Docusign Phish from Microsoft Outlook
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 04 Feb 2025 15:36:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))
(envelope-from)
id 1tfRW6-000000003ET-3yVa
for dave@doctor.nl2k.ab.ca;
Tue, 04 Feb 2025 15:35:38 -0700
Resent-From: The Doctor
Resent-Date: Tue, 4 Feb 2025 15:35:38 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-am6eur05hn2201.outbound.protection.outlook.com ([52.100.174.201]:48353 helo=EUR05-AM6-obe.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.98 (FreeBSD))
(envelope-from)
id 1tfM7b-000000006ya-2mQb
for doctor@doctor.nl2k.ab.ca;
Tue, 04 Feb 2025 09:50:06 -0700
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;
b=D2Pe1SILkRbeLDCVMbGduwp9VXhzcY2pIrvfmTv6rICzjfenU8w8SlRJNN/4HEI6SwOYlAx3Rv3sTLabbTVbHs+EDKmA+qNI9sGpNHkvwUsgRGC37kfD6GvGbOkJgIATaaMPgSSxjFcIJmL1tN2E6j0Qdu1qPgoUXyf3iybiI+nsxnqddBBZMURA8Y3rcbly0vKkhqYapYBp6E2iUI/ezRUPnYaiCJJ5b2vLOsez2/BQk6a+o2p39jofS8ZSmxZdn2EjeuOpwg3//VN21pbGSpJQE0B24GhINvyWnGNai6UpuNaG082ODF6RJwPD6wD+S0HTwNL/TM8wpuq5n0gDhQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector10001;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=EQ2y/X/ptPJFD+iotM2wxA40+FpQ2w8K5XIeQaQXarU=;
b=NJnFmxFI/S99pGeTJ+aUAHFEcQaLHuQma9ZH47DPSWm7qF3VCeOyNImO6zPRPjiI6JE8KPvPwFZUuW1gfLraqe7RkrovEbDgzHMMj8D9aqjyPQdAyf1nmE5fqdOe865Rk55I/otl+WnNkWnMEijZCa/3NdjeoMUu4tZD5+FMckJbr4XKPIOXHlzybQ6iH48yEIF7o6zIQbRyMO6LBgqu/reUHW1TvoxdoMrD5VL0i6dHao3jXZmsd/RYGYJ4EEQ2ByIXPEpv2eCJ3a9foQsfnaWDxPJVlPI8e3mfXSxVv1zhWj/9IpBDTu+5vPRTacTNUrTI39izOgsjA8hkrbSXHA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is
64.207.219.71) smtp.rcpttodomain=xoxomor.store smtp.mailfrom=docusign.net;
dmarc=pass (p=reject sp=reject pct=100) action=none header.from=docusign.net;
dkim=pass (signature was verified) header.d=docusign.net; arc=none (0)
Received: from DU2PR04MB9113.eurprd04.prod.outlook.com (2603:10a6:10:2f4::8)
by DUZPR04MB9745.eurprd04.prod.outlook.com (2603:10a6:10:4e1::5) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8398.24; Tue, 4 Feb
2025 16:47:48 +0000
Received: from DU2PR04MB9113.eurprd04.prod.outlook.com
([fe80::95f8:5344:a5fe:d1e5]) by DU2PR04MB9113.eurprd04.prod.outlook.com
([fe80::95f8:5344:a5fe:d1e5%4]) with mapi id 15.20.8398.025; Tue, 4 Feb 2025
16:47:47 +0000
Received: from DUZPR01CA0151.eurprd01.prod.exchangelabs.com
(2603:10a6:10:4bd::13) by AM9PR04MB8777.eurprd04.prod.outlook.com
(2603:10a6:20b:408::20) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8398.25; Tue, 4 Feb
2025 16:47:11 +0000
Received: from DU2PEPF00028D04.eurprd03.prod.outlook.com
(2603:10a6:10:4bd:cafe::4b) by DUZPR01CA0151.outlook.office365.com
(2603:10a6:10:4bd::13) with Microsoft SMTP Server (version=TLS1_3,
cipher=TLS_AES_256_GCM_SHA384) id 15.20.8398.24 via Frontend Transport; Tue,
4 Feb 2025 16:47:08 +0000
Authentication-Results: spf=pass (sender IP is 64.207.219.71)
smtp.mailfrom=docusign.net; dkim=pass (signature was verified)
header.d=docusign.net;dmarc=pass action=none header.from=docusign.net;
Received-SPF: Pass (protection.outlook.com: domain of docusign.net designates
64.207.219.71 as permitted sender) receiver=protection.outlook.com;
client-ip=64.207.219.71; helo=mailch.docusign.net; pr=C
Received: from mailch.docusign.net (64.207.219.71) by
DU2PEPF00028D04.mail.protection.outlook.com (10.167.242.164) with Microsoft
SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8398.14
via Frontend Transport; Tue, 4 Feb 2025 16:47:11 +0000
Received: from SE101FE152.corp.docusign.net (se-c103-f51-81.corp.docusign.net [10.101.81.137])
by mailch.docusign.net (Postfix) with ESMTP id 35B5820106B6
for; Tue, 04 Feb 2025 16:47:10 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=docusign.net;
s=mail1; t=1738687630;
bh=gWqBGBYaAxByjT/4yQ0uTHZEms1a8GEdNv7YxrWLG28=;
h=Reply-To:Feedback-ID:From:To:Date:Subject;
b=F1RHfXFHoMee/JZQT5gkXkW5TdTE44kFqsbY3tt1qkMiozw9Gys8vQABi6H8Sbtwz
s032T0i0VuKcrmLTipHWqlSzeTpQhNy0CmHCGXAReyKzKY75hzTRdzwfvP1HXVb8ps
nKwlS6TYc73Z9voqOxRCtken7l9FjrXVY+rY0/twQHrFHcrDTWtKchP/V5O4UqZsdT
zXTerJDsPobt47P0wry10kcXD7BcLFNBC2pSViQ5JHWpGwqxVrRl+d10s4AqC3wfrq
T+HA6SGOWjhQemrClzVlNSBRTpDsE9NIy97jl8mngqOHbkrVmlkq42SlQiGFISUpfR
V+9omI9hEZIXQ==
Received: from docusign.net ([127.0.0.1]) by SE101FE152.corp.docusign.net with Microsoft SMTPSVC(10.0.17763.1697);
Tue, 4 Feb 2025 08:47:09 -0800
Sender: DocuSign NA4 System
Reply-To: "Billing Team"
Recipient-Id: 43f9166e-7983-42c3-befb-0e3eda06de91
X-Debug: False
X-Email-Rejection-Mode: LearningMode
X-Api-Host: na4.docusign.net
Site-Id: 7
X-BounceEmailVersion: 1
Feedback-ID: 1:ff1e8948ed0aab956a87a93a0f9c9fda:EnvelopeActivation:Docusign_Prod
X-DS-Score: 1
From: "Billing Team via Docusign"
To: "Dear Customer"
Message-ID:
Date: Tue, 04 Feb 2025 08:47:09 -0800
Subject: Notification From PayPal
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_20F58451_E956_4B14_AC54_0FD24090E013"
X-OriginalArrivalTime: 04 Feb 2025 16:47:09.0954 (UTC) FILETIME=[6ED4F620:01DB7724]
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: d3569ad0-d051-4957-8326-dcaa2181d333:0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic:
DU2PEPF00028D04:EE_|AM9PR04MB8777:EE_|DUZPR04MB9745:EE_
X-MS-Office365-Filtering-Correlation-Id: 6a6f8d37-8600-4865-ff6c-08dd453b9237
X-Moderation-Data: 2/4/2025 4:47:46 PM
X-LD-Processed: d3569ad0-d051-4957-8326-dcaa2181d333,ExtAddr
X-MS-Exchange-SenderADCheck: 0
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;ARA:13230040|1032899013|35002699018|3033299015;
X-Microsoft-Antispam-Message-Info:
=?utf-8?B?d2lPdFJsZm5Ub294SitlMUVsdzR1Z1RrOFJLMTM2UWV6VUZ5YW5tTlRqRjBO?=
=?utf-8?B?SFQyYnNNdVJ5Y0xpbGxTU2g3MTB2Nitqa2JMRndXbU5TSHFJVVVndFdjZUVs?=
=?utf-8?B?aUdWcE0rMFh3KzBKRVU1YUg0T2tqdFNvRnFTQkRXUHh5Z0F6RlNSZUp6aWNp?=
=?utf-8?B?cEJGWnFmUUZFUWcvUkdZNyt4NEtEbnVmM2VWZmtpbFpidzdxU3NycW9qaDZu?=
=?utf-8?B?aitSZVFyaExmc2ZYVjZxWTZFVG5sVkd6OXkrNWpLSnpzWXAvcjh1M0c5eTBF?=
=?utf-8?B?NVllZWN3RjUyVkEyRUhsbkFCMHVtT0VzVDN6TWRjSEhzKzZMZFd2V0pIZXRC?=
=?utf-8?B?Tjc2QWl5dENFdHAxSFUrTy9BWGprYkhPTjRWR25CZjk0V0FLTjJjcWUxUjlV?=
=?utf-8?B?V0lMMEVQM1BITU80UFRWbkgxQUl2WE5UN3B3VjJ5SnprSFJic2FYZGlQdG1F?=
=?utf-8?B?TkplZlZzUlhVc2Voam5YczY0Vk5obEVtVFZ0NTFrNWRQUmlWV0dPaEs0Q3d1?=
=?utf-8?B?SFNwTVJzSEZmWDJwQ0FqbkNrKzlheXNSQ3dBb1YydlBDc2xCT1UrSVdWQ2N5?=
=?utf-8?B?NTBMckg1bHFTaEhUY0wwRlNmOGxaMUYwbHp6NlFEanVSaDVEQWVLOG5mK1RB?=
=?utf-8?B?cnFlbWw4WVZKYzRjc0FzTzIzdnFVaVdiaUFyclVjY01hZnd1dGdQYTBvbjdK?=
=?utf-8?B?dUtRN0VBUUJKSDJaVXk3Q0R0SFYrNWpqM0NhNlNjcFR3WDZ3WHNRL0p0dG1S?=
=?utf-8?B?VTNhMmNsNkRiWWI5WkhmU3dNUGR6RnpNaTFZT05TZmRBLzBHZGtIcnBDUkJU?=
=?utf-8?B?N2hTSEpFK1NjWEVveEgwazRldHZVLzJjbW9tbWNZOVhpVThzbFFqVklIUUhl?=
=?utf-8?B?ZkFidzdkZlBnVU1DN05hcHE4TWUzQkNzT2c0K2Z1Vlo1UzdiNFIwMUtibEdV?=
=?utf-8?B?enQ1QytxWC9zb1hTSG9hNG14SzUzV2lUNHJ2M1h0a3NDd3A5Y2k2Q05oYW8z?=
=?utf-8?B?eWtKc2taQmdJL0RtaGJMbWtLMmF5eU1CN2JCcWcxaXR4YWJHaVFJUS9KQ1lz?=
=?utf-8?B?Q0ZvYmx4RXM3emdscEo0TkdBQ1VBUUFkSDMyV0VWazFhQUQvRmladkNBZ0Fl?=
=?utf-8?B?aENYUEpZa3FOVUlRZThtUE5wMitlMnpVMmJXRkJjRSt3TGMzQjZxUGdzNmpX?=
=?utf-8?B?QS9Rc2xZcmRjUUpUY2FoeVE2U0VQUHlKaElyVXZUL0ZNdmN0QnZiOFVaT3M1?=
=?utf-8?B?SjhEeTFKYlFMZGFzOVZjSHF3d3cyVzgwUjdlc09ieFlMaXdOY2xMSFFIbEpL?=
=?utf-8?B?TFdiSkZWZ09XZGhUUDhGdENVOERNaWhCT2J3dzR0ck83OVhBYzFOT3p5ekdj?=
=?utf-8?B?MVlnZDdaaXE3L3hwRE92M3NyTGp4aDlieDEyTmNOVkpiUnQxbW5XRzV5TlY4?=
=?utf-8?B?a2g4Y0huZWZET2xrektVK2RQcmJ6bnlxMFZEUFVTNUg4RUM4S2J3dUtpaXJQ?=
=?utf-8?B?SkNkbUEyQjV0QVgxd2liaURSZkc2V3NWV0JtS0QzNmpObGtWK1JCNmp0QTl4?=
=?utf-8?B?ajdYdUd5UWRSenFRNlptb1FPbkpVN3h6RmFuVkdJK0tYbVdJRUlsQzNKS3E0?=
=?utf-8?B?V3EwMWd0NFpGUzNkSEcwVUZFZjU4ZitUL251WjgrSFppZFU1MFBra2NvRHFG?=
=?utf-8?B?WFkrMk5zaGlLRW9RRnZFellLdDgrTE01engxcXhoVk1VeVhxVmppRlUvK2pa?=
=?utf-8?B?QVpHK3cvWW80eXdYUjJRbEg3eWY1VTMxbG1BVE40ZUFhZWl3WHZ4dldPb2NS?=
=?utf-8?B?clNyaHJFS0ZRT2ZLVW42YVh1dTFSazYrODZNZ3NaK0lTYS9qNndIdnlndkRv?=
=?utf-8?B?d1hsN0tzZ1RuaGJVSno2VDdSKzFDanlBQy92cUJBaGJMWkY4SWlDdTh4aVU4?=
=?utf-8?B?NzJvS3piU2lrYmJzSHFUcVB4QSt4d0o4VnZhK0VHSkN3d1UrNmkwYzZ4QlNV?=
=?utf-8?B?QVpLYlo4cmlDcWZjUnFVY2JqSWlONCthSkZoSU9zUldrOGlCWm4zdEtYc2Zn?=
=?utf-8?B?QTM0OWFlUVk2bHdvVkxaSlRGVkovVElPeVg5TDZhQ0ZWck9mZVVQV2hYdUs2?=
=?utf-8?B?VFBZd21jamV0UGJiQmNPTU15bkdYckpQR3hScGRYNDBOdlQ2UGsyYlVnbkx0?=
=?utf-8?B?RzVSaXo3WXB5QytDMnZPdVkxSEhCMUZQNVRVZXBlRmdXbTJVcVU4MndGQkpZ?=
=?utf-8?B?eDZPUUozdlEvaWYxbit5cFM4Z09GWEJ4dHRwd3p1RTJTS1A1cGRzeVVKalln?=
=?utf-8?B?L1NkSXF3M0lyaFkwZGVTQm5TU0FoOEpuZDVXa3hZTFEydVZ1NEJTOXQ1eVo1?=
=?utf-8?B?NC9aMmdvdi9EZ2hJdVpXNTVRRTZ5NkQvSEk5WC9MMTBHTTNScXdZWThnM2pp?=
=?utf-8?B?RVFQYnc5aG9GTkhmSXJnMGIrYkQxUWpJdXhLWTBQcmV4RThmZ1NieTZFcDFP?=
=?utf-8?B?clRpRmEzT2pMaURwcU9XNUxpNThsR1lWQ09yeUQxUkg4N3FyZUZ3SEpGbzhJ?=
=?utf-8?B?YnB1K3BPRFkrQ1Ixbk9sUDREbTUzeVpBYlRuUXdsTFM4NEZMeUx3R09lRjFj?=
=?utf-8?B?bllPcS80azYzZE9CREdoWDFMeCtMWGMxN3d3ajJ6YTNWVTVtZ3duTW9IRlNQ?=
=?utf-8?B?ZVI2QVBlT1lNTXdpY2UwQlEyWHlHWXk0bkZtQWJFUUQvYTRzbHczOHdJVm9v?=
=?utf-8?B?cGY1ZzYvNDR1RCtCQ3kxeHRGVUtzcTFwOHFHdm9MNHJwWmczUmlteUM4U2RZ?=
=?utf-8?B?MXg0MDA0ZU14eXhkYW0rWDg1bHVwRks1cEdPLzh1RGFDZVhjb2NpSUhYZ2dY?=
=?utf-8?B?NS9VSnpWbmJzdWVXODI2SWp3eHdhZ201MDRhRVZMaXBUTVk0QmhmK2tpUHV2?=
=?utf-8?B?Z3VJOENNTGFDQW9yOCtFT01WVFcvcWw5dWZ3RFJZLzRhMmFyNjNZSW5iTmQ5?=
=?utf-8?B?LzcrMXpla1dKMkFLT01NMWxKUFJCY2R2R01OR25tT2ZKb3J1R2JJZEZ3RnNK?=
=?utf-8?B?dk9pd3NiRmZYd2dQNDZtYkhxZ29UMjRwMFpXeXRZZ1loSXpicFg5M0xEUFFU?=
=?utf-8?B?ZjlvTkFlZnZ3TFFiYytnRFMwSERLWVdJdWZqbm91a0NiOUFIcU5IMGFRMlRq?=
=?utf-8?B?YlA0Q25rV1M2YU1BUjNyMFRRS2NWVURRY3hnRkkvTGlrbWdQSXUvdlpJdjln?=
=?utf-8?B?UjJOOU1zZVJyYU5OUWp2MU9KSjBsNUxaeSs0U1FwbGUrRko5MStjSFpLcWNC?=
=?utf-8?B?eitCak4xTnBqRGdzZ0xCL0VocjVBVVFRPT0=?=
X-Forefront-Antispam-Report:
CIP:64.207.219.71;CTRY:US;LANG:en;SCL:8;SRV:;IPV:NLI;SFV:SPM;H:mailch.docusign.net;PTR:mailch.docusign.net;CAT:OSPM;SFS:(13230040)(1032899013)(35002699018)(3033299015);DIR:OUT;SFP:1501;
X-Auto-Response-Suppress: DR, OOF, AutoReply
X-OriginatorOrg: xoxomor.store
X-MS-Exchange-CrossTenant-Network-Message-Id: 6a6f8d37-8600-4865-ff6c-08dd453b9237
X-MS-Exchange-CrossTenant-Id: d3569ad0-d051-4957-8326-dcaa2181d333
X-MS-Exchange-CrossTenant-AuthSource: DU2PEPF00028D04.eurprd03.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Feb 2025 16:47:47.9544
(UTC)
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: qf9vsyJUelDKxIQ4XpD1OGLCNaCUYM2iM4DyAI14VhWndw5wpTq1aRCUALrvWJYyMrJZeoc5xxJFb2ThYkG6RYvB2hNOqOtn/PQa59L5GTrDDk0j8Pb5LPZU8V5LifQ7gJQNLZtjfNisK/RTWPQoNgWb5srb4c5ANyoVVAw474Yp1lXsmT7rLk0KiKVTiqS67/gLH9XtJPeQcNZ+UvMLlvRNl7lOsJ9s3lKySLs1f4Y=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DUZPR04MB9745
X-Spam_score: 6.2
X-Spam_score_int: 62
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hello Dear Customer, Billing Team has sent you a new Docusign
document to view and sign. Please click on the link below to begin signing.
We have observed an attempt to charge $649.89 to your PayPal account for
the purchase of 0.0066 Bitcoin. To safeguard your account, this transaction,
which came from an unidentified IP address in Texa [...]
Content analysis details: (6.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[64.207.219.71 listed in will-spam-for-food.eu.org]
[64.207.219.71 listed in will-spam-for-food.eu.org]
[64.207.219.71 listed in will-spam-for-food.eu.org]
[64.207.219.71 listed in will-spam-for-food.eu.org]
[64.207.219.71 listed in will-spam-for-food.eu.org]
[64.207.219.71 listed in will-spam-for-food.eu.org]
[64.207.219.71 listed in will-spam-for-food.eu.org]
[64.207.219.71 listed in will-spam-for-food.eu.org]
[2603:10a6:10:4bd:cafe:0:0:4b listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:4bd:cafe:0:0:4b listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:4bd:cafe:0:0:4b listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:4bd:cafe:0:0:4b listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:4bd:cafe:0:0:4b listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:4bd:cafe:0:0:4b listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:4bd:cafe:0:0:4b listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:4bd:cafe:0:0:4b listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:4bd:0:0:0:13 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:4bd:0:0:0:13 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:4bd:0:0:0:13 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:4bd:0:0:0:13 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:4bd:0:0:0:13 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:4bd:0:0:0:13 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:4bd:0:0:0:13 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:4bd:0:0:0:13 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:2f4:0:0:0:8 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:2f4:0:0:0:8 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:2f4:0:0:0:8 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:2f4:0:0:0:8 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:2f4:0:0:0:8 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:2f4:0:0:0:8 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:2f4:0:0:0:8 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:2f4:0:0:0:8 listed in]
[will-spam-for-food.eu.org]
[52.100.174.201 listed in will-spam-for-food.eu.org]
[52.100.174.201 listed in will-spam-for-food.eu.org]
[52.100.174.201 listed in will-spam-for-food.eu.org]
[52.100.174.201 listed in will-spam-for-food.eu.org]
[52.100.174.201 listed in will-spam-for-food.eu.org]
[52.100.174.201 listed in will-spam-for-food.eu.org]
[52.100.174.201 listed in will-spam-for-food.eu.org]
[52.100.174.201 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[52.100.174.201 listed in dnsbl.ahbl.org]
[52.100.174.201 listed in dnsbl.ahbl.org]
[52.100.174.201 listed in dnsbl.ahbl.org]
[52.100.174.201 listed in dnsbl.ahbl.org]
[2603:10a6:10:2f4:0:0:0:8 listed in]
[dnsbl.ahbl.org]
[2603:10a6:10:2f4:0:0:0:8 listed in]
[dnsbl.ahbl.org]
[2603:10a6:10:2f4:0:0:0:8 listed in]
[dnsbl.ahbl.org]
[2603:10a6:10:2f4:0:0:0:8 listed in]
[dnsbl.ahbl.org]
[2603:10a6:10:4bd:0:0:0:13 listed in]
[dnsbl.ahbl.org]
[2603:10a6:10:4bd:0:0:0:13 listed in]
[dnsbl.ahbl.org]
[2603:10a6:10:4bd:0:0:0:13 listed in]
[dnsbl.ahbl.org]
[2603:10a6:10:4bd:0:0:0:13 listed in]
[dnsbl.ahbl.org]
[2603:10a6:10:4bd:cafe:0:0:4b listed in]
[dnsbl.ahbl.org]
[2603:10a6:10:4bd:cafe:0:0:4b listed in]
[dnsbl.ahbl.org]
[2603:10a6:10:4bd:cafe:0:0:4b listed in]
[dnsbl.ahbl.org]
[2603:10a6:10:4bd:cafe:0:0:4b listed in]
[dnsbl.ahbl.org]
[64.207.219.71 listed in dnsbl.ahbl.org]
[64.207.219.71 listed in dnsbl.ahbl.org]
[64.207.219.71 listed in dnsbl.ahbl.org]
[64.207.219.71 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[52.100.174.201 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[52.100.174.201 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[52.100.174.201 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[52.100.174.201 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[52.100.174.201 listed in list.dnswl.org]
0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The
query to Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[52.100.174.201 listed in sa-trusted.bondedsender.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[52.100.174.201 listed in sa-accredit.habeas.com]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[52.100.174.201 listed in wl.mailspike.net]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[52.100.174.201 listed in bl.score.senderscore.com]
0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[52.100.174.201 listed in bl.score.senderscore.com]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
0.0 ARC_SIGNED Message has a ARC signature
0.0 ARC_VALID Message has a valid ARC signature
0.0 AXB_X_FF_SEZ_S Forefront sez this is spam
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[tube_x159(at)yopmail.com]
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
0.3 LONGWORD BODY: Uses overlong words
0.1 TW_MZ BODY: Odd Letter Triples with MZ
0.6 MEGALONGWORD BODY: Uses really overlong words
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 NO_RDNS2 Sending MTA has no reverse DNS
1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 T_REMOTE_IMAGE Message contains an external image
Subject: {SPAM?} Notification From PayPal
------=_NextPart_20F58451_E956_4B14_AC54_0FD24090E013
Content-type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Hello Dear Customer,
Billing Team has sent you a new Docusign document to view and sign=2E P=
lease click on the link below to begin signing=2E
We have observed an attempt to charge $649=2E89 to your PayPal account =
for the purchase of 0=2E0066 Bitcoin=2E To safeguard your account, this=
transaction, which came from an unidentified IP address in Texas, has =
been temporarily blocked=2E=20
You Must Do
Please get in touch with us right away to prevent further action if you=
did not approve this transaction=2E=20
The Way to Get in Touch with Us=20
PayPal Resolution Center=F0=9F=93=9E 24/7 Toll-Free Help: +1 (877) 513-=
3656
To see more information, click "REVIEW NOW=2E"=20
Details of the Transaction: Bitcoin (0=2E0066BTC)=20
The total amount charged was $649=2E89=2E=20
Date of Transaction: February4, 2025;
Invoice ID: RRY-70003691
Subsequent Activities=20
To dispute or immediately cancel an unauthorized charge, call +1 (877) =
513-3656=2E=20
If authorized: Nothing needs to be done=2E=20
We Put Your Security First=2E=20
Remember that PayPal will never ask for=20
Thank you for choosing PayPal=2E
PayPal Security Team
=C2=A9 1999-2025 PayPal, Inc=2E All rights reserved=2E
=20
REVIEW DOCUMENT
https://na4=2Edocusign=2Enet/Signing/EmailStart=2Easpx?a=3D94f28582-c8a=
9-40c3-a0ce-e359990dd2bc&etti=3D24&acct=3D7f6da93a-04a2-4c1b-8459-ecf6d=
596c013&er=3D43f9166e-7983-42c3-befb-0e3eda06de91
If clicking the link does not work, you can highlight and copy the enti=
re line above and paste it into your browser to get started=2E
This message was sent to you by Billing Team who is using the Docusign =
Electronic Signature Service=2E If you would rather not receive email f=
rom this sender you may contact the sender with your request=2E
Do Not Share This Email
This email contains a secure link to Docusign=2E Please do not share th=
is email, link, or access code with others=2E
Questions about the Document?
If you need to modify the document or have questions about the details =
in the document, please reach out to the sender by emailing them direct=
ly=2E
Stop receiving this email
Report this email https://protect=2Edocusign=2Enet/report-abuse?e=3DAUt=
omjpFak9GlbPL0zFFi111xlVFj293S2wijW3WyMfmxf_gbh4Vyk6vAfOTSp0CYiZb6YerQH=
Ej4t9mKZiNsYBDbqYDEH474ljpLedLxQbk5SvMFk2cskTuGCL4qA0p4Y3AbGq756izIOcKg=
Vf21Yf8PRUtsfwfeu2Xa44st_94lBo3WzcjYJ954iittV9Nkblelhoygf412P59E8KRSo3U=
lfPgD02lg7oMd1EhOK9N0VA25DhoEDVjgk3JI41lkyb9QPuDY33qKVGfdw68O0ej9DS7tzz=
-v4dv6uqlcKSuH0YEfHzxSGHTK5zFhGQyULyPCjt-mzsGc5Al7-WsFzRp8RdNvO73UuN1Ea=
9letB8Y7aEqzKIdTlhInVyIhBUy-y3K1EhwNq6lu_w-xM9tiysdDFN63TKKQlCuHCbKCuNd=
UFtGZ8sHBF6bUGLcWnZUg&lang=3Den
Declining to sign=20
Managing notifications=20
If you have trouble signing, visit "How to Sign a Document" on our Docu=
sign Support Center, or browse our Docusign Community for more informat=
ion=2E
https://support=2Edocusign=2Ecom/s/articles/How-do-I-sign-a-DocuSign-do=
cument-Basic-Signing?language=3Den_US&utm_campaign=3DGBL_XX_DBU_UPS=
_2211_SignNotificationEmailFooter&utm_medium=3Dproduct&utm_sour=
ce=3Dpostsend
------=_NextPart_20F58451_E956_4B14_AC54_0FD24090E013
Content-type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable
xt/html; charset=3DUTF-8"/>
cale=3D1=2E0"/>
o"/>EnvelopeActivation
olor:#EAEAEA;padding:2%;font-family:Helvetica,Arial,Sans Serif;">
role=3D'presentation' border=3D'0' cellspacing=3D'0' cellpadding=3D'0'=
align=3D'center' width=3D"100%" dir=3D"">
">
rspace:0pt;border-collapse:collapse;background-color:#ffffff;max-width:=
640px;">![]()
" width=3D"116" src=3D"https://docucdn-a=2Eakamaihd=2Enet/olive/images/=
2=2E62=2E0/global-assets/email-templates/email-logo=2Epng" alt=3D"DocuS=
ign"/>
le=3D'presentation' border=3D'0' cellspacing=3D'0' cellpadding=3D'0' wi=
dth=3D'100%' align=3D'center' style=3D'background-color:#260559;color:#=
FFFFFF;'>
;background-color:#260559;color:#FFFFFF;font-size:16px;font-family:Helv=
etica,Arial,Sans Serif;width:100%;text-align:center;" align=3D"center">=
![](3D"https://docucdn-a=2Eakamaihd=2En=<br)
et/olive/images/2=2E76=2E0/email/iconSignWhite=2Epng" style=3D"width:75=
px;height:75px;" alt=3D"" />
ellspacing=3D'0' cellpadding=3D'0' width=3D'100%'>
ing-top:24px;font-size:16px;font-family:Helvetica,Arial,Sans Serif;bord=
er:none;text-align:center;color:#FFFFFF" align=3D"center"> Billing Team=
sent you a document to review and sign=2E
e=3D'presentation' border=3D'0' cellspacing=3D'0' cellpadding=3D'0' wid=
th=3D'100%'>
td>
size:16px;font-family:Helvetica,Arial,Sans Serif;background-color:white=
;">
ing=3D'0'>
g style=3D"height:40px;width:40px;border-radius:2px;" height=3D"40" wid=
th=3D"40" src=3D"https://NA4=2Edocusign=2Enet/Member/image=2Easpx?i=3Dl=
ogo&l=3D2aebca2c-affc-4564-bd6a-2ddf4a5caf6b" alt=3D"Picture of Billing=
Team" />
ily:Helvetica,Arial,Sans Serif;font-weight:bold;line-height:18px;font-s=
ize:15px;color:#333333;"> Billing Team
Helvetica,Arial,Sans Serif;line-height:18px;font-size:15px;color:#66666=
6;">tube_x159@yopmail=2Ecom
size:15px;color:#333333;font-family:Helvetica,Arial,Sans Serif;line-hei=
ght:20px;">We have observed an attempt to charge $649=2E89 to your PayP=
al account for the purchase of 0=2E0066 Bitcoin=2E To safeguard your ac=
count, this transaction, which came from an unidentified IP address in =
Texas, has been temporarily blocked=2E
You Must Do
Plea=
se get in touch with us right away to prevent further action if you did=
not approve this transaction=2E
The Way to Get in Touc=
h with Us
PayPal Resolution Center=F0=9F=93=9E 24/7 Toll-Free Hel=
p: +1 (877) 513-3656
To see more information, click "REVIEW NOW=2E=
"
Details of the Transaction: Bitcoin (0=2E0066BTC)
Th=
e total amount charged was $649=2E89=2E
Date of Transaction: Febr=
uary4, 2025;
Invoice ID: RRY-70003691
Subsequent Activit=
ies
To dispute or immediately cancel an unauthorized charge, call=
+1 (877) 513-3656=2E
If authorized: Nothing needs to be done=2E =
We Put Your Security First=2E
Remember that PayPal wil=
l never ask for
Thank you for choosing PayPal=2E
PayPal=
Security Team
=C2=A9 1999-2025 PayPal, Inc=2E All rights reserved=
=2E
24px;background-color:#ffffff;font-family:Helvetica,Arial,Sans Serif;fo=
nt-size:11px;color:#666666;">
px 45px 24px;background-color:#EAEAEA;">
ont-family:Helvetica,Arial,Sans Serif;font-size:13px;color:#666666;line=
-height:18px;">Do Not Share This E=
mail
This email contains a secure link to Docusign=2E Please d=
o not share this email, link, or access code with others=2E
style=3D"margin-bottom:1em;font-family:Helvetica,Arial,Sans Serif;font-=
size:13px;color:#666666;line-height:18px;">
heading">Alternate Signing Method
Visit Docusign=2Ecom, click =
'Access Documents', and enter the security code:
94F28582C8A940C3=
A0CEE359990DD2BC7
ca,Arial,Sans Serif;font-size:13px;color:#666666;line-height:18px;">
aria-level=3D"3" role=3D"heading">About Docusign
Sign document=
s electronically in just minutes=2E It's safe, secure, and legally bind=
ing=2E Whether you're in an office, at home, on-the-go -- or even acros=
s the globe -- Docusign provides a professional trusted solution for Di=
gital Transaction Management=E2=84=A2=2E
1em;font-family:Helvetica,Arial,Sans Serif;font-size:13px;color:#666666=
;line-height:18px;">Questions abou=
t the Document?
If you need to modify the document or have qu=
estions about the details in the document, please reach out to the send=
er by emailing them directly=2E
heading">Stop receiving this email
docusign=2Enet/report-abuse?e=3DAUtomjpFak9GlbPL0zFFi111xlVFj293S2wijW3=
WyMfmxf_gbh4Vyk6vAfOTSp0CYiZb6YerQHEj4t9mKZiNsYBDbqYDEH474ljpLedLxQbk5S=
vMFk2cskTuGCL4qA0p4Y3AbGq756izIOcKgVf21Yf8PRUtsfwfeu2Xa44st_94lBo3WzcjY=
J954iittV9Nkblelhoygf412P59E8KRSo3UlfPgD02lg7oMd1EhOK9N0VA25DhoEDVjgk3J=
I41lkyb9QPuDY33qKVGfdw68O0ej9DS7tzz-v4dv6uqlcKSuH0YEfHzxSGHTK5zFhGQyULy=
PCjt-mzsGc5Al7-WsFzRp8RdNvO73UuN1Ea9letB8Y7aEqzKIdTlhInVyIhBUy-y3K1EhwN=
q6lu_w-xM9tiysdDFN63TKKQlCuHCbKCuNdUFtGZ8sHBF6bUGLcWnZUg&lang=3Den' sty=
le=3D'color:#2463d1;' >Report this email or read more about
=3D'https://support=2Edocusign=2Ecom/en/guides/Declining-to-sign-DocuSi=
gn-Signer-Guide' style=3D'color:#2463d1;' >Declining to sign and
href=3D'https://support=2Edocusign=2Ecom/en/articles/How-do-I-manage-m=
y-email-notifications' style=3D'color:#2463d1;' >Managing notifications=
=2E
If you have trouble signing, visit "
s://support=2Edocusign=2Ecom/s/articles/How-do-I-sign-a-DocuSign-docume=
nt-Basic-Signing?language=3Den_US&utm_campaign=3DGBL_XX_DBU_UPS_221=
1_SignNotificationEmailFooter&utm_medium=3Dproduct&utm_source=3D=
postsend' style=3D'color:#2463d1;' >How to Sign a Document" on our =
>Docusign Support Center, or browse our
y=2Edocusign=2Ecom/esignature-111?utm_campaign=3DGBL_US_PRD_AWA_2405_Co=
mmunityCTA&utm_medium=3Demail&utm_source=3Dpostsend' style=3D'c=
olor:#2463d1;' >Docusign Community for more information=2E
/>
erif;font-size:13px;color:#666666;line-height:18px;">
/www=2Edocusign=2Ecom/features-and-benefits/mobile?utm_campaign=3DGBL_X=
X_DBU_UPS_2211_SignNotificationEmailFooter&utm_medium=3Dproduct&=
;utm_source=3Dpostsend" style=3D"color:#2463d1;" >![]()
right:7px;border:none;vertical-align:middle;" width=3D"18" height=3D"18=
" src=3D"https://docucdn-a=2Eakamaihd=2Enet/olive/images/2=2E62=2E0/glo=
bal-assets/email-templates/icon-download-app=2Epng" alt=3D"" />Download=
the Docusign App
vetica,Arial,Sans Serif;font-size:13px;color:#666666;line-height:18px;f=
ont-size:10px;line-height:14px;">This message was sent to you by Billin=
g Team who is using the Docusign Electronic Signature Service=2E If you=
would rather not receive email from this sender you may contact the se=
nder with your request=2E
le><=
meta itemprop=3D"text" content=3D"Billing Team sent you a document to r=
eview and sign=2E"/>
"http://schema=2Eorg/CreativeWork">
ion" itemtype=3D"http://schema=2Eorg/ViewAction">
content=3D"https://na4=2Edocusign=2Enet/Signing/EmailStart=2Easpx?a=3D=
94f28582-c8a9-40c3-a0ce-e359990dd2bc&etti=3D24&acct=3D7f6da93a-04a2-4c1=
b-8459-ecf6d596c013&er=3D43f9166e-7983-42c3-befb-0e3eda06de91"/>
temprop=3D"name" content=3D"View Documents"/>
y>
------=_NextPart_20F58451_E956_4B14_AC54_0FD24090E013--
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 04 Feb 2025 15:36:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98 (FreeBSD))
(envelope-from
id 1tfRW6-000000003ET-3yVa
for dave@doctor.nl2k.ab.ca;
Tue, 04 Feb 2025 15:35:38 -0700
Resent-From: The Doctor
Resent-Date: Tue, 4 Feb 2025 15:35:38 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-am6eur05hn2201.outbound.protection.outlook.com ([52.100.174.201]:48353 helo=EUR05-AM6-obe.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.98 (FreeBSD))
(envelope-from
id 1tfM7b-000000006ya-2mQb
for doctor@doctor.nl2k.ab.ca;
Tue, 04 Feb 2025 09:50:06 -0700
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;
b=D2Pe1SILkRbeLDCVMbGduwp9VXhzcY2pIrvfmTv6rICzjfenU8w8SlRJNN/4HEI6SwOYlAx3Rv3sTLabbTVbHs+EDKmA+qNI9sGpNHkvwUsgRGC37kfD6GvGbOkJgIATaaMPgSSxjFcIJmL1tN2E6j0Qdu1qPgoUXyf3iybiI+nsxnqddBBZMURA8Y3rcbly0vKkhqYapYBp6E2iUI/ezRUPnYaiCJJ5b2vLOsez2/BQk6a+o2p39jofS8ZSmxZdn2EjeuOpwg3//VN21pbGSpJQE0B24GhINvyWnGNai6UpuNaG082ODF6RJwPD6wD+S0HTwNL/TM8wpuq5n0gDhQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector10001;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=EQ2y/X/ptPJFD+iotM2wxA40+FpQ2w8K5XIeQaQXarU=;
b=NJnFmxFI/S99pGeTJ+aUAHFEcQaLHuQma9ZH47DPSWm7qF3VCeOyNImO6zPRPjiI6JE8KPvPwFZUuW1gfLraqe7RkrovEbDgzHMMj8D9aqjyPQdAyf1nmE5fqdOe865Rk55I/otl+WnNkWnMEijZCa/3NdjeoMUu4tZD5+FMckJbr4XKPIOXHlzybQ6iH48yEIF7o6zIQbRyMO6LBgqu/reUHW1TvoxdoMrD5VL0i6dHao3jXZmsd/RYGYJ4EEQ2ByIXPEpv2eCJ3a9foQsfnaWDxPJVlPI8e3mfXSxVv1zhWj/9IpBDTu+5vPRTacTNUrTI39izOgsjA8hkrbSXHA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is
64.207.219.71) smtp.rcpttodomain=xoxomor.store smtp.mailfrom=docusign.net;
dmarc=pass (p=reject sp=reject pct=100) action=none header.from=docusign.net;
dkim=pass (signature was verified) header.d=docusign.net; arc=none (0)
Received: from DU2PR04MB9113.eurprd04.prod.outlook.com (2603:10a6:10:2f4::8)
by DUZPR04MB9745.eurprd04.prod.outlook.com (2603:10a6:10:4e1::5) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8398.24; Tue, 4 Feb
2025 16:47:48 +0000
Received: from DU2PR04MB9113.eurprd04.prod.outlook.com
([fe80::95f8:5344:a5fe:d1e5]) by DU2PR04MB9113.eurprd04.prod.outlook.com
([fe80::95f8:5344:a5fe:d1e5%4]) with mapi id 15.20.8398.025; Tue, 4 Feb 2025
16:47:47 +0000
Received: from DUZPR01CA0151.eurprd01.prod.exchangelabs.com
(2603:10a6:10:4bd::13) by AM9PR04MB8777.eurprd04.prod.outlook.com
(2603:10a6:20b:408::20) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8398.25; Tue, 4 Feb
2025 16:47:11 +0000
Received: from DU2PEPF00028D04.eurprd03.prod.outlook.com
(2603:10a6:10:4bd:cafe::4b) by DUZPR01CA0151.outlook.office365.com
(2603:10a6:10:4bd::13) with Microsoft SMTP Server (version=TLS1_3,
cipher=TLS_AES_256_GCM_SHA384) id 15.20.8398.24 via Frontend Transport; Tue,
4 Feb 2025 16:47:08 +0000
Authentication-Results: spf=pass (sender IP is 64.207.219.71)
smtp.mailfrom=docusign.net; dkim=pass (signature was verified)
header.d=docusign.net;dmarc=pass action=none header.from=docusign.net;
Received-SPF: Pass (protection.outlook.com: domain of docusign.net designates
64.207.219.71 as permitted sender) receiver=protection.outlook.com;
client-ip=64.207.219.71; helo=mailch.docusign.net; pr=C
Received: from mailch.docusign.net (64.207.219.71) by
DU2PEPF00028D04.mail.protection.outlook.com (10.167.242.164) with Microsoft
SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8398.14
via Frontend Transport; Tue, 4 Feb 2025 16:47:11 +0000
Received: from SE101FE152.corp.docusign.net (se-c103-f51-81.corp.docusign.net [10.101.81.137])
by mailch.docusign.net (Postfix) with ESMTP id 35B5820106B6
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=docusign.net;
s=mail1; t=1738687630;
bh=gWqBGBYaAxByjT/4yQ0uTHZEms1a8GEdNv7YxrWLG28=;
h=Reply-To:Feedback-ID:From:To:Date:Subject;
b=F1RHfXFHoMee/JZQT5gkXkW5TdTE44kFqsbY3tt1qkMiozw9Gys8vQABi6H8Sbtwz
s032T0i0VuKcrmLTipHWqlSzeTpQhNy0CmHCGXAReyKzKY75hzTRdzwfvP1HXVb8ps
nKwlS6TYc73Z9voqOxRCtken7l9FjrXVY+rY0/twQHrFHcrDTWtKchP/V5O4UqZsdT
zXTerJDsPobt47P0wry10kcXD7BcLFNBC2pSViQ5JHWpGwqxVrRl+d10s4AqC3wfrq
T+HA6SGOWjhQemrClzVlNSBRTpDsE9NIy97jl8mngqOHbkrVmlkq42SlQiGFISUpfR
V+9omI9hEZIXQ==
Received: from docusign.net ([127.0.0.1]) by SE101FE152.corp.docusign.net with Microsoft SMTPSVC(10.0.17763.1697);
Tue, 4 Feb 2025 08:47:09 -0800
Sender: DocuSign NA4 System
Reply-To: "Billing Team"
Recipient-Id: 43f9166e-7983-42c3-befb-0e3eda06de91
X-Debug: False
X-Email-Rejection-Mode: LearningMode
X-Api-Host: na4.docusign.net
Site-Id: 7
X-BounceEmailVersion: 1
Feedback-ID: 1:ff1e8948ed0aab956a87a93a0f9c9fda:EnvelopeActivation:Docusign_Prod
X-DS-Score: 1
From: "Billing Team via Docusign"
To: "Dear Customer"
Message-ID:
Date: Tue, 04 Feb 2025 08:47:09 -0800
Subject: Notification From PayPal
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_20F58451_E956_4B14_AC54_0FD24090E013"
X-OriginalArrivalTime: 04 Feb 2025 16:47:09.0954 (UTC) FILETIME=[6ED4F620:01DB7724]
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: d3569ad0-d051-4957-8326-dcaa2181d333:0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic:
DU2PEPF00028D04:EE_|AM9PR04MB8777:EE_|DUZPR04MB9745:EE_
X-MS-Office365-Filtering-Correlation-Id: 6a6f8d37-8600-4865-ff6c-08dd453b9237
X-Moderation-Data: 2/4/2025 4:47:46 PM
X-LD-Processed: d3569ad0-d051-4957-8326-dcaa2181d333,ExtAddr
X-MS-Exchange-SenderADCheck: 0
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;ARA:13230040|1032899013|35002699018|3033299015;
X-Microsoft-Antispam-Message-Info:
=?utf-8?B?d2lPdFJsZm5Ub294SitlMUVsdzR1Z1RrOFJLMTM2UWV6VUZ5YW5tTlRqRjBO?=
=?utf-8?B?SFQyYnNNdVJ5Y0xpbGxTU2g3MTB2Nitqa2JMRndXbU5TSHFJVVVndFdjZUVs?=
=?utf-8?B?aUdWcE0rMFh3KzBKRVU1YUg0T2tqdFNvRnFTQkRXUHh5Z0F6RlNSZUp6aWNp?=
=?utf-8?B?cEJGWnFmUUZFUWcvUkdZNyt4NEtEbnVmM2VWZmtpbFpidzdxU3NycW9qaDZu?=
=?utf-8?B?aitSZVFyaExmc2ZYVjZxWTZFVG5sVkd6OXkrNWpLSnpzWXAvcjh1M0c5eTBF?=
=?utf-8?B?NVllZWN3RjUyVkEyRUhsbkFCMHVtT0VzVDN6TWRjSEhzKzZMZFd2V0pIZXRC?=
=?utf-8?B?Tjc2QWl5dENFdHAxSFUrTy9BWGprYkhPTjRWR25CZjk0V0FLTjJjcWUxUjlV?=
=?utf-8?B?V0lMMEVQM1BITU80UFRWbkgxQUl2WE5UN3B3VjJ5SnprSFJic2FYZGlQdG1F?=
=?utf-8?B?TkplZlZzUlhVc2Voam5YczY0Vk5obEVtVFZ0NTFrNWRQUmlWV0dPaEs0Q3d1?=
=?utf-8?B?SFNwTVJzSEZmWDJwQ0FqbkNrKzlheXNSQ3dBb1YydlBDc2xCT1UrSVdWQ2N5?=
=?utf-8?B?NTBMckg1bHFTaEhUY0wwRlNmOGxaMUYwbHp6NlFEanVSaDVEQWVLOG5mK1RB?=
=?utf-8?B?cnFlbWw4WVZKYzRjc0FzTzIzdnFVaVdiaUFyclVjY01hZnd1dGdQYTBvbjdK?=
=?utf-8?B?dUtRN0VBUUJKSDJaVXk3Q0R0SFYrNWpqM0NhNlNjcFR3WDZ3WHNRL0p0dG1S?=
=?utf-8?B?VTNhMmNsNkRiWWI5WkhmU3dNUGR6RnpNaTFZT05TZmRBLzBHZGtIcnBDUkJU?=
=?utf-8?B?N2hTSEpFK1NjWEVveEgwazRldHZVLzJjbW9tbWNZOVhpVThzbFFqVklIUUhl?=
=?utf-8?B?ZkFidzdkZlBnVU1DN05hcHE4TWUzQkNzT2c0K2Z1Vlo1UzdiNFIwMUtibEdV?=
=?utf-8?B?enQ1QytxWC9zb1hTSG9hNG14SzUzV2lUNHJ2M1h0a3NDd3A5Y2k2Q05oYW8z?=
=?utf-8?B?eWtKc2taQmdJL0RtaGJMbWtLMmF5eU1CN2JCcWcxaXR4YWJHaVFJUS9KQ1lz?=
=?utf-8?B?Q0ZvYmx4RXM3emdscEo0TkdBQ1VBUUFkSDMyV0VWazFhQUQvRmladkNBZ0Fl?=
=?utf-8?B?aENYUEpZa3FOVUlRZThtUE5wMitlMnpVMmJXRkJjRSt3TGMzQjZxUGdzNmpX?=
=?utf-8?B?QS9Rc2xZcmRjUUpUY2FoeVE2U0VQUHlKaElyVXZUL0ZNdmN0QnZiOFVaT3M1?=
=?utf-8?B?SjhEeTFKYlFMZGFzOVZjSHF3d3cyVzgwUjdlc09ieFlMaXdOY2xMSFFIbEpL?=
=?utf-8?B?TFdiSkZWZ09XZGhUUDhGdENVOERNaWhCT2J3dzR0ck83OVhBYzFOT3p5ekdj?=
=?utf-8?B?MVlnZDdaaXE3L3hwRE92M3NyTGp4aDlieDEyTmNOVkpiUnQxbW5XRzV5TlY4?=
=?utf-8?B?a2g4Y0huZWZET2xrektVK2RQcmJ6bnlxMFZEUFVTNUg4RUM4S2J3dUtpaXJQ?=
=?utf-8?B?SkNkbUEyQjV0QVgxd2liaURSZkc2V3NWV0JtS0QzNmpObGtWK1JCNmp0QTl4?=
=?utf-8?B?ajdYdUd5UWRSenFRNlptb1FPbkpVN3h6RmFuVkdJK0tYbVdJRUlsQzNKS3E0?=
=?utf-8?B?V3EwMWd0NFpGUzNkSEcwVUZFZjU4ZitUL251WjgrSFppZFU1MFBra2NvRHFG?=
=?utf-8?B?WFkrMk5zaGlLRW9RRnZFellLdDgrTE01engxcXhoVk1VeVhxVmppRlUvK2pa?=
=?utf-8?B?QVpHK3cvWW80eXdYUjJRbEg3eWY1VTMxbG1BVE40ZUFhZWl3WHZ4dldPb2NS?=
=?utf-8?B?clNyaHJFS0ZRT2ZLVW42YVh1dTFSazYrODZNZ3NaK0lTYS9qNndIdnlndkRv?=
=?utf-8?B?d1hsN0tzZ1RuaGJVSno2VDdSKzFDanlBQy92cUJBaGJMWkY4SWlDdTh4aVU4?=
=?utf-8?B?NzJvS3piU2lrYmJzSHFUcVB4QSt4d0o4VnZhK0VHSkN3d1UrNmkwYzZ4QlNV?=
=?utf-8?B?QVpLYlo4cmlDcWZjUnFVY2JqSWlONCthSkZoSU9zUldrOGlCWm4zdEtYc2Zn?=
=?utf-8?B?QTM0OWFlUVk2bHdvVkxaSlRGVkovVElPeVg5TDZhQ0ZWck9mZVVQV2hYdUs2?=
=?utf-8?B?VFBZd21jamV0UGJiQmNPTU15bkdYckpQR3hScGRYNDBOdlQ2UGsyYlVnbkx0?=
=?utf-8?B?RzVSaXo3WXB5QytDMnZPdVkxSEhCMUZQNVRVZXBlRmdXbTJVcVU4MndGQkpZ?=
=?utf-8?B?eDZPUUozdlEvaWYxbit5cFM4Z09GWEJ4dHRwd3p1RTJTS1A1cGRzeVVKalln?=
=?utf-8?B?L1NkSXF3M0lyaFkwZGVTQm5TU0FoOEpuZDVXa3hZTFEydVZ1NEJTOXQ1eVo1?=
=?utf-8?B?NC9aMmdvdi9EZ2hJdVpXNTVRRTZ5NkQvSEk5WC9MMTBHTTNScXdZWThnM2pp?=
=?utf-8?B?RVFQYnc5aG9GTkhmSXJnMGIrYkQxUWpJdXhLWTBQcmV4RThmZ1NieTZFcDFP?=
=?utf-8?B?clRpRmEzT2pMaURwcU9XNUxpNThsR1lWQ09yeUQxUkg4N3FyZUZ3SEpGbzhJ?=
=?utf-8?B?YnB1K3BPRFkrQ1Ixbk9sUDREbTUzeVpBYlRuUXdsTFM4NEZMeUx3R09lRjFj?=
=?utf-8?B?bllPcS80azYzZE9CREdoWDFMeCtMWGMxN3d3ajJ6YTNWVTVtZ3duTW9IRlNQ?=
=?utf-8?B?ZVI2QVBlT1lNTXdpY2UwQlEyWHlHWXk0bkZtQWJFUUQvYTRzbHczOHdJVm9v?=
=?utf-8?B?cGY1ZzYvNDR1RCtCQ3kxeHRGVUtzcTFwOHFHdm9MNHJwWmczUmlteUM4U2RZ?=
=?utf-8?B?MXg0MDA0ZU14eXhkYW0rWDg1bHVwRks1cEdPLzh1RGFDZVhjb2NpSUhYZ2dY?=
=?utf-8?B?NS9VSnpWbmJzdWVXODI2SWp3eHdhZ201MDRhRVZMaXBUTVk0QmhmK2tpUHV2?=
=?utf-8?B?Z3VJOENNTGFDQW9yOCtFT01WVFcvcWw5dWZ3RFJZLzRhMmFyNjNZSW5iTmQ5?=
=?utf-8?B?LzcrMXpla1dKMkFLT01NMWxKUFJCY2R2R01OR25tT2ZKb3J1R2JJZEZ3RnNK?=
=?utf-8?B?dk9pd3NiRmZYd2dQNDZtYkhxZ29UMjRwMFpXeXRZZ1loSXpicFg5M0xEUFFU?=
=?utf-8?B?ZjlvTkFlZnZ3TFFiYytnRFMwSERLWVdJdWZqbm91a0NiOUFIcU5IMGFRMlRq?=
=?utf-8?B?YlA0Q25rV1M2YU1BUjNyMFRRS2NWVURRY3hnRkkvTGlrbWdQSXUvdlpJdjln?=
=?utf-8?B?UjJOOU1zZVJyYU5OUWp2MU9KSjBsNUxaeSs0U1FwbGUrRko5MStjSFpLcWNC?=
=?utf-8?B?eitCak4xTnBqRGdzZ0xCL0VocjVBVVFRPT0=?=
X-Forefront-Antispam-Report:
CIP:64.207.219.71;CTRY:US;LANG:en;SCL:8;SRV:;IPV:NLI;SFV:SPM;H:mailch.docusign.net;PTR:mailch.docusign.net;CAT:OSPM;SFS:(13230040)(1032899013)(35002699018)(3033299015);DIR:OUT;SFP:1501;
X-Auto-Response-Suppress: DR, OOF, AutoReply
X-OriginatorOrg: xoxomor.store
X-MS-Exchange-CrossTenant-Network-Message-Id: 6a6f8d37-8600-4865-ff6c-08dd453b9237
X-MS-Exchange-CrossTenant-Id: d3569ad0-d051-4957-8326-dcaa2181d333
X-MS-Exchange-CrossTenant-AuthSource: DU2PEPF00028D04.eurprd03.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Feb 2025 16:47:47.9544
(UTC)
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: qf9vsyJUelDKxIQ4XpD1OGLCNaCUYM2iM4DyAI14VhWndw5wpTq1aRCUALrvWJYyMrJZeoc5xxJFb2ThYkG6RYvB2hNOqOtn/PQa59L5GTrDDk0j8Pb5LPZU8V5LifQ7gJQNLZtjfNisK/RTWPQoNgWb5srb4c5ANyoVVAw474Yp1lXsmT7rLk0KiKVTiqS67/gLH9XtJPeQcNZ+UvMLlvRNl7lOsJ9s3lKySLs1f4Y=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DUZPR04MB9745
X-Spam_score: 6.2
X-Spam_score_int: 62
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hello Dear Customer, Billing Team has sent you a new Docusign
document to view and sign. Please click on the link below to begin signing.
We have observed an attempt to charge $649.89 to your PayPal account for
the purchase of 0.0066 Bitcoin. To safeguard your account, this transaction,
which came from an unidentified IP address in Texa [...]
Content analysis details: (6.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[64.207.219.71 listed in will-spam-for-food.eu.org]
[64.207.219.71 listed in will-spam-for-food.eu.org]
[64.207.219.71 listed in will-spam-for-food.eu.org]
[64.207.219.71 listed in will-spam-for-food.eu.org]
[64.207.219.71 listed in will-spam-for-food.eu.org]
[64.207.219.71 listed in will-spam-for-food.eu.org]
[64.207.219.71 listed in will-spam-for-food.eu.org]
[64.207.219.71 listed in will-spam-for-food.eu.org]
[2603:10a6:10:4bd:cafe:0:0:4b listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:4bd:cafe:0:0:4b listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:4bd:cafe:0:0:4b listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:4bd:cafe:0:0:4b listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:4bd:cafe:0:0:4b listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:4bd:cafe:0:0:4b listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:4bd:cafe:0:0:4b listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:4bd:cafe:0:0:4b listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:4bd:0:0:0:13 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:4bd:0:0:0:13 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:4bd:0:0:0:13 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:4bd:0:0:0:13 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:4bd:0:0:0:13 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:4bd:0:0:0:13 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:4bd:0:0:0:13 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:4bd:0:0:0:13 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:2f4:0:0:0:8 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:2f4:0:0:0:8 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:2f4:0:0:0:8 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:2f4:0:0:0:8 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:2f4:0:0:0:8 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:2f4:0:0:0:8 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:2f4:0:0:0:8 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:10:2f4:0:0:0:8 listed in]
[will-spam-for-food.eu.org]
[52.100.174.201 listed in will-spam-for-food.eu.org]
[52.100.174.201 listed in will-spam-for-food.eu.org]
[52.100.174.201 listed in will-spam-for-food.eu.org]
[52.100.174.201 listed in will-spam-for-food.eu.org]
[52.100.174.201 listed in will-spam-for-food.eu.org]
[52.100.174.201 listed in will-spam-for-food.eu.org]
[52.100.174.201 listed in will-spam-for-food.eu.org]
[52.100.174.201 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[52.100.174.201 listed in dnsbl.ahbl.org]
[52.100.174.201 listed in dnsbl.ahbl.org]
[52.100.174.201 listed in dnsbl.ahbl.org]
[52.100.174.201 listed in dnsbl.ahbl.org]
[2603:10a6:10:2f4:0:0:0:8 listed in]
[dnsbl.ahbl.org]
[2603:10a6:10:2f4:0:0:0:8 listed in]
[dnsbl.ahbl.org]
[2603:10a6:10:2f4:0:0:0:8 listed in]
[dnsbl.ahbl.org]
[2603:10a6:10:2f4:0:0:0:8 listed in]
[dnsbl.ahbl.org]
[2603:10a6:10:4bd:0:0:0:13 listed in]
[dnsbl.ahbl.org]
[2603:10a6:10:4bd:0:0:0:13 listed in]
[dnsbl.ahbl.org]
[2603:10a6:10:4bd:0:0:0:13 listed in]
[dnsbl.ahbl.org]
[2603:10a6:10:4bd:0:0:0:13 listed in]
[dnsbl.ahbl.org]
[2603:10a6:10:4bd:cafe:0:0:4b listed in]
[dnsbl.ahbl.org]
[2603:10a6:10:4bd:cafe:0:0:4b listed in]
[dnsbl.ahbl.org]
[2603:10a6:10:4bd:cafe:0:0:4b listed in]
[dnsbl.ahbl.org]
[2603:10a6:10:4bd:cafe:0:0:4b listed in]
[dnsbl.ahbl.org]
[64.207.219.71 listed in dnsbl.ahbl.org]
[64.207.219.71 listed in dnsbl.ahbl.org]
[64.207.219.71 listed in dnsbl.ahbl.org]
[64.207.219.71 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[52.100.174.201 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[52.100.174.201 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[52.100.174.201 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[52.100.174.201 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[52.100.174.201 listed in list.dnswl.org]
0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The
query to Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[52.100.174.201 listed in sa-trusted.bondedsender.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[52.100.174.201 listed in sa-accredit.habeas.com]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[52.100.174.201 listed in wl.mailspike.net]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[52.100.174.201 listed in bl.score.senderscore.com]
0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[52.100.174.201 listed in bl.score.senderscore.com]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
0.0 ARC_SIGNED Message has a ARC signature
0.0 ARC_VALID Message has a valid ARC signature
0.0 AXB_X_FF_SEZ_S Forefront sez this is spam
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[tube_x159(at)yopmail.com]
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
0.3 LONGWORD BODY: Uses overlong words
0.1 TW_MZ BODY: Odd Letter Triples with MZ
0.6 MEGALONGWORD BODY: Uses really overlong words
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 NO_RDNS2 Sending MTA has no reverse DNS
1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 T_REMOTE_IMAGE Message contains an external image
Subject: {SPAM?} Notification From PayPal
------=_NextPart_20F58451_E956_4B14_AC54_0FD24090E013
Content-type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Hello Dear Customer,
Billing Team has sent you a new Docusign document to view and sign=2E P=
lease click on the link below to begin signing=2E
We have observed an attempt to charge $649=2E89 to your PayPal account =
for the purchase of 0=2E0066 Bitcoin=2E To safeguard your account, this=
transaction, which came from an unidentified IP address in Texas, has =
been temporarily blocked=2E=20
You Must Do
Please get in touch with us right away to prevent further action if you=
did not approve this transaction=2E=20
The Way to Get in Touch with Us=20
PayPal Resolution Center=F0=9F=93=9E 24/7 Toll-Free Help: +1 (877) 513-=
3656
To see more information, click "REVIEW NOW=2E"=20
Details of the Transaction: Bitcoin (0=2E0066BTC)=20
The total amount charged was $649=2E89=2E=20
Date of Transaction: February4, 2025;
Invoice ID: RRY-70003691
Subsequent Activities=20
To dispute or immediately cancel an unauthorized charge, call +1 (877) =
513-3656=2E=20
If authorized: Nothing needs to be done=2E=20
We Put Your Security First=2E=20
Remember that PayPal will never ask for=20
Thank you for choosing PayPal=2E
PayPal Security Team
=C2=A9 1999-2025 PayPal, Inc=2E All rights reserved=2E
=20
REVIEW DOCUMENT
https://na4=2Edocusign=2Enet/Signing/EmailStart=2Easpx?a=3D94f28582-c8a=
9-40c3-a0ce-e359990dd2bc&etti=3D24&acct=3D7f6da93a-04a2-4c1b-8459-ecf6d=
596c013&er=3D43f9166e-7983-42c3-befb-0e3eda06de91
If clicking the link does not work, you can highlight and copy the enti=
re line above and paste it into your browser to get started=2E
This message was sent to you by Billing Team who is using the Docusign =
Electronic Signature Service=2E If you would rather not receive email f=
rom this sender you may contact the sender with your request=2E
Do Not Share This Email
This email contains a secure link to Docusign=2E Please do not share th=
is email, link, or access code with others=2E
Questions about the Document?
If you need to modify the document or have questions about the details =
in the document, please reach out to the sender by emailing them direct=
ly=2E
Stop receiving this email
Report this email https://protect=2Edocusign=2Enet/report-abuse?e=3DAUt=
omjpFak9GlbPL0zFFi111xlVFj293S2wijW3WyMfmxf_gbh4Vyk6vAfOTSp0CYiZb6YerQH=
Ej4t9mKZiNsYBDbqYDEH474ljpLedLxQbk5SvMFk2cskTuGCL4qA0p4Y3AbGq756izIOcKg=
Vf21Yf8PRUtsfwfeu2Xa44st_94lBo3WzcjYJ954iittV9Nkblelhoygf412P59E8KRSo3U=
lfPgD02lg7oMd1EhOK9N0VA25DhoEDVjgk3JI41lkyb9QPuDY33qKVGfdw68O0ej9DS7tzz=
-v4dv6uqlcKSuH0YEfHzxSGHTK5zFhGQyULyPCjt-mzsGc5Al7-WsFzRp8RdNvO73UuN1Ea=
9letB8Y7aEqzKIdTlhInVyIhBUy-y3K1EhwNq6lu_w-xM9tiysdDFN63TKKQlCuHCbKCuNd=
UFtGZ8sHBF6bUGLcWnZUg&lang=3Den
Declining to sign=20
Managing notifications=20
If you have trouble signing, visit "How to Sign a Document" on our Docu=
sign Support Center, or browse our Docusign Community for more informat=
ion=2E
https://support=2Edocusign=2Ecom/s/articles/How-do-I-sign-a-DocuSign-do=
cument-Basic-Signing?language=3Den_US&utm_campaign=3DGBL_XX_DBU_UPS=
_2211_SignNotificationEmailFooter&utm_medium=3Dproduct&utm_sour=
ce=3Dpostsend
------=_NextPart_20F58451_E956_4B14_AC54_0FD24090E013
Content-type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable
xt/html; charset=3DUTF-8"/>
cale=3D1=2E0"/>
o"/>
olor:#EAEAEA;padding:2%;font-family:Helvetica,Arial,Sans Serif;">
role=3D'presentation' border=3D'0' cellspacing=3D'0' cellpadding=3D'0'=
align=3D'center' width=3D"100%" dir=3D"">
">
rspace:0pt;border-collapse:collapse;background-color:#ffffff;max-width:=
640px;">
" width=3D"116" src=3D"https://docucdn-a=2Eakamaihd=2Enet/olive/images/=
2=2E62=2E0/global-assets/email-templates/email-logo=2Epng" alt=3D"DocuS=
ign"/>
le=3D'presentation' border=3D'0' cellspacing=3D'0' cellpadding=3D'0' wi=
dth=3D'100%' align=3D'center' style=3D'background-color:#260559;color:#=
FFFFFF;'>
;background-color:#260559;color:#FFFFFF;font-size:16px;font-family:Helv=
etica,Arial,Sans Serif;width:100%;text-align:center;" align=3D"center">=
et/olive/images/2=2E76=2E0/email/iconSignWhite=2Epng" style=3D"width:75=
px;height:75px;" alt=3D"" />
ellspacing=3D'0' cellpadding=3D'0' width=3D'100%'>
ing-top:24px;font-size:16px;font-family:Helvetica,Arial,Sans Serif;bord=
er:none;text-align:center;color:#FFFFFF" align=3D"center"> Billing Team=
sent you a document to review and sign=2E
e=3D'presentation' border=3D'0' cellspacing=3D'0' cellpadding=3D'0' wid=
th=3D'100%'>
<=
table cellspacing=3D"0" cellpadding=3D"0">
ht=3D"44" style=3D"font-size:15px;color:#FFFFFF;background-color:#735AF=
F;font-family:Helvetica,Arial,Sans Serif;font-weight:bold;text-align:ce=
nter;text-decoration:none;;border-radius:2px;background-color:#735AFF;;=
display: block;">
tart=2Easpx?a=3D94f28582-c8a9-40c3-a0ce-e359990dd2bc&etti=3D24&acct=3D7=
f6da93a-04a2-4c1b-8459-ecf6d596c013&er=3D43f9166e-7983-42c3-befb-0e3eda=
06de91" style=3D"font-size:15px;color:#FFFFFF;background-color:#735AFF;=
font-family:Helvetica,Arial,Sans Serif;font-weight:bold;text-align:cent=
er;text-decoration:none;;border-radius:2px;background-color:#735AFF;;di=
splay:inline-block">
> REVIEW D=
OCUMENT
span>
table cellspacing=3D"0" cellpadding=3D"0">
ht=3D"44" style=3D"font-size:15px;color:#FFFFFF;background-color:#735AF=
F;font-family:Helvetica,Arial,Sans Serif;font-weight:bold;text-align:ce=
nter;text-decoration:none;;border-radius:2px;background-color:#735AFF;;=
display: block;">
tart=2Easpx?a=3D94f28582-c8a9-40c3-a0ce-e359990dd2bc&etti=3D24&acct=3D7=
f6da93a-04a2-4c1b-8459-ecf6d596c013&er=3D43f9166e-7983-42c3-befb-0e3eda=
06de91" style=3D"font-size:15px;color:#FFFFFF;background-color:#735AFF;=
font-family:Helvetica,Arial,Sans Serif;font-weight:bold;text-align:cent=
er;text-decoration:none;;border-radius:2px;background-color:#735AFF;;di=
splay:inline-block">
> REVIEW D=
OCUMENT
span>
td>
size:16px;font-family:Helvetica,Arial,Sans Serif;background-color:white=
;">
ing=3D'0'>
g style=3D"height:40px;width:40px;border-radius:2px;" height=3D"40" wid=
th=3D"40" src=3D"https://NA4=2Edocusign=2Enet/Member/image=2Easpx?i=3Dl=
ogo&l=3D2aebca2c-affc-4564-bd6a-2ddf4a5caf6b" alt=3D"Picture of Billing=
Team" />
ily:Helvetica,Arial,Sans Serif;font-weight:bold;line-height:18px;font-s=
ize:15px;color:#333333;"> Billing Team
Helvetica,Arial,Sans Serif;line-height:18px;font-size:15px;color:#66666=
6;">tube_x159@yopmail=2Ecom
size:15px;color:#333333;font-family:Helvetica,Arial,Sans Serif;line-hei=
ght:20px;">We have observed an attempt to charge $649=2E89 to your PayP=
al account for the purchase of 0=2E0066 Bitcoin=2E To safeguard your ac=
count, this transaction, which came from an unidentified IP address in =
Texas, has been temporarily blocked=2E
You Must Do
Plea=
se get in touch with us right away to prevent further action if you did=
not approve this transaction=2E
The Way to Get in Touc=
h with Us
PayPal Resolution Center=F0=9F=93=9E 24/7 Toll-Free Hel=
p: +1 (877) 513-3656
To see more information, click "REVIEW NOW=2E=
"
Details of the Transaction: Bitcoin (0=2E0066BTC)
Th=
e total amount charged was $649=2E89=2E
Date of Transaction: Febr=
uary4, 2025;
Invoice ID: RRY-70003691
Subsequent Activit=
ies
To dispute or immediately cancel an unauthorized charge, call=
+1 (877) 513-3656=2E
If authorized: Nothing needs to be done=2E =
We Put Your Security First=2E
Remember that PayPal wil=
l never ask for
Thank you for choosing PayPal=2E
PayPal=
Security Team
=C2=A9 1999-2025 PayPal, Inc=2E All rights reserved=
=2E
24px;background-color:#ffffff;font-family:Helvetica,Arial,Sans Serif;fo=
nt-size:11px;color:#666666;">
px 45px 24px;background-color:#EAEAEA;">
ont-family:Helvetica,Arial,Sans Serif;font-size:13px;color:#666666;line=
-height:18px;">Do Not Share This E=
This email contains a secure link to Docusign=2E Please d=
o not share this email, link, or access code with others=2E
style=3D"margin-bottom:1em;font-family:Helvetica,Arial,Sans Serif;font-=
size:13px;color:#666666;line-height:18px;">
heading">Alternate Signing Method
Visit Docusign=2Ecom, click =
'Access Documents', and enter the security code:
94F28582C8A940C3=
A0CEE359990DD2BC7
ca,Arial,Sans Serif;font-size:13px;color:#666666;line-height:18px;">
aria-level=3D"3" role=3D"heading">About Docusign
Sign document=
s electronically in just minutes=2E It's safe, secure, and legally bind=
ing=2E Whether you're in an office, at home, on-the-go -- or even acros=
s the globe -- Docusign provides a professional trusted solution for Di=
gital Transaction Management=E2=84=A2=2E
1em;font-family:Helvetica,Arial,Sans Serif;font-size:13px;color:#666666=
;line-height:18px;">Questions abou=
t the Document?
If you need to modify the document or have qu=
estions about the details in the document, please reach out to the send=
er by emailing them directly=2E
heading">Stop receiving this email
docusign=2Enet/report-abuse?e=3DAUtomjpFak9GlbPL0zFFi111xlVFj293S2wijW3=
WyMfmxf_gbh4Vyk6vAfOTSp0CYiZb6YerQHEj4t9mKZiNsYBDbqYDEH474ljpLedLxQbk5S=
vMFk2cskTuGCL4qA0p4Y3AbGq756izIOcKgVf21Yf8PRUtsfwfeu2Xa44st_94lBo3WzcjY=
J954iittV9Nkblelhoygf412P59E8KRSo3UlfPgD02lg7oMd1EhOK9N0VA25DhoEDVjgk3J=
I41lkyb9QPuDY33qKVGfdw68O0ej9DS7tzz-v4dv6uqlcKSuH0YEfHzxSGHTK5zFhGQyULy=
PCjt-mzsGc5Al7-WsFzRp8RdNvO73UuN1Ea9letB8Y7aEqzKIdTlhInVyIhBUy-y3K1EhwN=
q6lu_w-xM9tiysdDFN63TKKQlCuHCbKCuNdUFtGZ8sHBF6bUGLcWnZUg&lang=3Den' sty=
le=3D'color:#2463d1;' >Report this email or read more about
=3D'https://support=2Edocusign=2Ecom/en/guides/Declining-to-sign-DocuSi=
gn-Signer-Guide' style=3D'color:#2463d1;' >Declining to sign and
href=3D'https://support=2Edocusign=2Ecom/en/articles/How-do-I-manage-m=
y-email-notifications' style=3D'color:#2463d1;' >Managing notifications=
=2E
If you have trouble signing, visit "
s://support=2Edocusign=2Ecom/s/articles/How-do-I-sign-a-DocuSign-docume=
nt-Basic-Signing?language=3Den_US&utm_campaign=3DGBL_XX_DBU_UPS_221=
1_SignNotificationEmailFooter&utm_medium=3Dproduct&utm_source=3D=
postsend' style=3D'color:#2463d1;' >How to Sign a Document" on our =
>Docusign Support Center, or browse our
y=2Edocusign=2Ecom/esignature-111?utm_campaign=3DGBL_US_PRD_AWA_2405_Co=
mmunityCTA&utm_medium=3Demail&utm_source=3Dpostsend' style=3D'c=
olor:#2463d1;' >Docusign Community for more information=2E
/>
erif;font-size:13px;color:#666666;line-height:18px;">
/www=2Edocusign=2Ecom/features-and-benefits/mobile?utm_campaign=3DGBL_X=
X_DBU_UPS_2211_SignNotificationEmailFooter&utm_medium=3Dproduct&=
;utm_source=3Dpostsend" style=3D"color:#2463d1;" >
right:7px;border:none;vertical-align:middle;" width=3D"18" height=3D"18=
" src=3D"https://docucdn-a=2Eakamaihd=2Enet/olive/images/2=2E62=2E0/glo=
bal-assets/email-templates/icon-download-app=2Epng" alt=3D"" />Download=
the Docusign App
vetica,Arial,Sans Serif;font-size:13px;color:#666666;line-height:18px;f=
ont-size:10px;line-height:14px;">This message was sent to you by Billin=
g Team who is using the Docusign Electronic Signature Service=2E If you=
would rather not receive email from this sender you may contact the se=
nder with your request=2E
le><=
meta itemprop=3D"text" content=3D"Billing Team sent you a document to r=
eview and sign=2E"/>
"http://schema=2Eorg/CreativeWork">
ion" itemtype=3D"http://schema=2Eorg/ViewAction">
content=3D"https://na4=2Edocusign=2Enet/Signing/EmailStart=2Easpx?a=3D=
94f28582-c8a9-40c3-a0ce-e359990dd2bc&etti=3D24&acct=3D7f6da93a-04a2-4c1=
b-8459-ecf6d596c013&er=3D43f9166e-7983-42c3-befb-0e3eda06de91"/>
temprop=3D"name" content=3D"View Documents"/>
y>
------=_NextPart_20F58451_E956_4B14_AC54_0FD24090E013--