Business proposal spam from Google Gmail
Posted by Dave Yadallee onX-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 12 Dec 2025 20:22:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from
id 1vUGCf-000000006Cg-3Kbb
for dave@doctor.nl2k.ab.ca;
Fri, 12 Dec 2025 20:21:53 -0700
Resent-From: The Doctor
Resent-Date: Fri, 12 Dec 2025 20:21:53 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-ua1-f103.google.com ([209.85.222.103]:57580)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98.2 (FreeBSD))
(envelope-from
id 1vUEp6-000000000Oz-31vz
for root@doctor.nl2k.ab.ca;
Fri, 12 Dec 2025 18:53:36 -0700
Received: by mail-ua1-f103.google.com with SMTP id a1e0cc1a2514c-93f5667f944so1103144241.2
for
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1765590757; x=1766195557;
h=content-transfer-encoding:mime-version:message-id:subject:reply-to
:from:to:date:dkim-signature:x-gm-gg:x-gm-message-state:from:to:cc
:subject:date:message-id:reply-to;
bh=dutKWXB6qWezxV7ePGOU87aIyoiLN4AGBrtyOSZE6dY=;
b=Jsb/VrXRLbxTOikVdbiT6+kmS+qL4i/Kz83HRgWUPB+mXS7o0HHHlewpe+UCj3OaEG
oJPSFkSMHIlBOCv3O2MvsHZDPzNWwX2wJsCD3ZteGm7LdTJVc1RP+MXmZ+Lo2uvgBQab
6/Z1YCovY7Z793Co1HOSt+j0Wi+PopNxEiThrJ2MjdzY6qcWdjiV+Ze1vxCj5aYP4wbw
iPSZeyw27NZqn23MNFCRQDMl8IAkp5zCFM1FZI0c3hEk4wVUO5f7yPW8BwiF7TLbKZ3t
2SA+xWLR0+5pZ/pts0o2hYhF88As/N7gZCRTW1ZEMrlgqD1rMKE3HrbmQUFvVfXfCjlK
lazA==
X-Forwarded-Encrypted: i=1; AJvYcCUQXXwVnUEvE88WmCIIKYaWkYt22MIzE0AF0wWbM9Gv6x5y27/aVuX0Flgp5dKirN6TeL+u@doctor.nl2k.ab.ca
X-Gm-Message-State: AOJu0YxC8jcNrQ9ZM/jDf3e0RROUkUeu07qtWdAdHEhVr4fYfMqaYJHj
x8wOfeCED5c9drWEkZe8ZhP6AMrH1BIt9eMt4MZqZE8C2llZO99nje3jJ38Xb+EEYocO6CON1La
PPJQJrwLSPT1tof1ccSlB2S6mfI9AEmWb1wEm
X-Gm-Gg: AY/fxX7iUExbnMUXiF02euIifHplf9LLw+mT1aemlrtZEo7UjlpINtXDqhlnRb236eZ
Eem4r6zIP3EvcT6oJUTUasui7xAPz25tEGEOJANAVh/ZoesEGx/otdn0MyflfuWklpp38+RvVGQ
LAh8X2ys9PUVkKE8U7waOiWfSNVFIcYt2TSQ1dWpn7lZ+3u8vdGqgWUhVgad2ylYrrnYE46F/K9
65SraDI8cW0bXADG3wdSM9kcY/6xsT83nRXrTuUXAZ96WvmsLniKLNaaMjU3DOJalePbSy8XjLu
1CKV5t2vdLr7f+fqXoH8kwUQWWlNcX7A2XxCbiYqdOkNbqsDd6K37lzcWFvGovWgKYgF9HimFU/
Lpx3nEEan2ihGq8alG3P+fg==
X-Google-Smtp-Source: AGHT+IElSQJD4EuzNyeT/wLN5Wwq9ADndnKpPMprIFVBKutX19Z1D22HAf1YDiiuyLyeE7WRt0breOugPj1x
X-Received: by 2002:a05:6102:e12:b0:5d6:254f:4e24 with SMTP id ada2fe7eead31-5e827835869mr1664251137.32.1765590757385;
Fri, 12 Dec 2025 17:52:37 -0800 (PST)
Received: from mail.iadmexico.mx (mail.iadmexico.mx. [34.231.63.135])
by smtp-relay.gmail.com with ESMTPS id ada2fe7eead31-5e7c85bb9b4sm1037051137.0.2025.12.12.17.52.37
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Fri, 12 Dec 2025 17:52:37 -0800 (PST)
X-Relaying-Domain: iadmexico.mx
Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id 2C749146138;
Fri, 12 Dec 2025 19:52:05 -0600 (CST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=iadmexico.mx;
s=mailcow; t=1765590755; h=from:from:reply-to:reply-to:subject:subject:date:date:
message-id:message-id:to:to:cc:mime-version:mime-version:
content-type:content-type: content-transfer-encoding:content-transfer-encoding;
bh=dutKWXB6qWezxV7ePGOU87aIyoiLN4AGBrtyOSZE6dY=;
b=CGH8PWZCCPViEU8XqCia5znE5HX0enPvVKB06I4R/A3U3r6HAs2uO33UV0ivGdFvakhadR
BtJmvH7ig2j6PGJv34TgI/uAMmv4Y7sTWxPgj9j0/uSxbpJOpyTietikXZkRWow//ezAwx
QS2cBCtOXsiQjJkG3owfGjtJ9+o5EaB0pSb18yiwHO1Bs6bWpUz2zCDZitGq9lDWxMpQ5Q
rWhA4IfqzYyDweuwGsjtRGuoG3U7pHpqImjb0gzw2+CUMNDHcVnGZ1sY4JnphsgyDyp5wf
LU9EIcJkyBJDi8v+4GMas/g5HNANNN7aPNx8Ds0bADoA3Jo7VIsvQqACJwoD+w==
Date: Sat, 13 Dec 2025 01:07:28 +0100
To: undisclosed-recipients:;
From: FRANK STOCKTON
Reply-To: franktsockton654@outlook.com
Subject: BUSINESS PROPOSAL !!!
Message-ID:
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="12595d64276c0482262d2ac7c83b13fd7"
Content-Transfer-Encoding: 8bit
X-Last-TLS-Session-Version: TLSv1.2
X-Spam_score: 17.5
X-Spam_score_int: 175
X-Spam_bar: +++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: I have a Business proposal worth $35M USD, please contact
me for more information. Sincerely, Frank Stockton I have a Business proposal
worth $35M USD, please contact me for more information. Sincerely, Frank
Stockton
Content analysis details: (17.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[34.231.63.135 listed in will-spam-for-food.eu.org]
[34.231.63.135 listed in will-spam-for-food.eu.org]
[34.231.63.135 listed in will-spam-for-food.eu.org]
[34.231.63.135 listed in will-spam-for-food.eu.org]
[34.231.63.135 listed in will-spam-for-food.eu.org]
[34.231.63.135 listed in will-spam-for-food.eu.org]
[34.231.63.135 listed in will-spam-for-food.eu.org]
[34.231.63.135 listed in will-spam-for-food.eu.org]
[209.85.222.103 listed in will-spam-for-food.eu.org]
[209.85.222.103 listed in will-spam-for-food.eu.org]
[209.85.222.103 listed in will-spam-for-food.eu.org]
[209.85.222.103 listed in will-spam-for-food.eu.org]
[209.85.222.103 listed in will-spam-for-food.eu.org]
[209.85.222.103 listed in will-spam-for-food.eu.org]
[209.85.222.103 listed in will-spam-for-food.eu.org]
[209.85.222.103 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[34.231.63.135 listed in dnsbl.ahbl.org]
[34.231.63.135 listed in dnsbl.ahbl.org]
[34.231.63.135 listed in dnsbl.ahbl.org]
[34.231.63.135 listed in dnsbl.ahbl.org]
[209.85.222.103 listed in dnsbl.ahbl.org]
[209.85.222.103 listed in dnsbl.ahbl.org]
[209.85.222.103 listed in dnsbl.ahbl.org]
[209.85.222.103 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[34.231.63.135 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[34.231.63.135 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[34.231.63.135 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[34.231.63.135 listed in dnsbl.ahbl.org]
1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.222.103 listed in list.dnswl.org]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.222.103 listed in wl.mailspike.net]
0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's
domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[franktsockton654(at)outlook.com]
1.6 SUBJ_ALL_CAPS Subject is all capitals
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 HTML_MESSAGE BODY: HTML included in message
2.0 US_8BIT US-ASCII isn't an eight bit charset
0.0 LOTS_OF_MONEY Huge... sums of money
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.9 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?
2.9 UNDISC_MONEY Undisclosed recipients + money/fraud signs
Subject: {SPAM?} BUSINESS PROPOSAL !!!
This is a multi-part message in MIME format.
--12595d64276c0482262d2ac7c83b13fd7
Content-Type: text/plain; charset=us-ascii
I have a Business proposal worth $35M USD, please contact me for more information.
Sincerely,
Frank Stockton
--12595d64276c0482262d2ac7c83b13fd7
Content-Type: text/html; charset=us-ascii
I have a Business proposal worth $35M USD, please contact me for more information.
Sincerely,
Frank Stockton
--12595d64276c0482262d2ac7c83b13fd7--