Wealthsimple phish
Posted by Dave Yadallee onX-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 11 Sep 2026 07:10:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))
(envelope-from
id 1x510u-0000000079H-0CIc
for dave@doctor.nl2k.ab.ca;
Fri, 11 Sep 2026 07:09:56 -0600
Resent-From: The Doctor
Resent-Date: Fri, 11 Sep 2026 07:09:55 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from hihec.jxddsy.com ([20.240.94.55]:33193)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.100 (FreeBSD))
(envelope-from
id 1x50ch-000000004GF-3WXP
for doctor@nk.ca;
Fri, 11 Sep 2026 06:45:03 -0600
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=hihec.jxddsy.com;
h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID:List-Unsubscribe:
Reply-To; i=bfgrpgn@hihec.jxddsy.com;
bh=KXkxgT9866/RRjOVwtai6nUFv5dyrxvQkq1BEUAddIs=;
b=e1DYBh6dR+FWxJddpxTrAx9thsHuPSzXFYyCRQUu6Np/IVg3L+Z3cdhi85oxDGgmKbD45NmWLNkq
uyghxI02NmHS1rIKGg7EsO3KPe+EKswMsJCBmAnz1T6qB6b5bj/lvuUndq0oJ7EXOfX75Rt27VGN
ITqA1j87GPZTamo/NMfSzzo1H2eBRwDlRwpZTB/BhfzNXnOWK2+o5MPbIGxoIlthaOQB/TiFoqNZ
Ht1rAwYa6Um19OkfOZoUCwt8jPEGeCjQMBm7Svg5L0WZga1jXLyiH+2Lw4GlKT9NfYxMKbfOoI0B
k/t/Sw8TFTc6uEtgLCtbJ1nIyzjInem0Sin06A==
Content-Type: multipart/alternative;
boundary="===============5038080623298228269=="
MIME-Version: 1.0
From: Wealthsimple | Smart investing
To: doctor@nk.ca
Subject: Trading paused - complete your details to restore access
Date: Fri, 11 Sep 2026 08:44:06 -0400
Message-ID: <178913064641.28642.2958063619782514502@hihec.jxddsy.com>
List-Unsubscribe:
Reply-To: feedback@wealthsimple.com
Feedback-ID: campaign:wealthsimple.com:mailer
X-Spam_score: 44.0
X-Spam_score_int: 440
X-Spam_bar: ++++++++++++++++++++++++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Wealthsimple Trading paused - complete your details to restore
access Hello doctor,
Content analysis details: (44.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[20.240.94.55 listed in will-spam-for-food.eu.org]
[20.240.94.55 listed in will-spam-for-food.eu.org]
[20.240.94.55 listed in will-spam-for-food.eu.org]
[20.240.94.55 listed in will-spam-for-food.eu.org]
[20.240.94.55 listed in will-spam-for-food.eu.org]
[20.240.94.55 listed in will-spam-for-food.eu.org]
[20.240.94.55 listed in will-spam-for-food.eu.org]
[20.240.94.55 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[20.240.94.55 listed in dnsbl.ahbl.org]
[20.240.94.55 listed in dnsbl.ahbl.org]
[20.240.94.55 listed in dnsbl.ahbl.org]
[20.240.94.55 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[20.240.94.55 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[20.240.94.55 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[20.240.94.55 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[20.240.94.55 listed in dnsbl.ahbl.org]
2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist
[URI: jxddsy.com]
-0.0 SPF_PASS SPF: sender matches SPF record
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
1.0 HK_RANDOM_FROM From username looks random
3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)
0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters
0.6 HK_RANDOM_ENVFROM Envelope sender username looks random
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist
[URI: johnraya.com]
[URI: thedogpb.com]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[20.240.94.55 listed in bl.score.senderscore.com]
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
2.3 MANGLED_DOCTOR BODY: mangled doctor
2.3 MANGLED_YOUR BODY: mangled your
2.3 MANGLED_ACCNT BODY: mangled account(s)
1.5 MR_STRANGE_QUESTION URI: No description available.
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
1.0 J_WEEDS_U FULL: Dec/Hex char Enc [Uu]
1.0 J_WEEDS_C FULL: Dec/Hex char Enc [Cc]
1.0 J_WEEDS_B FULL: Dec/Hex char Enc [Bb]
1.0 J_WEEDS_F FULL: Dec/Hex char Enc [Ff]
1.0 J_WEEDS_K FULL: Dec/Hex char Enc [Kk]
1.0 J_WEEDS_S FULL: Dec/Hex char Enc [Ss]
1.0 J_WEEDS_H FULL: Dec/Hex char Enc [Hh]
1.0 J_WEEDS_R FULL: Dec/Hex char Enc [Rr]
1.0 J_WEEDS_Y FULL: Dec/Hex char Enc [Yy]
1.0 J_WEEDS_W FULL: Dec/Hex char Enc [Ww]
1.0 J_WEEDS_T FULL: Dec/Hex char Enc [Tt]
1.0 J_WEEDS_I FULL: Dec/Hex char Enc [Ii]
1.0 J_WEEDS_L FULL: Dec/Hex char Enc [Ll]
1.0 J_WEEDS_A FULL: Dec/Hex char Enc [Aa]
1.0 J_WEEDS_G FULL: Dec/Hex char Enc [Gg]
1.0 J_WEEDS_E FULL: Dec/Hex char Enc [Ee]
1.0 J_WEEDS_M FULL: Dec/Hex char Enc [Mm]
1.0 J_WEEDS_O FULL: Dec/Hex char Enc [Oo]
1.0 J_WEEDS_D FULL: Dec/Hex char Enc [Dd]
1.0 J_WEEDS_N FULL: Dec/Hex char Enc [Nn]
1.0 J_WEEDS_P FULL: Dec/Hex char Enc [Pp]
2.0 WINDOWS_7BITS Windows charset announced as 7 bit
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts
suspended", "account credited", "account
verification"
Subject: {SPAM?} Trading paused - complete your details to restore access
--===============5038080623298228269==
Content-Type: text/plain; charset=windows-1252
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Wealthsimple
Trading paused - complete your details to restore access
Hello doctor,
Your account information has not been updated for a long time. To keep your account secure, trading is paused until your details are confirmed.
What's paused: buying and selling.
What still works: deposits, withdrawals and transfers.
How to lift the pause: complete your account details.
Restore access: https://www.thedogpb.com/?uid=JiZeT6s2SDyWeSqjRru8Uqhk
This email was sent to doctor@nk.ca. This is an automated message from Wealthsimple. Please do not reply.
---
FRANAIS
Bonjour doctor,
Les renseignements de votre compte n'ont pas t mis jour depuis longtemps. Afin d'assurer la scurit de votre compte, la ngociation est en pause jusqu' la confirmation de vos renseignements.
Ce qui est en pause : l'achat et la vente.
Ce qui fonctionne toujours : les dpts, les retraits et les virements.
Comment lever la pause : complter les renseignements de votre compte.
Rtablir l'accs : https://www.thedogpb.com/?uid=JSDZGSLFmFqwmBs5W3JMtKHN
Ce courriel a t envoy doctor@nk.ca. Ceci est un message automatis de Wealthsimple. Veuillez ne pas y rpondre.
--===============5038080623298228269==
Content-Type: text/html; charset=utf-8
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
|
--===============5038080623298228269==--