Wealthsimple phish from Microsoft outlook
Posted by Dave Yadallee onX-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 28 Sep 2026 10:25:08 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))
(envelope-from
id 1xBEA2-00000000PIl-32AM
for dave@doctor.nl2k.ab.ca;
Mon, 28 Sep 2026 10:25:02 -0600
Resent-From: The Doctor
Resent-Date: Mon, 28 Sep 2026 10:25:02 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from urnr.cyxxjc.com ([20.221.221.63]:53413)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.100.1 (FreeBSD))
(envelope-from
id 1xBCah-00000000Fk0-0GFG
for root@nk.ca;
Mon, 28 Sep 2026 08:44:34 -0600
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=urnr.cyxxjc.com;
h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID:Reply-To;
i=eociybwgr@urnr.cyxxjc.com;
bh=hXGHQTZNxAcvlDdDYYvhHSXGsv6cZwFW3sjJ4vHk3oY=;
b=dpnO0HmXaSBlIi4OaC0VVuSjT+TGl6rwtbDQquAmB5PFW5erKoLIp0/7/jNg+WRSQF6bYTpN0x1M
mMge52dKqBlMlrN2uRh9RX5+eYudfIZ5HzsdeEK6MG8Th/3fWEBDxds5TyHJfSIndiXhmBwxyx/T
uUfHelBJp/Ou7YO/oEi/TLZXtAp7it72iqi+kJkdbUHR/psi0fLR4ryRpD40+dXvgxlKPFGM5gcw
G4InKb+ShQ12tUzqm8eqBxd3uXMWFnPeZwA61XAACup12akQenAkRZsh4iJDjXbduwD0UipWW4fR
9f8iC+2B4ECVqAZnD5KyYj8PpXPTOa31poUoWg==
Content-Type: multipart/alternative;
boundary="===============2774443498592361255=="
MIME-Version: 1.0
From: Wealthsimple
To: root@nk.ca
Subject: Your tax details need an update
Date: Mon, 28 Sep 2026 10:43:39 -0400
Message-ID: <179060661928.4953.9520321918051751445@urnr.cyxxjc.com>
Reply-To: feedback@wealthsimple.com
Feedback-ID: campaign:wealthsimple.com:mailer
X-Spam_score: 28.4
X-Spam_score_int: 284
X-Spam_bar: ++++++++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hello root, We noticed that the tax information on your account
is incomplete or out of date. To comply with current regulations, we ask
you to update it as soon as you can. Account: root@nk.ca Reference: 70821808
Status: Update required
Content analysis details: (28.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[20.221.221.63 listed in will-spam-for-food.eu.org]
[20.221.221.63 listed in will-spam-for-food.eu.org]
[20.221.221.63 listed in will-spam-for-food.eu.org]
[20.221.221.63 listed in will-spam-for-food.eu.org]
[20.221.221.63 listed in will-spam-for-food.eu.org]
[20.221.221.63 listed in will-spam-for-food.eu.org]
[20.221.221.63 listed in will-spam-for-food.eu.org]
[20.221.221.63 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[20.221.221.63 listed in dnsbl.ahbl.org]
[20.221.221.63 listed in dnsbl.ahbl.org]
[20.221.221.63 listed in dnsbl.ahbl.org]
[20.221.221.63 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[20.221.221.63 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[20.221.221.63 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[20.221.221.63 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[20.221.221.63 listed in dnsbl.ahbl.org]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
2.3 MANGLED_AVOID BODY: mangled avoid
2.3 MANGLED_ACCNT BODY: mangled account(s)
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[20.221.221.63 listed in bl.score.senderscore.com]
1.5 MR_STRANGE_QUESTION URI: No description available.
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
1.0 J_WEEDS_U FULL: Dec/Hex char Enc [Uu]
1.0 J_WEEDS_C FULL: Dec/Hex char Enc [Cc]
1.0 J_WEEDS_S FULL: Dec/Hex char Enc [Ss]
1.0 J_WEEDS_H FULL: Dec/Hex char Enc [Hh]
1.0 J_WEEDS_R FULL: Dec/Hex char Enc [Rr]
1.0 J_WEEDS_Y FULL: Dec/Hex char Enc [Yy]
1.0 J_WEEDS_W FULL: Dec/Hex char Enc [Ww]
1.0 J_WEEDS_T FULL: Dec/Hex char Enc [Tt]
1.0 J_WEEDS_I FULL: Dec/Hex char Enc [Ii]
1.0 J_WEEDS_L FULL: Dec/Hex char Enc [Ll]
1.0 J_WEEDS_A FULL: Dec/Hex char Enc [Aa]
1.0 J_WEEDS_G FULL: Dec/Hex char Enc [Gg]
1.0 J_WEEDS_E FULL: Dec/Hex char Enc [Ee]
1.0 J_WEEDS_X FULL: Dec/Hex char Enc [Xx]
1.0 J_WEEDS_M FULL: Dec/Hex char Enc [Mm]
1.0 J_WEEDS_O FULL: Dec/Hex char Enc [Oo]
1.0 J_WEEDS_D FULL: Dec/Hex char Enc [Dd]
1.0 J_WEEDS_N FULL: Dec/Hex char Enc [Nn]
1.0 J_WEEDS_P FULL: Dec/Hex char Enc [Pp]
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.0 WINDOWS_7BITS Windows charset announced as 7 bit
Subject: {SPAM?} Your tax details need an update
--===============2774443498592361255==
Content-Type: text/plain; charset=windows-1252
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Hello root,
We noticed that the tax information on your account is incomplete or
out of date. To comply with current regulations, we ask you to update
it as soon as you can.
Account: root@nk.ca
Reference: 70821808
Status: Update required
Update your tax details:
https://www.shqinbo.com/?email=root@nk.ca&uid=fqOqOGV8C79vL3vVUHdYFshq
It only takes a minute or two - and it helps you avoid withholding
tax at a higher rate.
Warm regards,
The Wealthsimple team
---
This email was sent automatically to root@nk.ca.
If this message was not meant for you, you can safely ignore it.
--===============2774443498592361255==
Content-Type: text/html; charset=utf-8
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
|
--===============2774443498592361255==--