BDR email lure tests: Attachment & URL analysis

For each card: select everything inside the dashed box, copy it, and paste it into a Gmail compose window (links stay live). Copy the subject, attach the named file from this folder if one is listed, and send from an account outside your organisation. Do not click the links: they point to a reserved test IP and made-up domains.

1 · DocuSign lure · Subject: Completed: Q3 Payroll Adjustment – Please Review

Hello,

Your document has been completed and is ready for review.

Review Document

Document: Q3_Payroll_Adjustment.pdf
This link expires in 24 hours.

DocuSign Electronic Signature Service

Expect: high, "IP-literal link"

2 · Microsoft 365 password expiry · Subject: Action Required: Your mailbox password expires today

Dear user,

The password for your Microsoft 365 account expires today. To keep using your current password, confirm it below.

Keep current password

Failure to act will lock your mailbox within 12 hours.
IT Service Desk

Expect: high, "credential page on a high-abuse TLD"

3 · PayPal unusual sign-in · Subject: Unusual sign-in activity on your account

We noticed a sign-in from a new device (Windows, Lagos, NG).
If this wasn't you, secure your account now:

www.paypal.com/myaccount

PayPal Security Team

Expect: high, link text shows paypal.com but goes to paypal-resolution.top

4 · Invoice with macro document · Subject: RE: Overdue invoice INV-20931 · Attach: INV-20931.docm

Hi,

Please find attached the overdue invoice. Kindly process payment by end of day. Enable editing to view the content.

Regards,
Accounts Receivable

Expect: high, "macro-enabled Office document" + sandbox result if Docker is running

5 · DHL delivery lure · Subject: DHL Express: Delivery attempt failed – AWB 7731 · Attach: DHL_AWB_7731.pdf.reg

We were unable to deliver your parcel. Open the attached airway bill to reschedule delivery.

DHL Express Customer Service

Expect: critical, "dangerous executable type". If Gmail refuses the .reg file, skip this one.

6 · Fake login page plus bad link · Subject: Payment remittance advice · Attach: Payment_Remittance.html

Please find the remittance advice attached. If it does not open, view it online:

View remittance

Expect: high (the .click login link). The HTML file alone is low risk and would not be flagged by itself.

7 · Should NOT be flagged · Subject: slides from today · Attach: photos.zip

Hi, slides from today's meeting: slides. Photos attached.

Expect: no attachment-url-analysis finding (a short link and a zip alone are low risk)