drop docusign envelope history · parse signer events + ip + timestamps · runs locally
flags signing after completion · ip/geo churn hints · void after partial sign · unusual routing order · recipient emails domain-retained
heuristic screener · geo hints require country metadata in export · recipient local-part masked · not definitive proof