign phish from Google Gmail Part 2

Posted by Dave Yadallee on




=EF=BB=BF


name=3D"viewport" />

Docusign phish from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 Jul 2026 14:12:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whv61-00000000Lss-0U65

for dave@doctor.nl2k.ab.ca;

Thu, 09 Jul 2026 14:11:45 -0600

Resent-From: The Doctor

Resent-Date: Thu, 9 Jul 2026 14:11:45 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oa1-f102.google.com ([209.85.160.102]:53473)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whsUL-00000000CFE-0oC2

for support@nk.ca;

Thu, 09 Jul 2026 11:24:53 -0600

Received: by mail-oa1-f102.google.com with SMTP id 586e51a60fabf-448b89f700fso1095661fac.2

for ; Thu, 09 Jul 2026 10:23:54 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1783617828; x=1784222628; darn=nk.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=CBCnKi6yFedusYVAYEog8Pbq6nVfckjxBILUJZflDog=;

b=CZlrJaStO4BWs5V0y+HgT4rlO9RG2ao7w6HwSiU/CErCl0q2B8mXsJOn+5C0mnyeYJ

ryxfcvtchzPdbF88NhwdO0dbRRJnmLIoK9Q+4N+mDeid7KD5X57Zq3M4v4n2ryafr8ls

Y/AfHJpALo+1XEwQ6yG+skgMrwKAY+XMMZv1Q=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783617828; x=1784222628;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=CBCnKi6yFedusYVAYEog8Pbq6nVfckjxBILUJZflDog=;

b=MnCaYFolcC9WGpCZuAXF4N9RZPuKKgfD3vRHig8BFZ9nujTQsNP++TMoAe5ZoqOrsQ

sucHAL5btzdoQ9bZymxV787pcXeQ+GG7VxDUfJQ+r9bVjJR6PK+FaR3H+wsgR4qVnuoi

dQJEwLD3tRCDMqZLKA4w5DWBWGs6dy2YcAF3LeDS+uf2cOuNGOuOwzP77E9pSgrUsFQF

4WR4tJEZHfhu/CGehn77bC8RGqTNwjYRikmSbDB464j6S6p4aRqq8Ff5kEFK2NyrFcK0

5phnPttm11Nazog+cRNVVQF1RFrQDbHLJtHJzjK2VyLorAQ3Si13rSPjB4xwT5TP3bJ0

R6+A==

X-Gm-Message-State: AOJu0YyVrvBeAyzmNZANNrkbsOZblL0rqMUf+JbMDhafOOxGGSHtTW3q

EKlTljGCrllxVEARqwXRBGteGP+oKqUmYfDLn2A6S7F+b+hzg4jqTf8JSfXj7qlJh2C1ylj08F3

8w12kIyWqFD4zxtDt0ZuxSCZDMtYrteuWAfW+yBMyzsZitqM=

X-Gm-Gg: AfdE7cmSWaPC4COvimD4+PouFKnk56IKuDYZWFl0G6dqGWslusVMLY9lLL0rd0zrfkE

oWhxwjHZiFdLhDOs2XtHsET46JgzZa8CtJ/70i9YqJew+cHFIpKM/oGpN7q/dd9nR1WMTCPacA/

6dQI1U2wyk+D/meW34OSxAB+ttkiud8HkLUpnaXw78vR9ow17dI9RCtAIvKMPJnT+jb8YuG4ob6

hfHl0vlZLIuYfHihHRWYI5oBJxBVERkOXLNwDxv8q3k8RrtiWJ4/3dZeVHr8mvyokXU3MOdB5CR

InG5dKNwONLV//kwpLIGOQKfqwkS2oSYGqUKQmwMu7budRDAu2EF2GcaG9EnnYfpQ+Oy1bm4pF2

ENxl+ErU3ZSPuUzeq5A==

X-Received: by 2002:a05:6870:231a:b0:440:67b1:b59b with SMTP id 586e51a60fabf-45162e399c1mr5318395fac.0.1783617828058;

Thu, 09 Jul 2026 10:23:48 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id 586e51a60fabf-451913f8914sm285696fac.8.2026.07.09.10.23.47

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Thu, 09 Jul 2026 10:23:48 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "Incoming_Payment|Schedule| Online Review/OU=EXCHANGE ADMINISTRATIVE

GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-61941"



To: support@nk.ca

Subject: =?UTF-8?Q?Attached_Financial_and_Swift_Documentati?=

=?UTF-8?Q?on_=EF=BF=BD_07/09/2026_=EF=BF=BD_suppor?=

=?UTF-8?Q?t=40nk=2Eca?=

Message-ID: <67d83905-a343-4b1f-6fa8-c016c48097a5@sabeng.it>

Content-Transfer-Encoding: quoted-printable

Date: Thu, 09 Jul 2026 17:23:46 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 6.3

X-Spam_score_int: 63

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  A document has been sent for your review View Document

Please review the attached document at your convenience. Contact the sender

if you have questions.



Content analysis details: (6.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.160.102 listed in dnsbl.ahbl.org]

[209.85.160.102 listed in dnsbl.ahbl.org]

[209.85.160.102 listed in dnsbl.ahbl.org]

[209.85.160.102 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.160.102 listed in will-spam-for-food.eu.org]

[209.85.160.102 listed in will-spam-for-food.eu.org]

[209.85.160.102 listed in will-spam-for-food.eu.org]

[209.85.160.102 listed in will-spam-for-food.eu.org]

[209.85.160.102 listed in will-spam-for-food.eu.org]

[209.85.160.102 listed in will-spam-for-food.eu.org]

[209.85.160.102 listed in will-spam-for-food.eu.org]

[209.85.160.102 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.160.102 listed in list.dnswl.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.160.102 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.160.102 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 NO_RDNS2 Sending MTA has no reverse DNS

Subject: {SPAM?} =?UTF-8?Q?Attached_Financial_and_Swift_Documentati?=

=?UTF-8?Q?on_=EF=BF=BD_07/09/2026_=EF=BF=BD_suppor?=

=?UTF-8?Q?t=40nk=2Eca?=

HR records phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 Jul 2026 14:12:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whv69-00000000LtH-0apO

for dave@doctor.nl2k.ab.ca;

Thu, 09 Jul 2026 14:11:53 -0600

Resent-From: The Doctor

Resent-Date: Thu, 9 Jul 2026 14:11:53 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lj1-f229.google.com ([209.85.208.229]:42371)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whsfY-00000000D4Z-2PJL

for doctor@nl2k.ab.ca;

Thu, 09 Jul 2026 11:36:25 -0600

Received: by mail-lj1-f229.google.com with SMTP id 38308e7fff4ca-39c94d4fdb9so570701fa.1

for ; Thu, 09 Jul 2026 10:35:29 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=waves-systems.20251104.gappssmtp.com; s=20251104; t=1783618522; x=1784223322; darn=nl2k.ab.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=TTaCEMM11Spje0itWq3IMDUmFcem/VGFQIsbz8obGsU=;

b=CHfZMauie2R2qM2G4c20nbG84vbznJoudQoBjOlAgYWc7d/DuDULH4SbvbUmr/6tv8

1LUd3Jclnyr0PqHXB7STKKyNuoZgLBSZHdbDvUyJNgwj+O8TdYrUfC9hcHVe/ks+ktR0

UfAx3vc+6MumlFLgGdJrLlxvH4Uy3zJXh1TAFC6Zw7OskztV4Kje36gafCS3efknQCdH

99cmmZN44YmrdzeNmMLkPfX0Fmkw4RuuXIrbnkk+c1IWxb/v4rZ4z+jAvrSaOmmUc6eB

mRa0gK7SL2tN7RJG7JJIrGC94VueGNkaJkoLcGi/+DhIEw+xmlsLl4W0kVLOdL8E+dSV

jdwA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783618522; x=1784223322;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=TTaCEMM11Spje0itWq3IMDUmFcem/VGFQIsbz8obGsU=;

b=NmZRkOeW5vZlYWWFS1vWjZJWfdZQ4/Ak5NIJVFJXYxojatbiBP/zybRgn/Vt70oiJP

i2jQkG6XewPUjhwHK2FwCvr1rf15VTxUN1JJP2AXvEJLQ1Qe68PZkKPTB7Q5dQQ/dfs+

/yl8OCFE1nQRUK/3AGnKlufp+2jkWuWsxZSb4+ALx8389zFVs5N+oe/O0UlyEbiSbSVu

a0lH6RXr+xnQmKHSz+Y6O1SCz36pssJ1YheEAtRswWcK0DBninHaEtg5OSZTiWsalNx2

hCGQD++zUlr1Qpdi5ieftK96W54bts3aHMjIYuOlAsz1rgzU/9X20qP0MepSlKp3frAv

emIQ==

X-Gm-Message-State: AOJu0Yw92F57dNWXMZBMrL6CyLDktyhEJ+2diCjzoNb5K1CVhiWg1p1H

BhxMGJv3yqy21oIWZwHNJQPPZM/Z+ihyIZNeSmJ9SEzS2HhzysM32BpDtDkEhr2CeofUVEO6YCf

uo2YiY9owIdMtN5r70FmDFZAoC+0TuOzcU65nfIx5vqQASZY=

X-Gm-Gg: AfdE7cnpJ3+HKj/gToqiSHfXJycTUvIuRCFD30olLXi8vVgK4kXcL7ticrmf4mSDQBi

C2cltH6nqQLViZTB+WPz2Z6NHi9fVDdQ7OkNjNkMALWmaxXrT30RXvgr1bVuYZQGYqKmQBsOvz3

gm9HhvpcUCC44IJltOSshaJlvdab6+a7yrqDEzAcFMDv8fvDIixLXAxGl7NAoVDXO+8A/eGBp6P

BEG/yzcZl3HN8vySg/V2KmKCx/uuOS8pdKPPDVRE+sAxWlxJYpbWL/zezUu7RYmK+3451h9tP/Z

1YEM3WUGQ9iMQgySOvFRSluBX/PHtGs2+Ad2JKVfcWMoqZ/4fEbU7+IOs7PQFJBIjd+2Viu4txF

ap9eiN2/HroTcSJBDGHrcpOYlY4n3jSoyHTxr

X-Received: by 2002:a2e:bb8e:0:b0:393:aa48:8243 with SMTP id 38308e7fff4ca-39c94ca66ffmr265461fa.18.1783618521935;

Thu, 09 Jul 2026 10:35:21 -0700 (PDT)

Received: from waves.systems ([185.56.45.245])

by smtp-relay.gmail.com with ESMTPS id 38308e7fff4ca-39c849034c0sm2003021fa.7.2026.07.09.10.35.21

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Thu, 09 Jul 2026 10:35:21 -0700 (PDT)

X-Relaying-Domain: waves.systems

From: nl2k_HR

To: doctor@nl2k.ab.ca

Subject: FW: Payroll NDA - doctor

Message-ID: <8375b5b0-cfd2-8a79-7949-116b489e4861@waves.systems>

Content-Transfer-Encoding: quoted-printable

Date: Thu, 09 Jul 2026 17:35:20 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 8.8

X-Spam_score_int: 88

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Action Required: Document Review A document has been uploaded

for your records. Please review the details below:



Content analysis details: (8.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.208.229 listed in dnsbl.ahbl.org]

[209.85.208.229 listed in dnsbl.ahbl.org]

[209.85.208.229 listed in dnsbl.ahbl.org]

[209.85.208.229 listed in dnsbl.ahbl.org]

[185.56.45.245 listed in dnsbl.ahbl.org]

[185.56.45.245 listed in dnsbl.ahbl.org]

[185.56.45.245 listed in dnsbl.ahbl.org]

[185.56.45.245 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.208.229 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.208.229 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.208.229 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.208.229 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[185.56.45.245 listed in will-spam-for-food.eu.org]

[185.56.45.245 listed in will-spam-for-food.eu.org]

[185.56.45.245 listed in will-spam-for-food.eu.org]

[185.56.45.245 listed in will-spam-for-food.eu.org]

[185.56.45.245 listed in will-spam-for-food.eu.org]

[185.56.45.245 listed in will-spam-for-food.eu.org]

[185.56.45.245 listed in will-spam-for-food.eu.org]

[185.56.45.245 listed in will-spam-for-food.eu.org]

[209.85.208.229 listed in will-spam-for-food.eu.org]

[209.85.208.229 listed in will-spam-for-food.eu.org]

[209.85.208.229 listed in will-spam-for-food.eu.org]

[209.85.208.229 listed in will-spam-for-food.eu.org]

[209.85.208.229 listed in will-spam-for-food.eu.org]

[209.85.208.229 listed in will-spam-for-food.eu.org]

[209.85.208.229 listed in will-spam-for-food.eu.org]

[209.85.208.229 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.208.229 listed in list.dnswl.org]

1.7 URIBL_CT_SURBL Contains an URL listed in the CT SURBL blocklist

[URI: ci6lc7hbb.cc.rs6.net]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: rs6.net]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.208.229 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.208.229 listed in bl.score.senderscore.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 IMPRO_URI_2 No description available.

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 NO_RDNS2 Sending MTA has no reverse DNS

Subject: {SPAM?} FW: Payroll NDA - doctor




border: 1px solid #d1d5db;">