Detects inbound messages that impersonate Zoho Sign document-signing notifications by presenting a legitimate-looking guest signing link and forged thread references, yet lacking a valid Zoho DKIM signature. The rule triggers when the message body (current_thread) contains the phrase “automated email from Zoho Sign” and includes at least one http/https link that is not the Zoho report-abuse footer. It further ensures the message did not originate from Zoho’s sending infrastructure by checking the Received headers against known third-party relays, using a regex to identify disallowed relay sources (e.g., transmail.net, zeptomail variants, zohomail360 subdomains). To reduce false positives, highly trusted domains that pass DMARC are excluded. This combination of content analysis, URL validation, and sender/trace analysis targets credential phishing and business email compromise (BEC) schemes where attackers mimic Zoho Sign to prompt recipients to sign fraudulent documents. The rule is designed for email security gateways or inbox protection layers that process inbound messages and inspect headers, threads, and links to identify impersonation attempts.