by buried under 419s
Thu Jul 06, 2017 7:37 pm
Return-path: <[email protected]>
Envelope-to:
Delivery-date: Thu, 06 Jul 2017 13:42:20 -0700
Received: from lsh1001.lsh.siteprotect.com ([64.71.32.11]:57146)
by with esmtps (TLSv1.2:DHE-RSA-AES128-SHA:128)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1dTDbM-0000Lt-Fr
for ; Thu, 06 Jul 2017 13:42:20 -0700
Received: from localhost
([127.0.0.1] helo=User ident=kollefever)
by lsh1001.lsh.siteprotect.com with smtp (Exim 4.80)
(envelope-from <[email protected]>)
id 1dTDVn-0002gP-Uw; Thu, 06 Jul 2017 15:36:32 -0500
Reply-To: <[email protected]>
From: "U S A A"<[email protected]>
Date: Thu, 6 Jul 2017 16:36:31 -0400
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <[email protected]>
X-Spam-Status: Yes, score=21.1
X-Spam-Score: 211
X-Spam-Bar: +++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: USAA McDermott Building Corporate Headquarters 9800 Fredericksburg
Rd. San Antonio, TX 78288 You have been automatically approved to receive
financial aid based on your current USAA profile. We're pleased to report
that USAA's financial strength remained solid in 2016, enabling us to promptly
pay claims and serve our growing membership, while continuing to invest in
ways that will help us better serve you in the future. [...]
Content analysis details: (21.1 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[64.71.32.11 listed in list.dnswl.org]
4.4 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[64.71.32.11 listed in bb.barracudacentral.org]
1.0 MISSING_HEADERS Missing To: header
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source
[64.71.32.11 listed in dnsbl.sorbs.net]
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
1.0 KAM_LAZY_DOMAIN_SECURITY Sending domain does not have any
anti-forgery methods
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
2.6 MSOE_MID_WRONG_CASE No description available.
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 FROM_MISSPACED From: missing whitespace
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 FILL_THIS_FORM Fill in a form with personal information
0.0 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
0.0 T_FILL_THIS_FORM_LONG Fill in a form with personal information
X-Spam-Flag: YES
Subject: ***SPAM*** Offer from USAA - Respond
USAA McDermott Building
Corporate Headquarters
9800 Fredericksburg Rd.
San Antonio, TX 78288
You have been automatically approved to receive financial aid based on your current
USAA profile.
We're pleased to report that USAA's financial strength remained solid in 2016,
enabling us to promptly pay claims and serve our growing membership, while
continuing to invest in ways that will help us better serve you in the future.
USAA is proud to receive consistently outstanding awards and ratings for member
service, employee well-being and financial strength. We have decided to give back to
our loyal customers by providing financial help and clearing debts for a total of
100 customers who will be selected based on their profile.
You are receiving this message because you have been approved by a top staff member
who just retired on the 10th of April. If you need financial aid or help getting out
of a debt, kindly reply or send a new message with the following information:
Full Name:
Full Address:
Contact Phone Number:
Current Occupation:
What do you need help with: Financial Aid or Debt Clearing
Amount Required:
You are required to send the information requested above to Mr. Frank Kelson via
email: [email protected]
Mr. Jackson Oliver is well trusted as we guarantee your safety with him. Thank you
for letting us serve you.
Envelope-to:
Delivery-date: Thu, 06 Jul 2017 13:42:20 -0700
Received: from lsh1001.lsh.siteprotect.com ([64.71.32.11]:57146)
by with esmtps (TLSv1.2:DHE-RSA-AES128-SHA:128)
(Exim 4.89)
(envelope-from <[email protected]>)
id 1dTDbM-0000Lt-Fr
for ; Thu, 06 Jul 2017 13:42:20 -0700
Received: from localhost
([127.0.0.1] helo=User ident=kollefever)
by lsh1001.lsh.siteprotect.com with smtp (Exim 4.80)
(envelope-from <[email protected]>)
id 1dTDVn-0002gP-Uw; Thu, 06 Jul 2017 15:36:32 -0500
Reply-To: <[email protected]>
From: "U S A A"<[email protected]>
Date: Thu, 6 Jul 2017 16:36:31 -0400
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <[email protected]>
X-Spam-Status: Yes, score=21.1
X-Spam-Score: 211
X-Spam-Bar: +++++++++++++++++++++
X-Spam-Report: Spam detection software, running on the system "",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: USAA McDermott Building Corporate Headquarters 9800 Fredericksburg
Rd. San Antonio, TX 78288 You have been automatically approved to receive
financial aid based on your current USAA profile. We're pleased to report
that USAA's financial strength remained solid in 2016, enabling us to promptly
pay claims and serve our growing membership, while continuing to invest in
ways that will help us better serve you in the future. [...]
Content analysis details: (21.1 points, 7.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
5.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
0.0 FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[64.71.32.11 listed in list.dnswl.org]
4.4 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[64.71.32.11 listed in bb.barracudacentral.org]
1.0 MISSING_HEADERS Missing To: header
1.0 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
[score: 1.0000]
0.5 RCVD_IN_SORBS_SPAM RBL: SORBS: sender is a spam source
[64.71.32.11 listed in dnsbl.sorbs.net]
1.6 REPLYTO_WITHOUT_TO_CC No description available.
0.0 AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
0.0 FSL_NEW_HELO_USER Spam's using Helo and User
0.0 FROM_MISSP_MSFT From misspaced + supposed Microsoft tool
1.0 KAM_LAZY_DOMAIN_SECURITY Sending domain does not have any
anti-forgery methods
0.0 FROM_MISSP_XPRIO Misspaced FROM + X-Priority
2.6 MSOE_MID_WRONG_CASE No description available.
2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 TO_NO_BRKTS_FROM_MSSP Multiple header formatting problems
0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To
0.0 FROM_MISSPACED From: missing whitespace
1.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook
0.0 FILL_THIS_FORM Fill in a form with personal information
0.0 TO_NO_BRKTS_MSFT To: lacks brackets and supposed Microsoft tool
0.0 T_FILL_THIS_FORM_LONG Fill in a form with personal information
X-Spam-Flag: YES
Subject: ***SPAM*** Offer from USAA - Respond
USAA McDermott Building
Corporate Headquarters
9800 Fredericksburg Rd.
San Antonio, TX 78288
You have been automatically approved to receive financial aid based on your current
USAA profile.
We're pleased to report that USAA's financial strength remained solid in 2016,
enabling us to promptly pay claims and serve our growing membership, while
continuing to invest in ways that will help us better serve you in the future.
USAA is proud to receive consistently outstanding awards and ratings for member
service, employee well-being and financial strength. We have decided to give back to
our loyal customers by providing financial help and clearing debts for a total of
100 customers who will be selected based on their profile.
You are receiving this message because you have been approved by a top staff member
who just retired on the 10th of April. If you need financial aid or help getting out
of a debt, kindly reply or send a new message with the following information:
Full Name:
Full Address:
Contact Phone Number:
Current Occupation:
What do you need help with: Financial Aid or Debt Clearing
Amount Required:
You are required to send the information requested above to Mr. Frank Kelson via
email: [email protected]
Mr. Jackson Oliver is well trusted as we guarantee your safety with him. Thank you
for letting us serve you.
Questions about scams? fraudatiocruor @ gmail.com to contact remove spaces