Walmart phish
Posted by Dave Yadallee onX-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Tue, 13 Oct 2026 09:40:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))
(envelope-from
id 1xGebc-000000005DW-3lu8
for dave@doctor.nl2k.ab.ca;
Tue, 13 Oct 2026 09:39:56 -0600
Resent-From: The Doctor
Resent-Date: Tue, 13 Oct 2026 09:39:56 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [35.207.86.100] (port=38623 helo=abqcc.fakunews.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.100.1 (FreeBSD))
(envelope-from
id 1xGeMm-000000003pk-3VwQ
for root@nk.ca;
Tue, 13 Oct 2026 09:24:45 -0600
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=abqcc.fakunews.com;
h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID:Reply-To;
i=xrtkgyva@abqcc.fakunews.com;
bh=0nPi90aDEs5WTqIADfA1lyZAHlL/VR+VwhHO3dog+0c=;
b=J77tFIC4CCxnq6k0+2lvltrNPd8dhkDhvT7vMAzkTkl3ZKnir/5iwIJKLM48QTOqL4wyfAsKC4yT
Fzr9hJhYRO72dR3x45hTjQtN2ZTXkVcikBiNb63FMN8qSnHbhaNzfJMVTyc32G1lwn0QohnCW0jT
uFU4GxqdzzVASo3CM+o5URCjnyZkMtTrBjHkWannImsJmITzcE5zYg+bcN6jYzni4dvmtT3tN4+2
1Z78UFFGh9wq/HVWjOkmURXAgaQBB3LYx+vhDxfPzoNk8rTU5Fd2kteqCDM9P+n8b5EczGt+0jJt
vfBLY47me2yKxXOBqeKkf8QKbYD92rZKAM4hZA==
Content-Type: multipart/alternative;
boundary="===============2168027945637798909=="
MIME-Version: 1.0
From: "Walmart.ca"
To: root@nk.ca
Subject: Reminder - confirm your mobile number to receive your $50 Walmart
gift card
Date: Tue, 13 Oct 2026 11:23:45 -0400
Message-ID: <179190502503.5250.17519329643440112367@abqcc.fakunews.com>
Reply-To: no-reply@walmart.ca
Feedback-ID: campaign:walmart.ca:mailer
X-Auto-Response-Suppress: OOF, DR, RN, NRN
X-Spam_score: 40.2
X-Spam_score_int: 402
X-Spam_bar: ++++++++++++++++++++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Subject: Reminder - confirm your mobile number to receive
your $50 Walmart gift card Hi root, Your $50 gift card is still reserved
Content analysis details: (40.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[35.207.86.100 listed in will-spam-for-food.eu.org]
[35.207.86.100 listed in will-spam-for-food.eu.org]
[35.207.86.100 listed in will-spam-for-food.eu.org]
[35.207.86.100 listed in will-spam-for-food.eu.org]
[35.207.86.100 listed in will-spam-for-food.eu.org]
[35.207.86.100 listed in will-spam-for-food.eu.org]
[35.207.86.100 listed in will-spam-for-food.eu.org]
[35.207.86.100 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[35.207.86.100 listed in dnsbl.ahbl.org]
[35.207.86.100 listed in dnsbl.ahbl.org]
[35.207.86.100 listed in dnsbl.ahbl.org]
[35.207.86.100 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[35.207.86.100 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[35.207.86.100 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[35.207.86.100 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[35.207.86.100 listed in dnsbl.ahbl.org]
1.0 HK_RANDOM_FROM From username looks random
0.6 HK_RANDOM_ENVFROM Envelope sender username looks random
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URI: xiahuaqp.com]
1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist
[URI: xiahuaqp.com]
2.3 MANGLED_TEXT BODY: mangled text
2.3 MANGLED_FROM BODY: mangled from
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[35.207.86.100 listed in bl.score.senderscore.com]
1.5 MR_STRANGE_QUESTION URI: No description available.
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_MESSAGE BODY: HTML included in message
1.0 J_WEEDS_G FULL: Dec/Hex char Enc [Gg]
1.0 J_WEEDS_O FULL: Dec/Hex char Enc [Oo]
1.0 J_WEEDS_P FULL: Dec/Hex char Enc [Pp]
1.0 J_WEEDS_E FULL: Dec/Hex char Enc [Ee]
1.0 J_WEEDS_D FULL: Dec/Hex char Enc [Dd]
1.0 J_WEEDS_M FULL: Dec/Hex char Enc [Mm]
1.0 J_WEEDS_I FULL: Dec/Hex char Enc [Ii]
1.0 J_WEEDS_X FULL: Dec/Hex char Enc [Xx]
1.0 J_WEEDS_U FULL: Dec/Hex char Enc [Uu]
1.0 J_WEEDS_H FULL: Dec/Hex char Enc [Hh]
1.0 J_WEEDS_C FULL: Dec/Hex char Enc [Cc]
1.0 J_WEEDS_W FULL: Dec/Hex char Enc [Ww]
1.0 J_WEEDS_V FULL: Dec/Hex char Enc [Vv]
1.0 J_WEEDS_N FULL: Dec/Hex char Enc [Nn]
1.0 J_WEEDS_Y FULL: Dec/Hex char Enc [Yy]
1.0 J_WEEDS_T FULL: Dec/Hex char Enc [Tt]
1.0 J_WEEDS_R FULL: Dec/Hex char Enc [Rr]
1.0 J_WEEDS_L FULL: Dec/Hex char Enc [Ll]
1.0 J_WEEDS_F FULL: Dec/Hex char Enc [Ff]
1.0 J_WEEDS_A FULL: Dec/Hex char Enc [Aa]
1.0 J_WEEDS_K FULL: Dec/Hex char Enc [Kk]
1.0 J_WEEDS_S FULL: Dec/Hex char Enc [Ss]
1.0 J_WEEDS_B FULL: Dec/Hex char Enc [Bb]
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.5 ISO_7BITS ISO charset announced as 7 bit (or bad rule ?)
0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)
2.0 HTML_FONT_TINY_NORDNS Font too small to read, no rDNS
Subject: {SPAM?} Reminder - confirm your mobile number to receive your $50 Walmart
gift card
--===============2168027945637798909==
Content-Type: text/plain; charset=iso-8859-1
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: Reminder - confirm your mobile number to receive your $50 Walmart gift card
Hi root,
Your $50 gift card is still reserved
We only need one thing from you: the mobile number that should receive the
reward. Confirm it and your $50.00 Walmart gift card is sent by text message.
Confirm your mobile number:
https://xiahuaqp.com/?email=root@nk.ca&token=q7VCcSokC1ZUw4s6xHes8nBi&pos=cta_primary
Reservation status
-----------------------------------------
Gift card value ....... $50.00 CAD
Reserved for .......... root@nk.ca
Mobile number ......... Not confirmed yet
Delivery method ....... Text message (SMS)
Reference number ...... 8GS7XCGVI4
-----------------------------------------
What happens after you confirm
- A six-digit code is sent to the mobile number you enter.
- Enter the code on the confirmation page.
- Your $50 gift card code is then sent to the same number.
Why we ask for a mobile number: the gift card code is a digital reward, so it
is delivered by text message to the number you confirm. The number is used only
to send this reward and to verify that the request came from you.
If you have already confirmed your mobile number, you can ignore this reminder.
Your gift card is on its way.
Thank you,
Gift Card Services
Walmart Canada
-----------------------------------------
This message was sent automatically to root@nk.ca.
Please do not reply to this email.
You are receiving this reminder because the reserved gift card has not been
matched to a mobile number yet. Message and data rates may apply.
Walmart gift cards are issued by Walmart Canada Corp. Gift cards have no
expiry date and are not redeemable for cash.
(C) 2026 Walmart Canada Corp. All rights reserved.
1940 Argentia Road, Mississauga, ON L5N 1P1
Help Centre: https://xiahuaqp.com/?email=root@nk.ca&token=G9J9QcJ1IbbHm5HAlzaRboOP&pos=f_help
Contact us: https://xiahuaqp.com/?email=root@nk.ca&token=mxzhkOmEmElm1ikiocebPsS7&pos=f_contact
Privacy: https://xiahuaqp.com/?email=root@nk.ca&token=GPb59ERuOV7m91EwL18JIiAy&pos=f_privacy
Gift card terms: https://xiahuaqp.com/?email=root@nk.ca&token=MPbBLxgzY5RdkTYYIyy9Nj97&pos=f_terms
Unsubscribe: https://xiahuaqp.com/?email=root@nk.ca&token=SEdJ65FTDyWDpvtXdBmxJfVJ&pos=f_unsub
--===============2168027945637798909==
Content-Type: text/html; charset=utf-8
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
|
--===============2168027945637798909==--