Fake DocuSign "document waiting for signature" or "envelope expires today" notice sent from a non-DocuSign domain — credential-harvest cross-domain phish; signature requests are a low-suspicion lure that masks fake login portals. Real DocuSign mail originates from docusign.net / docusign.com only.
docusign-signature-cross-domain
What this tier means
Warning signal — bulk / marketing / mild spam. Contributes to the trash score but is not by itself sufficient.
How Gorganizer detects this
Fake DocuSign "document waiting for signature", "envelope expires today", or "completed document available" notice sent from a non-DocuSign sending domain (From / Reply-To / link domains do not align with docusign.net / docusign.com / docusign.com.au) directing the recipient to a "review and sign" link — credential-harvest cross-domain phish that masquerades as a routine business signature request. Real DocuSign communications originate exclusively from docusign.net or docusign.com with DMARC-aligned signing; "review document" links always terminate at docusign.net, never at third-party domains. Signature-request lures bypass normal suspicion because employees expect contracts and NDAs via DocuSign — the cross-domain mismatch is the defining tell. Distinct from generic e-signature-phish — this targets the DocuSign brand / envelope-waiting / cross-domain From-link mismatch pretext. Detection: DocuSign brand vocabulary (document waiting for signature, envelope expires, review and sign) + sender or link domain ≠ docusign.net / docusign.com + no DMARC alignment. Trash score: +5. Source: GC1-R31; APWG DocuSign phishing report 2025; DocuSign anti-phishing guidance; FBI IC3 e-signature impersonation alert.
False-positive guard
Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a warning-tier signal — bulk / marketing / mild spam. It contributes to the trash score but never triggers deletion on its own. Gorganizer requires multiple signals + a margin over the safety floor before any email is moved to trash.
About the scoring engine
Gorganizer's scoring engine emits over 1,800 signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.
Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.
Ready to clean your inbox?
Gorganizer scans your Gmail with this signal and 1,800+ others, then cleans everything in one click. $4.99 one-time, no subscription.
Get started