E-Mail regarding deduction from my bank account. Looks like authentic e-mail address from ABSA - Scamalot

Seen a Scammer? Report Them!

Seen a scammer? Been caught out? Let the world know so they don't get burned. Add information if you see one that's already been logged - scammers move quickly and change details often to avoid detection. Details you log here will be in major search engines within an hour or two.

Please Like, Share, Tweet etc. to spread the word.
  Scam type at Advanced Search      
Scam ReporterScam Tips Received
Monika Pletschke
Somewhere in South Africa
2012-10-12 10:03:17
Identity Theft
E-Mail regarding deduction from my bank account. Looks like authentic e-mail address from ABSA   
Email Address:
Scam Website:
Raw message: Return-path:
Envelope-to: mcalitz@absamail.co.za
Delivery-date: Fri, 12 Oct 2012 14:53:16 +0200
Received: from mxl56v247.dotnetwork2.co.za ([]:11179 helo=s11p02m011.dotnetwork2.co.za)
by aia-mx-vm-04 with esmtp (Exim 4.76 (FreeBSD))
(envelope-from )
id 1TMejr-000E87-62
for mcalitz@absamail.co.za; Fri, 12 Oct 2012 14:53:15 +0200
Authentication-Results: s11p02m011.dotnetwork2.co.za; spf=none
Received: from unknown [] (EHLO server.onsinteractive.com)
by s11p02m011.dotnetwork2.co.za(mxl_mta-6.15.0-1) over TLS secured channel
with ESMTP id ab218705.0.5290208.00-462.7816169.s11p02m011.dotnetwork2.co.za (envelope-from );
Fri, 12 Oct 2012 06:53:14 -0600 (MDT)
Received: from nobody by server.onsinteractive.com with local (Exim 4.77)
(envelope-from )
id 1TMejl-0006a4-CL
for mcalitz@absamail.co.za; Fri, 12 Oct 2012 07:53:09 -0500
Date: Fri, 12 Oct 2012 07:53:09 -0500
To: mcalitz@absamail.co.za
From: Absa
Subject: Debit Order Confirmation
Message-ID: <0f081e1cbb792ba47043bb688023e8f6@www.thelinenbin.com>
X-Priority: 3
X-Mailer: PHPMailer [version ]
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Content-Type: text/html; charset=\"iso-8859-1\"
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server.onsinteractive.com
X-AntiAbuse: Original Domain - absamail.co.za
X-AntiAbuse: Originator/Caller UID/GID - [99 99] / [47 12]
X-AntiAbuse: Sender Address Domain - server.onsinteractive.com
X-Spam: [F=0.2727272727; B=0.500(0); spf=0.500; STSI=0.500(-12); STSM=0.600(22); CM=0.500; MH=0.500(2012101203); S=0.200(2010122901); SC=none]
X-AnalysisOut: [v=2.0 cv=cIFXRCiN c=1 sm=0 a=mvzBAHwrUKMl2lsxJHjA8w==:17 a]
X-AnalysisOut: [=BLceEmwcHowA:10 a=HCHVx1pr9SIA:10 a=8nJEP1OIZ-IA:10 a=_DM]
X-AnalysisOut: [4r1qgAAAA:8 a=RxPVNzto0i8A:10 a=AK9DinHJAAAA:8 a=G21HY6-iy]
X-AnalysisOut: [LW3S-meTEsA:9 a=wPNLvfGTeEIA:10 a=_W_S_7VecoQA:10 a=tXsnli]
X-AnalysisOut: [wV7b4A:10 a=SIiLqU03q8UA:10 a=9dfz8tVO2Mvqu4Cd:21 a=jluT_T]
X-AnalysisOut: [_LiqGQ7uzB:21 a=e7oi5LYTM1JkmAwU:21]
Received-SPF: None
X-Original-Subject: Debit Order Confirmation

HTML Online Editor Sample

Dear customer,

Debit order ending #72611 from Sage Life has deducted your monthly payment.

Login here to stop the order if you are not satisfied.

Kind Regards

Absa Digital Banking Services

********** Confidentiality Notice **********.

 This e-mail and any file(s) transmitted with it, is intended for the exclusive use by the person(s) mentioned above as recipient(s). This e-mail may contain confidential information and/or information protected by intellectual property rights or other rights. If you are not the intended recipient of this e-mail, you are hereby notified that any dissemination, distribution, copying, or action taken in relation to the contents of and attachments to this e-mail is strictly prohibited and may be unlawful. If you have received this e-mail in error, please notify the sender and delete the original and any copies of this e-mail and any printouts immediately from your system and destroy all copies of it.

 Got more information on this Scam/Scammer?
Add to Report
 Problems with this Report? (Spam/Legal/Abuse etc) ?
Report to Scamalot
Curious what information about you is out there? You may be surprised! | Reverse Email Lookup | Reverse Phone Lookup

Increase ad revenue 50-250% with Ezoic
    [CONTEXT_DOCUMENT_ROOT] => /home2/scamalot/public_html
    [DOCUMENT_ROOT] => /home2/scamalot/public_html
    [HTTPS] => on
    [HTTP_ACCEPT] => text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    [HTTP_ACCEPT_ENCODING] => x-gzip, gzip, deflate
    [HTTP_HOST] => www.scamalot.com
    [HTTP_USER_AGENT] => CCBot/2.0 (http://commoncrawl.org/faq/)
    [HTTP_X_HTTPS] => 1
    [PATH] => /bin:/usr/bin
    [PATH_INFO] => /5736
    [PATH_TRANSLATED] => /home2/scamalot/public_html/ScamTipReports
    [QUERY_STRING] => 
    [REDIRECT_STATUS] => 200
    [REMOTE_ADDR] =>
    [REMOTE_PORT] => 37408
    [REQUEST_SCHEME] => https
    [REQUEST_URI] => /ScamTipReports/5736
    [SCRIPT_FILENAME] => /home2/scamalot/public_html/ScamTipReports
    [SCRIPT_NAME] => /ScamTipReports
    [SCRIPT_URI] => https://www.scamalot.com/ScamTipReports/5736
    [SCRIPT_URL] => /ScamTipReports/5736
    [SERVER_ADDR] =>
    [SERVER_ADMIN] => webmaster@scamalot.com
    [SERVER_NAME] => www.scamalot.com
    [SERVER_PORT] => 443
    [SERVER_SOFTWARE] => Apache
    [SSL_TLS_SNI] => www.scamalot.com
    [TZ] => America/Sacramento
    [PHP_SELF] => /ScamTipReports/5736
    [REQUEST_TIME_FLOAT] => 1508785492.59
    [REQUEST_TIME] => 1508785492
    [argv] => Array

    [argc] => 0