Investor Line Phish from SendGRid
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 10 Sep 2026 12:04:59 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))
(envelope-from)
id 1x4j8n-00000000NWj-3dIw
for dave@doctor.nl2k.ab.ca;
Thu, 10 Sep 2026 12:04:53 -0600
Resent-From: The Doctor
Resent-Date: Thu, 10 Sep 2026 12:04:53 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from s.wfbtzbpn.outbound-mail.sendgrid.net ([159.183.235.50]:63510)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.100 (FreeBSD))
(envelope-from)
id 1x4gJe-00000000DLb-33NL
for doctor@doctor.nl2k.ab.ca;
Thu, 10 Sep 2026 09:04:07 -0600
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mkxczd.com;
h=from:subject:date:mime-version:to:content-type:cc:content-type:date:
from:subject:to;
s=s1; t=1789052580;
bh=vi4U36+vt6EXwwz7bgllIsHMgyNyeW+i1tfTNvLGyYk=;
b=HDa7cJcnok/+i4cnghyFNZqdBfQvoic2yTFSc7xgwx+gpQmKTU+OOFU6vCAvdLs9BF+z
RC1FV0MWacCNFHQA/ASyf9lrdzY1v6N0pRAqnc8LWEcsXRFvoT3TQ9VEdT3RDXNJSKTfYH
5YCegDIiBCZBdlGN04+gIRBWqJnTJFBLSDNWKCrtv/XgZkn2oeZju+izyhpxgoD3zChS3j
+geUCxIGvXG8QyJiHfrBbnYUlcHPanMd6zO6KRPF3KYIhVuZkVjcaOmk2AWihXbSPHqqR3
8aNC9eG2febgDSWmn1+bqLXRU8Dj0C3nloNjjO/fj85/kP9O7CpxVENQiuT/Ux1w==
Received: by recvd-6cd9678977-4jqd5 with SMTP id recvd-6cd9678977-4jqd5-1-6AA2C6A4-71
2026-09-10 15:03:00.325352891 +0000 UTC m=+3787807.071772490
Received: from wiipress.ch (unknown)
by geopod-ismtpd-7 (SG) with ESMTP
id KjfPNiexRXK9blAjEWeagA
for;
Thu, 10 Sep 2026 15:03:00.112 +0000 (UTC)
Message-Id: <92a496bd9aaf08e3157af64c27d5e69f@mkxczd.com>
From: InvestorLine Info
Subject: Action Required: Please Review Your Customer Information
Date: Thu, 10 Sep 2026 15:03:00 +0000 (UTC)
X-Priority: 3
X-Mailer: RZQGEZJBNXOHIK ZSWFRIH KGUIRAVRD 723
Mime-Version: 1.0
X-SG-EID:
=?us-ascii?Q?u001=2EnhMA48XH+kD7Dk1x3LbBwQT1mimGGynp44e3tDbfreTFd46cbvs40gFTd?=
=?us-ascii?Q?TGNxCktTAIrTQU0TkLQlKwK9nsk7T8ld6m6N5RK?=
=?us-ascii?Q?AJ5YSZZxp=2FtRijtg+X24WJhM0xhP=2FRYkb3HHHKk?=
=?us-ascii?Q?pvN6LhL9lYsZXjvx3rOD5HG8F5qbD6dSrQlW1Ih?=
=?us-ascii?Q?hvTAgttfcAcuPKLymkFeFRb7FcPqdpV76P7=2FfeJ?=
=?us-ascii?Q?cDgFiydwJr1F9Xegg2Ol46pSeQM++6wFBPLofEe?= =?us-ascii?Q?Esry?=
To: doctor
X-Entity-ID: u001.U3bXSLnQhyyXUhtoxL8Iww==
Content-Type: multipart/alternative; boundary="c307a3f1dd3ff4aa6c665b29000c3f01"
X-Spam_score: 29.4
X-Spam_score_int: 294
X-Spam_bar: +++++++++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview:  French message to follow/Version française ci-dessous
Dear Customer,As part of our regular review of customer records, we have
identified that certain personal or identification details associa [...]
Content analysis details: (29.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[159.183.235.50 listed in will-spam-for-food.eu.org]
[159.183.235.50 listed in will-spam-for-food.eu.org]
[159.183.235.50 listed in will-spam-for-food.eu.org]
[159.183.235.50 listed in will-spam-for-food.eu.org]
[159.183.235.50 listed in will-spam-for-food.eu.org]
[159.183.235.50 listed in will-spam-for-food.eu.org]
[159.183.235.50 listed in will-spam-for-food.eu.org]
[159.183.235.50 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[159.183.235.50 listed in dnsbl.ahbl.org]
[159.183.235.50 listed in dnsbl.ahbl.org]
[159.183.235.50 listed in dnsbl.ahbl.org]
[159.183.235.50 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[159.183.235.50 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[159.183.235.50 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[159.183.235.50 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[159.183.235.50 listed in dnsbl.ahbl.org]
2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist
[URI: mkxczd.com]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[159.183.235.50 listed in bl.score.senderscore.com]
-0.0 SPF_PASS SPF: sender matches SPF record
15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)
0.6 J_CHICKENPOX_82 BODY: 8alpha-pock-2alpha
0.6 J_CHICKENPOX_83 BODY: 8alpha-pock-3alpha
2.0 TVD_PH_REC BODY: Message includes a phrase commonly used in phishing
mails
0.6 J_CHICKENPOX_84 BODY: 8alpha-pock-4alpha
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts
suspended", "account credited", "account
verification"
1.5 VOWEL_FROM_6 Impronouncable from header (6 consecutive vowels)
0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!
2.0 MIXED_HREF_CASE Has href in mixed case
1.0 XPRIO Has X-Priority header
Subject: {SPAM?} Action Required: Please Review Your Customer Information
French message to follow/Version française ci-dessous
Dear Customer,
As part of our regular review of customer records, we have identified that certain personal or identification details associated with your account need to be confirmed, supplemented, or updated.
Keeping your customer information complete and up to date is an important part of our customer identification and verification requirements and helps ensure that your account records remain accurate.
We kindly ask you to review the information currently registered on your account and make any necessary changes or additions.
To complete the review, please sign in directly through the official online banking service or mobile banking application and follow the instructions displayed in your account:Review Customer Information.
Once your updated information has been submitted, it will be reviewed by the appropriate team. Your customer records will be updated once the verification process has been completed.
Please note that incomplete or outdated information may temporarily affect the availability of certain account functions or services until the required review has been completed.
If you need assistance, please contact Customer Support through the institution’s official contact channels.
BMO InvestorLine
***********************************************************************************************************************
Madame, Monsieur,
dans le cadre de notre examen régulier des dossiers clients, nous avons constaté que certaines informations personnelles ou d’identification associées à votre compte doivent être confirmées, complétées ou mises à jour.
Le maintien d’informations client complètes et à jour constitue un élément important de nos exigences en matière d’identification et de vérification de la clientèle et contribue à garantir l’exactitude des informations relatives à votre compte.
Nous vous invitons donc à vérifier les informations actuellement enregistrées sur votre compte et à effectuer, le cas échéant, les modifications ou compléments nécessaires.
Pour finaliser cette vérification, veuillez vous connecter directement à votre espace bancaire en ligne officiel ou à l’application bancaire mobile et suivre les instructions affichées dans votre compte :Vérifier mes informations.
Après l’envoi de vos informations mises à jour, celles-ci seront examinées par le service compétent. Votre dossier client sera actualisé une fois le processus de vérification terminé.
Veuillez noter que des informations incomplètes ou obsolètes peuvent temporairement affecter la disponibilité de certaines fonctionnalités ou de certains services du compte jusqu’à la fin de la vérification requise.
Si vous avez besoin d’aide, veuillez contacter le service client par l’intermédiaire des canaux de contact officiels de l’établissement.
BMO Ligne d’action
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Thu, 10 Sep 2026 12:04:59 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))
(envelope-from
id 1x4j8n-00000000NWj-3dIw
for dave@doctor.nl2k.ab.ca;
Thu, 10 Sep 2026 12:04:53 -0600
Resent-From: The Doctor
Resent-Date: Thu, 10 Sep 2026 12:04:53 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from s.wfbtzbpn.outbound-mail.sendgrid.net ([159.183.235.50]:63510)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.100 (FreeBSD))
(envelope-from
id 1x4gJe-00000000DLb-33NL
for doctor@doctor.nl2k.ab.ca;
Thu, 10 Sep 2026 09:04:07 -0600
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mkxczd.com;
h=from:subject:date:mime-version:to:content-type:cc:content-type:date:
from:subject:to;
s=s1; t=1789052580;
bh=vi4U36+vt6EXwwz7bgllIsHMgyNyeW+i1tfTNvLGyYk=;
b=HDa7cJcnok/+i4cnghyFNZqdBfQvoic2yTFSc7xgwx+gpQmKTU+OOFU6vCAvdLs9BF+z
RC1FV0MWacCNFHQA/ASyf9lrdzY1v6N0pRAqnc8LWEcsXRFvoT3TQ9VEdT3RDXNJSKTfYH
5YCegDIiBCZBdlGN04+gIRBWqJnTJFBLSDNWKCrtv/XgZkn2oeZju+izyhpxgoD3zChS3j
+geUCxIGvXG8QyJiHfrBbnYUlcHPanMd6zO6KRPF3KYIhVuZkVjcaOmk2AWihXbSPHqqR3
8aNC9eG2febgDSWmn1+bqLXRU8Dj0C3nloNjjO/fj85/kP9O7CpxVENQiuT/Ux1w==
Received: by recvd-6cd9678977-4jqd5 with SMTP id recvd-6cd9678977-4jqd5-1-6AA2C6A4-71
2026-09-10 15:03:00.325352891 +0000 UTC m=+3787807.071772490
Received: from wiipress.ch (unknown)
by geopod-ismtpd-7 (SG) with ESMTP
id KjfPNiexRXK9blAjEWeagA
for
Thu, 10 Sep 2026 15:03:00.112 +0000 (UTC)
Message-Id: <92a496bd9aaf08e3157af64c27d5e69f@mkxczd.com>
From: InvestorLine Info
Subject: Action Required: Please Review Your Customer Information
Date: Thu, 10 Sep 2026 15:03:00 +0000 (UTC)
X-Priority: 3
X-Mailer: RZQGEZJBNXOHIK ZSWFRIH KGUIRAVRD 723
Mime-Version: 1.0
X-SG-EID:
=?us-ascii?Q?u001=2EnhMA48XH+kD7Dk1x3LbBwQT1mimGGynp44e3tDbfreTFd46cbvs40gFTd?=
=?us-ascii?Q?TGNxCktTAIrTQU0TkLQlKwK9nsk7T8ld6m6N5RK?=
=?us-ascii?Q?AJ5YSZZxp=2FtRijtg+X24WJhM0xhP=2FRYkb3HHHKk?=
=?us-ascii?Q?pvN6LhL9lYsZXjvx3rOD5HG8F5qbD6dSrQlW1Ih?=
=?us-ascii?Q?hvTAgttfcAcuPKLymkFeFRb7FcPqdpV76P7=2FfeJ?=
=?us-ascii?Q?cDgFiydwJr1F9Xegg2Ol46pSeQM++6wFBPLofEe?= =?us-ascii?Q?Esry?=
To: doctor
X-Entity-ID: u001.U3bXSLnQhyyXUhtoxL8Iww==
Content-Type: multipart/alternative; boundary="c307a3f1dd3ff4aa6c665b29000c3f01"
X-Spam_score: 29.4
X-Spam_score_int: 294
X-Spam_bar: +++++++++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview:  French message to follow/Version française ci-dessous
Dear Customer,As part of our regular review of customer records, we have
identified that certain personal or identification details associa [...]
Content analysis details: (29.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[159.183.235.50 listed in will-spam-for-food.eu.org]
[159.183.235.50 listed in will-spam-for-food.eu.org]
[159.183.235.50 listed in will-spam-for-food.eu.org]
[159.183.235.50 listed in will-spam-for-food.eu.org]
[159.183.235.50 listed in will-spam-for-food.eu.org]
[159.183.235.50 listed in will-spam-for-food.eu.org]
[159.183.235.50 listed in will-spam-for-food.eu.org]
[159.183.235.50 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[159.183.235.50 listed in dnsbl.ahbl.org]
[159.183.235.50 listed in dnsbl.ahbl.org]
[159.183.235.50 listed in dnsbl.ahbl.org]
[159.183.235.50 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[159.183.235.50 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[159.183.235.50 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[159.183.235.50 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[159.183.235.50 listed in dnsbl.ahbl.org]
2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist
[URI: mkxczd.com]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[159.183.235.50 listed in bl.score.senderscore.com]
-0.0 SPF_PASS SPF: sender matches SPF record
15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)
0.6 J_CHICKENPOX_82 BODY: 8alpha-pock-2alpha
0.6 J_CHICKENPOX_83 BODY: 8alpha-pock-3alpha
2.0 TVD_PH_REC BODY: Message includes a phrase commonly used in phishing
mails
0.6 J_CHICKENPOX_84 BODY: 8alpha-pock-4alpha
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts
suspended", "account credited", "account
verification"
1.5 VOWEL_FROM_6 Impronouncable from header (6 consecutive vowels)
0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!
2.0 MIXED_HREF_CASE Has href in mixed case
1.0 XPRIO Has X-Priority header
Subject: {SPAM?} Action Required: Please Review Your Customer Information
French message to follow/Version française ci-dessous
Dear Customer,
As part of our regular review of customer records, we have identified that certain personal or identification details associated with your account need to be confirmed, supplemented, or updated.
Keeping your customer information complete and up to date is an important part of our customer identification and verification requirements and helps ensure that your account records remain accurate.
We kindly ask you to review the information currently registered on your account and make any necessary changes or additions.
To complete the review, please sign in directly through the official online banking service or mobile banking application and follow the instructions displayed in your account:Review Customer Information.
Once your updated information has been submitted, it will be reviewed by the appropriate team. Your customer records will be updated once the verification process has been completed.
Please note that incomplete or outdated information may temporarily affect the availability of certain account functions or services until the required review has been completed.
If you need assistance, please contact Customer Support through the institution’s official contact channels.
BMO InvestorLine
***********************************************************************************************************************
Madame, Monsieur,
dans le cadre de notre examen régulier des dossiers clients, nous avons constaté que certaines informations personnelles ou d’identification associées à votre compte doivent être confirmées, complétées ou mises à jour.
Le maintien d’informations client complètes et à jour constitue un élément important de nos exigences en matière d’identification et de vérification de la clientèle et contribue à garantir l’exactitude des informations relatives à votre compte.
Nous vous invitons donc à vérifier les informations actuellement enregistrées sur votre compte et à effectuer, le cas échéant, les modifications ou compléments nécessaires.
Pour finaliser cette vérification, veuillez vous connecter directement à votre espace bancaire en ligne officiel ou à l’application bancaire mobile et suivre les instructions affichées dans votre compte :Vérifier mes informations.
Après l’envoi de vos informations mises à jour, celles-ci seront examinées par le service compétent. Votre dossier client sera actualisé une fois le processus de vérification terminé.
Veuillez noter que des informations incomplètes ou obsolètes peuvent temporairement affecter la disponibilité de certaines fonctionnalités ou de certains services du compte jusqu’à la fin de la vérification requise.
Si vous avez besoin d’aide, veuillez contacter le service client par l’intermédiaire des canaux de contact officiels de l’établissement.
BMO Ligne d’action
![](3D"https://ci3.googleusercontent.com/meips/ADKq_NYWx_R1C52H8W=<br)