NAtional Bank phish
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 15 Apr 2026 05:27:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1wCyOa-00000000J8A-0wTE
for dave@doctor.nl2k.ab.ca;
Wed, 15 Apr 2026 05:27:00 -0600
Resent-From: The Doctor
Resent-Date: Wed, 15 Apr 2026 05:27:00 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from belcat.hlubina.com ([178.238.45.141]:51268 helo=cloud7.inett.no)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.98.2 (FreeBSD))
(envelope-from)
id 1wCrwn-000000001AN-0zXA
for sales@nk.ca;
Tue, 14 Apr 2026 22:34:01 -0600
Received: by cloud7.inett.no (Postfix, from userid 33)
id 2B498A0F84; Wed, 15 Apr 2026 02:47:35 +0000 (UTC)
To: sales@nk.ca
Subject: =?UTF-8?Q?Alerte_de_s=C3=A9curit=C3=A9_:_mise_=C3=A0_jour_de_s=C3=A9curit?= =?UTF-8?Q?=C3=A9_urgente_/_Security_Alert:_Emergency_Security_Update.?=
Date: Wed, 15 Apr 2026 02:04:47 +0000
From: =?UTF-8?Q?Banque_Nationale_du_Canada_=7C_National_Bank_of_Canada=C2=A9?=
Message-ID: <877b5780a669b74d823e3124fe8d03e7@nbc.ca>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="168cb3e04851107f8a6ee9e38343482b9"
Content-Transfer-Encoding: 8bit
X-Spam_score: 9.5
X-Spam_score_int: 95
X-Spam_bar: +++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: National Bank of Canada English version follows
Content analysis details: (9.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[178.238.45.141 listed in dnsbl.ahbl.org]
[178.238.45.141 listed in dnsbl.ahbl.org]
[178.238.45.141 listed in dnsbl.ahbl.org]
[178.238.45.141 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[178.238.45.141 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[178.238.45.141 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[178.238.45.141 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[178.238.45.141 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[178.238.45.141 listed in will-spam-for-food.eu.org]
[178.238.45.141 listed in will-spam-for-food.eu.org]
[178.238.45.141 listed in will-spam-for-food.eu.org]
[178.238.45.141 listed in will-spam-for-food.eu.org]
[178.238.45.141 listed in will-spam-for-food.eu.org]
[178.238.45.141 listed in will-spam-for-food.eu.org]
[178.238.45.141 listed in will-spam-for-food.eu.org]
[178.238.45.141 listed in will-spam-for-food.eu.org]
0.0 URIBL_RED Contains an URL listed in the URIBL redlist
[URI: scanned.page]
2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist
[URI: scanned.page]
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
0.5 L_HELLO_ADDRESS BODY: Greets you by address, not by name
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.8 A_HREF_NOWHERE A link tag with empty href
0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam
0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS
Subject: {SPAM?} =?UTF-8?Q?Alerte_de_s=C3=A9curit=C3=A9_:_mise_=C3=A0_jour_de_s=C3=A9curit?= =?UTF-8?Q?=C3=A9_urgente_/_Security_Alert:_Emergency_Security_Update.?=
National Bank of Canada
English version follows
Banque Nationale du Canada
Nos termes et conditions d'utilisation ont changé !
Bonjour sales@nk.ca,
Dans le cadre de notre nouvelle réglementation pour l'année 2026, nous prions tous nos utilisateurs de bien vouloir se conformer aux nouvelles directives de sécurité afin de garantir une plus grande sécurité pour leurs transactions et de lutter contre le blanchiment d'argent, conformément à nos conditions générales d'utilisation, en cliquant sur le bouton ci-dessous depuis votre téléphone portable, votre tablette ou votre ordinateur :
Mettre à jour maintenant
Veuillez ne pas répondre à ce courriel.
Ce courriel est destiné à sales@nk.ca.
La Banque Nationale peut toutefois insérer des liens vous redirigeant vers des pages de notre plateforme sécurisée dans ses messages.
MD BANQUE NATIONALE et le logo BANQUE NATIONALE sont des marques de commerce déposées de la Banque Nationale du Canada.
Conditions d’utilisation | Protection des renseignements personnels | ABC de sécurité
Banque Nationale du Canada,
800, rue Saint-Jacques,
Montréal, Québec, H3C 1A3
National Bank of Canada
Our Terms and Conditions of use have changed!
Hello sales@nk.ca,
As part of our new regulations for 2026, we ask all our users to comply with the new security guidelines to ensure greater security for their transactions and to combat money laundering, in accordance with our Terms of Service, by clicking the button below from your smartphone, tablet, or computer:
Update now
Please do not reply to this email.
This email is intended for sales@nk.ca.
National Bank may, however, insert redirection links to our secure plateform webpages in its communications.
® NATIONAL BANK and the NATIONAL BANK logo are registered trademarks of National Bank of Canada.
Terms of Use | Privacy Policy | ABCs of Security
National Bank of Canada,
800 Saint-Jacques Street,
Montreal, Quebec, H3C 1A3
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 15 Apr 2026 05:27:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from
id 1wCyOa-00000000J8A-0wTE
for dave@doctor.nl2k.ab.ca;
Wed, 15 Apr 2026 05:27:00 -0600
Resent-From: The Doctor
Resent-Date: Wed, 15 Apr 2026 05:27:00 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from belcat.hlubina.com ([178.238.45.141]:51268 helo=cloud7.inett.no)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.98.2 (FreeBSD))
(envelope-from
id 1wCrwn-000000001AN-0zXA
for sales@nk.ca;
Tue, 14 Apr 2026 22:34:01 -0600
Received: by cloud7.inett.no (Postfix, from userid 33)
id 2B498A0F84; Wed, 15 Apr 2026 02:47:35 +0000 (UTC)
To: sales@nk.ca
Subject: =?UTF-8?Q?Alerte_de_s=C3=A9curit=C3=A9_:_mise_=C3=A0_jour_de_s=C3=A9curit?= =?UTF-8?Q?=C3=A9_urgente_/_Security_Alert:_Emergency_Security_Update.?=
Date: Wed, 15 Apr 2026 02:04:47 +0000
From: =?UTF-8?Q?Banque_Nationale_du_Canada_=7C_National_Bank_of_Canada=C2=A9?=
Message-ID: <877b5780a669b74d823e3124fe8d03e7@nbc.ca>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="168cb3e04851107f8a6ee9e38343482b9"
Content-Transfer-Encoding: 8bit
X-Spam_score: 9.5
X-Spam_score_int: 95
X-Spam_bar: +++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: National Bank of Canada English version follows
Content analysis details: (9.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[178.238.45.141 listed in dnsbl.ahbl.org]
[178.238.45.141 listed in dnsbl.ahbl.org]
[178.238.45.141 listed in dnsbl.ahbl.org]
[178.238.45.141 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[178.238.45.141 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[178.238.45.141 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[178.238.45.141 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[178.238.45.141 listed in dnsbl.ahbl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[178.238.45.141 listed in will-spam-for-food.eu.org]
[178.238.45.141 listed in will-spam-for-food.eu.org]
[178.238.45.141 listed in will-spam-for-food.eu.org]
[178.238.45.141 listed in will-spam-for-food.eu.org]
[178.238.45.141 listed in will-spam-for-food.eu.org]
[178.238.45.141 listed in will-spam-for-food.eu.org]
[178.238.45.141 listed in will-spam-for-food.eu.org]
[178.238.45.141 listed in will-spam-for-food.eu.org]
0.0 URIBL_RED Contains an URL listed in the URIBL redlist
[URI: scanned.page]
2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist
[URI: scanned.page]
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
0.5 L_HELLO_ADDRESS BODY: Greets you by address, not by name
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.8 A_HREF_NOWHERE A link tag with empty href
0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam
0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS
Subject: {SPAM?} =?UTF-8?Q?Alerte_de_s=C3=A9curit=C3=A9_:_mise_=C3=A0_jour_de_s=C3=A9curit?= =?UTF-8?Q?=C3=A9_urgente_/_Security_Alert:_Emergency_Security_Update.?=
National Bank of Canada
English version follows
Banque Nationale du Canada
Nos termes et conditions d'utilisation ont changé !
Bonjour sales@nk.ca,
Dans le cadre de notre nouvelle réglementation pour l'année 2026, nous prions tous nos utilisateurs de bien vouloir se conformer aux nouvelles directives de sécurité afin de garantir une plus grande sécurité pour leurs transactions et de lutter contre le blanchiment d'argent, conformément à nos conditions générales d'utilisation, en cliquant sur le bouton ci-dessous depuis votre téléphone portable, votre tablette ou votre ordinateur :
Mettre à jour maintenant
Veuillez ne pas répondre à ce courriel.
Ce courriel est destiné à sales@nk.ca.
La Banque Nationale peut toutefois insérer des liens vous redirigeant vers des pages de notre plateforme sécurisée dans ses messages.
MD BANQUE NATIONALE et le logo BANQUE NATIONALE sont des marques de commerce déposées de la Banque Nationale du Canada.
Conditions d’utilisation | Protection des renseignements personnels | ABC de sécurité
Banque Nationale du Canada,
800, rue Saint-Jacques,
Montréal, Québec, H3C 1A3
National Bank of Canada
Our Terms and Conditions of use have changed!
Hello sales@nk.ca,
As part of our new regulations for 2026, we ask all our users to comply with the new security guidelines to ensure greater security for their transactions and to combat money laundering, in accordance with our Terms of Service, by clicking the button below from your smartphone, tablet, or computer:
Update now
Please do not reply to this email.
This email is intended for sales@nk.ca.
National Bank may, however, insert redirection links to our secure plateform webpages in its communications.
® NATIONAL BANK and the NATIONAL BANK logo are registered trademarks of National Bank of Canada.
Terms of Use | Privacy Policy | ABCs of Security
National Bank of Canada,
800 Saint-Jacques Street,
Montreal, Quebec, H3C 1A3
