Trustwallet phish
Posted by Dave Yadallee onEnvelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 16 Nov 2025 21:18:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from
id 1vKqgE-00000000FIN-2Zn8
for dave@doctor.nl2k.ab.ca;
Sun, 16 Nov 2025 21:17:30 -0700
Resent-From: The Doctor
Resent-Date: Sun, 16 Nov 2025 21:17:30 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from cloudhost-3108045.uk-south-2.nxcli.net ([87.76.28.99]:48526)
by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
(Exim 4.98.2 (FreeBSD))
(envelope-from
id 1vKnEk-00000000O1j-1T3g
for sales@nk.ca;
Sun, 16 Nov 2025 17:37:02 -0700
Comment: DomainKeys? See http://domainkeys.sourceforge.net/
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=default; d=c149d246c7.nxcli.io;
b=eO8SMdbWT+khLxQT0Gv8hNdOlPjskysCN9IYm593E1V4B3Hav8KPJLDSBBc6n5AuMI/3fmrG9qqumHRm7uFiSN0AEafu4/dyAk5T58TyQnXD4BJYuoveFBIQocbyRWhU+818es6AuxllnMP331b+UQdbJ/d5YPabJHsC9XOC7xdh5kJE47y2S2x8SdkFlmxD1l7bl/GPrUMLrMPJOJYTEbg+GCYrkmsHAUU8C4Y7moliLmngGLAmb3Y2GO008b2HuB9C2N80zM3vSRStYE+cWTJuGkEOydnYgYFdiyigF8ie6ossGzJ1fmIydVlr+fxiPbTRfzRTCMaEyJZJ6RI/TA==;
h=Received:Date:To:From:Reply-To:Subject:Message-ID:List-Unsubscribe:MIME-Version:Content-Type:Content-Transfer-Encoding;
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; d=c149d246c7.nxcli.io; h=
date:to:from:reply-to:subject:message-id:list-unsubscribe
:mime-version:content-type:content-transfer-encoding; s=default;
bh=Cxx9FCXPtCpdyHb6urCc9ig+IbvonVnZhXKhH/wItOw=; b=tGKycLbbNWfo
WZbPa/9vp5JbeP3eyLqt8vTd/pzAxlq+g5caqusZrAShi+OkEF3Yj7ZEfItuyQIZ
L+2sMLABp5dx5PTVt6Mw0fW4lK1tNkTijiWGqYDku8EKCF62OLEohbr5AsCkd7PW
Pza6jgOO+exGuU8T5aUUCWALxYj3MANUXzxjkvH2S3kYsC+v2PvSdO3BdKXasoKi
zdwHyS+BPCRPCS1c5nQ8Va9D6i2tPCiz3ZLZddgBs0P0OiQYh8M55Iw6l2FYasK8
Jz5+ThbpQ6cIRkJ9rBSEIsqDWqhsP/+Mv5G4D45ilrL5KAiSoiLoEOP9UQur0LTR
2fjWbL8xRQ==
Received: (qmail 16270 invoked by uid 10317); 17 Nov 2025 00:30:45 +0000
Date: Mon, 17 Nov 2025 00:30:38 +0000
To: sales@nk.ca
From: Trust Wallet
Reply-To: system@twt.io
Subject: Inactivity Alert: Wallet at Risk of Removal
Message-ID:
List-Unsubscribe: mailto:bounce238-yXMqEkqVbnfxHnf@twt.io?subject=list-unsubscribe
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="179608020289cdb24ae0ccb4189ba8efc"
Content-Transfer-Encoding: 8bit
X-Spam_score: 7.4
X-Spam_score_int: 74
X-Spam_bar: +++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Wallet Activity Review body{margin:0;padding:0;background:#f4f4f4;font-family:Arial,Helvetica,sans-serif;color:#222}.wrap{max-width:620px;margin:40px
auto;background:#fff;border-radius:10px;border:1px solid #e8e8e8}.header{
[...]
Content analysis details: (7.4 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[87.76.28.99 listed in will-spam-for-food.eu.org]
[87.76.28.99 listed in will-spam-for-food.eu.org]
[87.76.28.99 listed in will-spam-for-food.eu.org]
[87.76.28.99 listed in will-spam-for-food.eu.org]
[87.76.28.99 listed in will-spam-for-food.eu.org]
[87.76.28.99 listed in will-spam-for-food.eu.org]
[87.76.28.99 listed in will-spam-for-food.eu.org]
[87.76.28.99 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[87.76.28.99 listed in dnsbl.ahbl.org]
[87.76.28.99 listed in dnsbl.ahbl.org]
[87.76.28.99 listed in dnsbl.ahbl.org]
[87.76.28.99 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[87.76.28.99 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[87.76.28.99 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[87.76.28.99 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[87.76.28.99 listed in dnsbl.ahbl.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The
query to Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[87.76.28.99 listed in sa-trusted.bondedsender.org]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[87.76.28.99 listed in sa-accredit.habeas.com]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[87.76.28.99 listed in bl.score.senderscore.com]
0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[87.76.28.99 listed in bl.score.senderscore.com]
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
0.6 HTML_IMAGE_RATIO_04 BODY: HTML has a low ratio of text to image area
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words
2.0 VOWEL_URI_6 URI hostname with 6 consecutive vowels
2.0 US_8BIT US-ASCII isn't an eight bit charset
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
Subject: {SPAM?} Inactivity Alert: Wallet at Risk of Removal
This is a multi-part message in MIME format.
--179608020289cdb24ae0ccb4189ba8efc
Content-Type: text/plain; charset=us-ascii
Wallet Activity Review
body{margin:0;padding:0;background:#f4f4f4;font-family:Arial,Helvetica,sans-serif;color:#222}.wrap{max-width:620px;margin:40px auto;background:#fff;border-radius:10px;border:1px solid #e8e8e8}.header{padding:22px;text-align:left;border-bottom:1px solid #e6e6e6;background:#fafafa}.logo{width:140px;height:40px;background:#d9d9d9;border-radius:4px;margin-bottom:8px}.content{padding:26px;line-height:1.55;font-size:15px}.cta{display:inline-block;padding:10px 18px;background:#1a73e8;color:#fff;text-decoration:none;border-radius:4px;font-size:14px;margin-top:18px}.footer{padding:20px;text-align:left;font-size:12px;color:#777;border-top:1px solid #e6e6e6}a{color:#1a73e8;text-decoration:none}
Trustwallet
Systems
Hello,
As part of our periodic account maintenance, we are confirming the current
status of wallets connected to the Trustwallet platform.
Our system indicates that one of your registered wallets has not shown recent
activity. To keep it associated with your profile, you can confirm that it is
still in use.
Confirm
Wallet Status
If the wallet is no longer active, no action is
required and it may be removed from our system during the next update.
Thank you.Trustwallet Operations
This notification relates to your Trustwallet account
settings.You can update your email preferences or unsubscribe.
--179608020289cdb24ae0ccb4189ba8efc
Content-Type: text/html; charset=us-ascii

Systems
Hello,
As part of our periodic account maintenance, we are confirming the current
status of wallets connected to the Trustwallet platform.
Our system indicates that one of your registered wallets has not shown recent
activity. To keep it associated with your profile, you can confirm that it is
still in use.
If the wallet is no longer active, no action is
required and it may be removed from our system during the next update.
Thank you.
Trustwallet Operations
--179608020289cdb24ae0ccb4189ba8efc--