Questtrade Phish
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 24 Feb 2026 05:52:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1vurtA-000000002Q8-1NSU
for dave@doctor.nl2k.ab.ca;
Tue, 24 Feb 2026 05:51:44 -0700
Resent-From: The Doctor
Resent-Date: Tue, 24 Feb 2026 05:51:44 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail4.jurnalminang.com ([34.130.103.215]:40602)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1vuqDx-000000003LL-2EfZ
for root@nk.ca;
Tue, 24 Feb 2026 04:05:13 -0700
Authentication-Results: mail4.jurnalminang.com;
auth=pass (login)
From: =?utf-8?B?bm8tcmVwbHk=?=
To: =?utf-8?B?cm9vdEBuay5jYQ==?=
Subject: =?utf-8?B?UXVlc3RyYWRlOiBZb3VyIFctOEJFTiBGb3JtIEhhcyBFeHBp?=
=?utf-8?B?cmVk?=
Date: Tue, 24 Feb 2026 11:04:15 +0000
Message-ID:
MIME-Version: 1.0
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: base64
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0)
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
Received: from localhost (Unknown [127.0.0.1])
by mail4.jurnalminang.com (Haraka) with ESMTPSA id 942B2463-E89B-498A-A371-E8647B3063FE.1
envelope-from
tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (authenticated bits=0);
Tue, 24 Feb 2026 11:04:15 +0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=mail4.jurnalminang.com; h=Content-Transfer-Encoding: Content-Type:
MIME-Version: Message-ID: Date: Subject: To: From; q=dns/txt;
s=s20260223160; t=1771931056;
bh=yEyby3yHSY/3KEEgFdjeJHYaTS+gudE3iWsHIKh2rt0=;
b=j0JpLH3j9lYMv6TwJ0oAuvABXjdHL0lKbpASPrDa1fkDw49ccR/NGeKJGjYw+LSGOfPxQLhf7
WCsrwPDla6SHJPR7OB0ObzGi2oJNdOiWCdEbnMAYfQnqvQVfIic/x6uvMXHEFkso/oIlQkX154b
Q8ZXgXHdycdBQOR3oSV+jDg=
X-Spam_score: 6.3
X-Spam_score_int: 63
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Confirmation of Tax Form Expiration – W-8BEN Renewal Required
for 2026 Dear Questrade Client,
Content analysis details: (6.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[34.130.103.215 listed in dnsbl.ahbl.org]
[34.130.103.215 listed in dnsbl.ahbl.org]
[34.130.103.215 listed in dnsbl.ahbl.org]
[34.130.103.215 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[34.130.103.215 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[34.130.103.215 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[34.130.103.215 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[34.130.103.215 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[34.130.103.215 listed in will-spam-for-food.eu.org]
[34.130.103.215 listed in will-spam-for-food.eu.org]
[34.130.103.215 listed in will-spam-for-food.eu.org]
[34.130.103.215 listed in will-spam-for-food.eu.org]
[34.130.103.215 listed in will-spam-for-food.eu.org]
[34.130.103.215 listed in will-spam-for-food.eu.org]
[34.130.103.215 listed in will-spam-for-food.eu.org]
[34.130.103.215 listed in will-spam-for-food.eu.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay
0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily
Subject: {SPAM?} =?utf-8?B?UXVlc3RyYWRlOiBZb3VyIFctOEJFTiBGb3JtIEhhcyBFeHBp?=
=?utf-8?B?cmVk?=
Confirmation of Tax Form Expiration – W-8BEN Renewal Required for 2026
Dear Questrade Client,
This notice is issued to formally confirm that the W-8BEN form previously provided for your account has expired and is no longer valid for tax compliance or reporting purposes. The W-8BEN is a required certification used to establish your status as a non-U.S. individual and to determine the appropriate withholding and reporting treatment under applicable tax regulations.
According to regulatory standards, W-8BEN forms are valid only for a limited period. Once this period ends, the form can no longer be relied upon to support reduced withholding rates or eligibility for tax treaty benefits. Our records indicate that your W-8BEN has reached the end of its validity and must be renewed.
Until a renewed and approved W-8BEN is received, regulatory requirements may require standard withholding treatment to be applied to your account. This may affect how certain payments, distributions, or account activities are processed during this period.
To restore compliant tax documentation status, you are required to submit a renewed W-8BEN that will generally remain valid for the applicable IRS validity period, provided your tax residency and personal information remain accurate. The renewal process must be completed through our secure documentation system:
Complete Update
Login with the email address you used to register to complete your application today, or your Questrade Username and password.
Thank you,
Questrade Team
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 24 Feb 2026 05:52:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from
id 1vurtA-000000002Q8-1NSU
for dave@doctor.nl2k.ab.ca;
Tue, 24 Feb 2026 05:51:44 -0700
Resent-From: The Doctor
Resent-Date: Tue, 24 Feb 2026 05:51:44 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail4.jurnalminang.com ([34.130.103.215]:40602)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.98.2 (FreeBSD))
(envelope-from
id 1vuqDx-000000003LL-2EfZ
for root@nk.ca;
Tue, 24 Feb 2026 04:05:13 -0700
Authentication-Results: mail4.jurnalminang.com;
auth=pass (login)
From: =?utf-8?B?bm8tcmVwbHk=?=
To: =?utf-8?B?cm9vdEBuay5jYQ==?=
Subject: =?utf-8?B?UXVlc3RyYWRlOiBZb3VyIFctOEJFTiBGb3JtIEhhcyBFeHBp?=
=?utf-8?B?cmVk?=
Date: Tue, 24 Feb 2026 11:04:15 +0000
Message-ID:
MIME-Version: 1.0
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: base64
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0)
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
Received: from localhost (Unknown [127.0.0.1])
by mail4.jurnalminang.com (Haraka) with ESMTPSA id 942B2463-E89B-498A-A371-E8647B3063FE.1
envelope-from
tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (authenticated bits=0);
Tue, 24 Feb 2026 11:04:15 +0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=mail4.jurnalminang.com; h=Content-Transfer-Encoding: Content-Type:
MIME-Version: Message-ID: Date: Subject: To: From; q=dns/txt;
s=s20260223160; t=1771931056;
bh=yEyby3yHSY/3KEEgFdjeJHYaTS+gudE3iWsHIKh2rt0=;
b=j0JpLH3j9lYMv6TwJ0oAuvABXjdHL0lKbpASPrDa1fkDw49ccR/NGeKJGjYw+LSGOfPxQLhf7
WCsrwPDla6SHJPR7OB0ObzGi2oJNdOiWCdEbnMAYfQnqvQVfIic/x6uvMXHEFkso/oIlQkX154b
Q8ZXgXHdycdBQOR3oSV+jDg=
X-Spam_score: 6.3
X-Spam_score_int: 63
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Confirmation of Tax Form Expiration – W-8BEN Renewal Required
for 2026 Dear Questrade Client,
Content analysis details: (6.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[34.130.103.215 listed in dnsbl.ahbl.org]
[34.130.103.215 listed in dnsbl.ahbl.org]
[34.130.103.215 listed in dnsbl.ahbl.org]
[34.130.103.215 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[34.130.103.215 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[34.130.103.215 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[34.130.103.215 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[34.130.103.215 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[34.130.103.215 listed in will-spam-for-food.eu.org]
[34.130.103.215 listed in will-spam-for-food.eu.org]
[34.130.103.215 listed in will-spam-for-food.eu.org]
[34.130.103.215 listed in will-spam-for-food.eu.org]
[34.130.103.215 listed in will-spam-for-food.eu.org]
[34.130.103.215 listed in will-spam-for-food.eu.org]
[34.130.103.215 listed in will-spam-for-food.eu.org]
[34.130.103.215 listed in will-spam-for-food.eu.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 MSGID_FROM_MTA_HEADER Message-Id was added by a relay
0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only
0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily
Subject: {SPAM?} =?utf-8?B?UXVlc3RyYWRlOiBZb3VyIFctOEJFTiBGb3JtIEhhcyBFeHBp?=
=?utf-8?B?cmVk?=
Confirmation of Tax Form Expiration – W-8BEN Renewal Required for 2026
Dear Questrade Client,
This notice is issued to formally confirm that the W-8BEN form previously provided for your account has expired and is no longer valid for tax compliance or reporting purposes. The W-8BEN is a required certification used to establish your status as a non-U.S. individual and to determine the appropriate withholding and reporting treatment under applicable tax regulations.
According to regulatory standards, W-8BEN forms are valid only for a limited period. Once this period ends, the form can no longer be relied upon to support reduced withholding rates or eligibility for tax treaty benefits. Our records indicate that your W-8BEN has reached the end of its validity and must be renewed.
Until a renewed and approved W-8BEN is received, regulatory requirements may require standard withholding treatment to be applied to your account. This may affect how certain payments, distributions, or account activities are processed during this period.
To restore compliant tax documentation status, you are required to submit a renewed W-8BEN that will generally remain valid for the applicable IRS validity period, provided your tax residency and personal information remain accurate. The renewal process must be completed through our secure documentation system:
Complete Update
Login with the email address you used to register to complete your application today, or your Questrade Username and password.
Thank you,
Questrade Team