Wealthsimple phish from Microsoft Outlook
Posted by Dave Yadallee onX-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 28 Sep 2026 10:26:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))
(envelope-from
id 1xBEAO-00000000PLC-3oqc
for dave@doctor.nl2k.ab.ca;
Mon, 28 Sep 2026 10:25:24 -0600
Resent-From: The Doctor
Resent-Date: Mon, 28 Sep 2026 10:25:24 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from beea.youutop.com ([52.255.111.173]:59173)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.100.1 (FreeBSD))
(envelope-from
id 1xBCcz-00000000Fxh-1yU7
for doctor@nk.ca;
Mon, 28 Sep 2026 08:46:57 -0600
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=beea.youutop.com;
h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID:Reply-To;
i=nqcekrzye@beea.youutop.com;
bh=zoxWRq7fgI0fuaE5V6XA1PDfK1DJTUyatgRDNHdayIA=;
b=WrMSveNvhwosdoAjlgPvhvsn8r2pSxredI9W64jH8SatMZz4Sg9ejCEmS8yLUweEaXdryXUD5XZ8
BlyPlSxJ/8g/l4Mks2zGcCfJmjymlPJBUxbRRY9b9hQ6BpRudlwSL4l2xEnNsb1y3EgMTn0R4u8i
VwFAB6MqCzfzbFaqwllCAXCTk8UU4tP2IlVn8B/xrkijoe5J84+otYSP7csLqG7n6LzRELhEK60L
FABFiirS9LiXjOtJM/QCBQHOCNAS0g8kMGcJB10c0jEc7ONFk2Ll6c9DfCzzsyEgTpG0ogs47myV
FEf4XOr3jvYLN1R5Hy4sO/k4I+Ihqz5kTxU4dA==
Content-Type: multipart/alternative;
boundary="===============3317652590351520762=="
MIME-Version: 1.0
From: Wealthsimple
To: doctor@nk.ca
Subject: Your tax details need an update
Date: Mon, 28 Sep 2026 10:46:00 -0400
Message-ID: <179060676064.4402.1362875435222300895@beea.youutop.com>
Reply-To: feedback@wealthsimple.com
Feedback-ID: campaign:wealthsimple.com:mailer
X-Spam_score: 36.6
X-Spam_score_int: 366
X-Spam_bar: ++++++++++++++++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hello doctor, We noticed that the tax information on your
account is incomplete or out of date. To comply with current regulations,
we ask you to update it as soon as you can. Account: doctor@nk.ca Reference:
08469147 Status: Update required
Content analysis details: (36.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[52.255.111.173 listed in will-spam-for-food.eu.org]
[52.255.111.173 listed in will-spam-for-food.eu.org]
[52.255.111.173 listed in will-spam-for-food.eu.org]
[52.255.111.173 listed in will-spam-for-food.eu.org]
[52.255.111.173 listed in will-spam-for-food.eu.org]
[52.255.111.173 listed in will-spam-for-food.eu.org]
[52.255.111.173 listed in will-spam-for-food.eu.org]
[52.255.111.173 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[52.255.111.173 listed in dnsbl.ahbl.org]
[52.255.111.173 listed in dnsbl.ahbl.org]
[52.255.111.173 listed in dnsbl.ahbl.org]
[52.255.111.173 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[52.255.111.173 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[52.255.111.173 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[52.255.111.173 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[52.255.111.173 listed in dnsbl.ahbl.org]
0.0 URIBL_RED Contains an URL listed in the URIBL redlist
[URI: jsdkhbkj.com]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist
[URI: www.jsdkhbkj.com]
[URI: www.bjcwdb.com]
1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URI: bjcwdb.com]
[URI: jsdkhbkj.com]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
2.3 MANGLED_AVOID BODY: mangled avoid
2.3 MANGLED_DOCTOR BODY: mangled doctor
2.3 MANGLED_ACCNT BODY: mangled account(s)
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[52.255.111.173 listed in bl.score.senderscore.com]
1.5 MR_STRANGE_QUESTION URI: No description available.
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
3.0 VOWEL_URI_7 RAW: URI hostname with 7+ consecutive vowels
1.0 J_WEEDS_U FULL: Dec/Hex char Enc [Uu]
1.0 J_WEEDS_K FULL: Dec/Hex char Enc [Kk]
1.0 J_WEEDS_S FULL: Dec/Hex char Enc [Ss]
1.0 J_WEEDS_H FULL: Dec/Hex char Enc [Hh]
1.0 J_WEEDS_R FULL: Dec/Hex char Enc [Rr]
1.0 J_WEEDS_W FULL: Dec/Hex char Enc [Ww]
1.0 J_WEEDS_T FULL: Dec/Hex char Enc [Tt]
1.0 J_WEEDS_I FULL: Dec/Hex char Enc [Ii]
1.0 J_WEEDS_L FULL: Dec/Hex char Enc [Ll]
1.0 J_WEEDS_A FULL: Dec/Hex char Enc [Aa]
1.0 J_WEEDS_G FULL: Dec/Hex char Enc [Gg]
1.0 J_WEEDS_E FULL: Dec/Hex char Enc [Ee]
1.0 J_WEEDS_X FULL: Dec/Hex char Enc [Xx]
1.0 J_WEEDS_M FULL: Dec/Hex char Enc [Mm]
1.0 J_WEEDS_O FULL: Dec/Hex char Enc [Oo]
1.0 J_WEEDS_D FULL: Dec/Hex char Enc [Dd]
1.0 J_WEEDS_N FULL: Dec/Hex char Enc [Nn]
1.0 J_WEEDS_P FULL: Dec/Hex char Enc [Pp]
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.0 WINDOWS_7BITS Windows charset announced as 7 bit
Subject: {SPAM?} Your tax details need an update
--===============3317652590351520762==
Content-Type: text/plain; charset=windows-1252
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Hello doctor,
We noticed that the tax information on your account is incomplete or
out of date. To comply with current regulations, we ask you to update
it as soon as you can.
Account: doctor@nk.ca
Reference: 08469147
Status: Update required
Update your tax details:
https://www.bjcwdb.com/?email=doctor@nk.ca&uid=o7NkYXWRfSWgScoWfaKllIco
It only takes a minute or two - and it helps you avoid withholding
tax at a higher rate.
Warm regards,
The Wealthsimple team
---
This email was sent automatically to doctor@nk.ca.
If this message was not meant for you, you can safely ignore it.
--===============3317652590351520762==
Content-Type: text/html; charset=utf-8
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
|
--===============3317652590351520762==--