Spam Warning: You received notification from DocuSign Signature Service

by sircles on Aug 07, 2018 in Internet Security, Fraud, Online Fraud, SPAM, Phishing, Spam List Building
Spam Warning: You received notification from DocuSign Signature Service   

Spam Warning: You received notification from DocuSign Signature Service 

 

You may see the following email, purportedly from DocuSign. We have seen it being captured by most spam guards but also getting through many on other occasions.

 

 

 

 

From:                                                       DocuSign Signature  Service <[email protected]>

Sent:                                                        Monday, August 6, 2018 5:21 PM

To:                                                           Recipient

Subject:                                                   You received notification from DocuSign Signature Service

 

 

 

 

 

 

DocuSign

Review and sign this document.

 

Dear Receiver,

Please review this invoice
It is an automatically generated invoice.
 

This email contains a secure information. Do not share this code with other people.

Additional Signing Way
Please visit DocuSign.com, click on 'Access Documents', and enter the security code: F80B75BEF7

About Our Service
Sign invoice electronically in just minutes. It's risk-free. Whether you're at work, home or even across the globe -- Our service gives a professional solution for Digital Transaction Management.

Have questions about an Invoice?
In case you need to modify the document or have questions about the details in the document, reach out to the sender directly.

If you are having trouble signing the document, please see the Help with Signing page on our Webpage .
 

Review Invoice

This message was sent to you by DocuSign Electronic Signature Service.

 

 

 The 'view invoice' link actually points at: http://keithharenda.com?6d50=YourEmailAddressEncoded which is an unsecured site which appears to have been compromised.
The folder appears to have already been removed.
We have also seen: http://nashvillechildfamilywellness.com?20Yy5=YourEmailAddressEncoded being used by the same email.
The 'review invoice' link at the bottom points to: http://kphbuilds.com?7P62A=YourEmailAddressEncoded which also appears to have been shut down.
 
Report any senders of this email, the pehache.com domain does not seem to function either, but it will track your email if you click the link because you are sending your email address in a coded format to them, which is what the string is at the end of the link.

Add comment