Scam Tip Report #5736 - E-Mail regarding deduction from my bank account. Looks like authentic e-mail address from ABSA


Monika Pletschke
Somewhere in South Africa
2012-10-12 14:03:17
Identity Theft
E-Mail regarding deduction from my bank account. Looks like authentic e-mail address from ABSA  Raw message: Return-path: <nobody@server.onsinteractive.com>
Envelope-to: mcalitz@absamail.co.za
Delivery-date: Fri, 12 Oct 2012 14:53:16 +0200
Received: from mxl56v247.dotnetwork2.co.za ([41.77.56.247]:11179 helo=s11p02m011.dotnetwork2.co.za)
by aia-mx-vm-04 with esmtp (Exim 4.76 (FreeBSD))
(envelope-from <nobody@server.onsinteractive.com>)
id 1TMejr-000E87-62
for mcalitz@absamail.co.za; Fri, 12 Oct 2012 14:53:15 +0200
Authentication-Results: s11p02m011.dotnetwork2.co.za; spf=none
Received: from unknown [174.132.254.130] (EHLO server.onsinteractive.com)
by s11p02m011.dotnetwork2.co.za(mxl_mta-6.15.0-1) over TLS secured channel
with ESMTP id ab218705.0.5290208.00-462.7816169.s11p02m011.dotnetwork2.co.za (envelope-from <nobody@server.onsinteractive.com>);
Fri, 12 Oct 2012 06:53:14 -0600 (MDT)
Received: from nobody by server.onsinteractive.com with local (Exim 4.77)
(envelope-from <nobody@server.onsinteractive.com>)
id 1TMejl-0006a4-CL
for mcalitz@absamail.co.za; Fri, 12 Oct 2012 07:53:09 -0500
Date: Fri, 12 Oct 2012 07:53:09 -0500
To: mcalitz@absamail.co.za
From: Absa <jones.le.roux@ib.absa.co.za>
Reply-to:
Subject: Debit Order Confirmation
Message-ID: <0f081e1cbb792ba47043bb688023e8f6@www.thelinenbin.com>
X-Priority: 3
X-Mailer: PHPMailer [version ]
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Content-Type: text/html; charset=\"iso-8859-1\"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server.onsinteractive.com
X-AntiAbuse: Original Domain - absamail.co.za
X-AntiAbuse: Originator/Caller UID/GID - [99 99] / [47 12]
X-AntiAbuse: Sender Address Domain - server.onsinteractive.com
X-Spam: [F=0.2727272727; B=0.500(0); spf=0.500; STSI=0.500(-12); STSM=0.600(22); CM=0.500; MH=0.500(2012101203); S=0.200(2010122901); SC=none]
X-MAIL-FROM: <nobody@server.onsinteractive.com>
X-SOURCE-IP: [174.132.254.130]
X-AnalysisOut: [v=2.0 cv=cIFXRCiN c=1 sm=0 a=mvzBAHwrUKMl2lsxJHjA8w==:17 a]
X-AnalysisOut: [=BLceEmwcHowA:10 a=HCHVx1pr9SIA:10 a=8nJEP1OIZ-IA:10 a=_DM]
X-AnalysisOut: [4r1qgAAAA:8 a=RxPVNzto0i8A:10 a=AK9DinHJAAAA:8 a=G21HY6-iy]
X-AnalysisOut: [LW3S-meTEsA:9 a=wPNLvfGTeEIA:10 a=_W_S_7VecoQA:10 a=tXsnli]
X-AnalysisOut: [wV7b4A:10 a=SIiLqU03q8UA:10 a=9dfz8tVO2Mvqu4Cd:21 a=jluT_T]
X-AnalysisOut: [_LiqGQ7uzB:21 a=e7oi5LYTM1JkmAwU:21]
Received-SPF: None
X-Original-Subject: Debit Order Confirmation

<html>
<head>
<title>HTML Online Editor Sample</title>
</head>
<body>
<p>
Dear customer,<br />
<br />
Debit order ending #72611 from Sage Life has deducted your monthly payment.<br />
<br />
<font><font><a href=\"http://osg.or.kr/home/data/cheditor/0706/login.php\" id=\"yiv2124309037yui_3_2_0_6_1349711804444548\" rel=\"nofollow\" target=\"_blank\"><span class=\"yiv2124309037yshortcuts\" id=\"yiv2124309037lw_1324438419_0\"><font color=\"red\" id=\"yiv2124309037yui_3_2_0_6_1349711804444547\">Login here</font></span></a></font></font> to stop the order if you are not satisfied.<br />
<br />
Kind Regards<br />
Absa Digital Banking Services<br />
<br />
<br />
********** Confidentiality Notice **********.<br />
&nbsp;This e-mail and any file(s) transmitted with it, is intended for the exclusive use by the person(s) mentioned above as recipient(s). This e-mail may contain confidential information and/or information protected by intellectual property rights or other rights. If you are not the intended recipient of this e-mail, you are hereby notified that any dissemination, distribution, copying, or action taken in relation to the contents of and attachments to this e-mail is strictly prohibited and may be unlawful. If you have received this e-mail in error, please notify the sender and delete the original and any copies of this e-mail and any printouts immediately from your system and destroy all copies of it.</p>
</body>
</html>


 Got more information on this Scam/Scammer? Add to Scam Report
 Problems with this Report? Let us know Report to Scamalot

Ad Blocker Detected
Our website is made possible by displaying online advertisements to our visitors.
Please consider supporting us by disabling your ad blocker.
Thanks!
Scamdex
PING