Odd email - query spam

I received two emails this morning which I am pretty sure are scams. However they are genuine enough looking to make me think.
One is from Shared-Documents via SharePoint | My domain name <sharepointmyname@edocs.com>
The other is the same content but from DocuSign-Account | My domain name<sharefile-myname@edocs.com>

I have no financial or legal transactions pending, though have had some from my bank a few weeks ago that used similar system.
Hovering over Review document shows https: *//t.co/and a string of letters and numbers (My asterisk)
Header is
ARC-Seal: i=1; cv=none; a=rsa-sha256; d=********; s=default;
t=1729740559;
b=fWk9VuhJTBrHbS6PAsxbS456OPAx2Q2fNc0uYtO2P9pL2TO6mBCjUzatS2SKRyKA8iyie
xgHibU/K11YPEX3xLDIZg/c23UyQQSSj20T7K7U57jKHXfxcyItf39X/xrpH2OFkn46bmNM
NZJbXKr0vDgp6IJnHPzlXRiPoq+ZZB8=
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed;
d=*******; s=default; t=1729740559; h=from : to : subject : date
: message-id : mime-version : content-type : content-transfer-encoding
: from; bh=Dl91aeOZr6BuSx0ujOOLEolWacFnm/EL0b4W8XMVtyw=;
b=qKenenM8kHrNlaL0iGLBEGAb5EvmdSlzXy/rE6MKIZcJhWIWWB4yXEPimgmgjiFYPRpK/
QpVC1fP+M+t3XJmLkm3g4+OK9ix4N4p6Hb14HFv0+hE/wSH7fDwX9AcmHHkHEwZya+1nEEh
wlP/fQCmRpieChH62E+zc0+l+N23RQM=
ARC-Authentication-Results: i=1; ynh4.uk.easy-server.com;
dmarc=none smtp.from=edocs.com header.from=edocs.com;
spf=none smtp.mailfrom=sharepoint********@edocs.com smtp.helo=edocs.com
Return-Path: <sharepointi********@edocs.com>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
ynh4.uk.easy-server.com
X-Spam-Level: *
X-Spam-Status: No, score=1.4 required=4.0 tests=HTML_FONT_SIZE_LARGE,
HTML_MESSAGE,MIME_HTML_ONLY,RCVD_IN_MSPIKE_BL,RCVD_IN_MSPIKE_L5,
RCVD_IN_VALIDITY_RPBL_BLOCKED,RCVD_IN_VALIDITY_SAFE_BLOCKED,RDNS_NONE,
SPF_HELO_NONE,SPF_NONE,TO_NO_BRKTS_NORDNS_HTML,URIBL_BLOCKED autolearn=no
autolearn_force=no version=3.4.0
X-Original-To: *****************
Delivered-To: *****************
Received: from edocs.com (unknown [201.218.200.106])
by ynh4.uk.easy-server.com (Postfix) with ESMTP id 8EBDFA0FA0
for <*****************>; Thu, 24 Oct 2024 04:29:17 +0100 (BST)
Authentication-Results: ynh4.uk.easy-server.com;
dmarc=none (p=NONE sp=NONE) smtp.from=edocs.com header.from=edocs.com;
spf=none (sender IP is 201.218.200.106) smtp.mailfrom=sharepointimcandrew@edocs.com smtp.helo=edocs.com
Received-SPF: none (ynh4.uk.easy-server.com: no valid SPF record)
From: "Shared-Documents via SharePoint | stbees.org.uk" <sharepointimcandrew@edocs.com>
To: **************
Subject: DocuSign Important received a New Secured Document ************** 10/23/2024
Date: 23 Oct 2024 22:29:16 -0500
Message-ID: <20241023222915.7EC4B503766BA989@edocs.com>
MIME-Version: 1.0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

The screen grab is attached.

Sigurd said:

edocs.com

Click to expand...

I can’t load that domain.

The subject of one “DocuSign Important received a New Secured Document”
Screams scam.

Sigurd said:

smtp.mailfrom=sharepointimcandrew @ edocs.com

Click to expand...

lol

Do you have 5 min? You want me to connect right now and check the emails out?

Probably not necessary though: I’m calling it dangerous scam spam.

Good job posting the Header info, Ian

Unless I know the sender I'll just delete any email without even opening it -- if the message is a genuine message and important enough the sender will communicate again soon enough via a more recogniseable message.

Cheers
jimbo

So are you expecting any financial statements and documents about cash flow??

idgat said:

So are you expecting any financial statements and documents about cash flow??

Click to expand...

Not unless some rich relative I don't know has left me something in his will.

antspants said:

Do you have 5 min? You want me to connect right now and check the emails out?

Probably not necessary though: I’m calling it dangerous scam spam.

Click to expand...

Agree - not necessary. Zapping it!

Thanks all.

Sigurd said:

Not unless some rich relative I don't know has left me something in his will.

Agree - not necessary. Zapping it!

Thanks all.

Click to expand...

If that were the case I'd bet your phone would be in the old parlance "be ringing off the hook". !!

Cheers
jimbo

You might register at spamcop and start a report there.
After inserting the suspected code of the email, you get an analysis of the email.
They search the email-code for tricks in the adresses and report the analysis-result to you.
If you would want to report the email to spamcop and possibly other adresses, it will be mentioned where they send it to (you can choose them as well). But you don't need to report the mail, you just can only use it for analyzing purposes.

When you indeed report the email, all personal data will be anonymized!

That's how I do it, when I get emails that look suspicious but might be real.

idgat said:

So are you expecting any financial statements and documents about cash flow??

Click to expand...

Sigurd said:

Not unless some rich relative I don't know has left me something in his will.

Click to expand...

Not that that domain anyway. It’s all a scam.

Docusigns domains is

docusign.com

Dmarc=none in the header is enough to tell me this was not sent by any reputable company.

People can post onto your Google drive and bypass emails spam traps. I guess the same can happen with SharePoint?