<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"> <meta name=Generator content="Microsoft Word 12 (filtered medium)"> <style>  </style>  </head> <body lang=EN-GB link=blue vlink=purple> <div class=Section1> Hello Support<o:p></o:p> <o:p> </o:p> Our hosting servers seem to be receiving bank phishing spam mail from one of your IP addresses. Could you please look into this?<o:p></o:p> <o:p> </o:p> We have included the headers of one of these mails below.<o:p></o:p> <o:p> </o:p> If you have any questions, please feel free to contact us. Kind Regards Stephen Waters www.ChoiceHosting.co.za Tel. 0878 058 729 Email: support@choicehosting.co.za <o:p></o:p> <o:p> </o:p> <o:p> </o:p> Return-path: <internet@absa.co.za><o:p></o:p> Envelope-to: support@choicehosting.co.za<o:p></o:p> Delivery-date: Mon, 14 Dec 2009 07:16:33 +0200<o:p></o:p> Received: from mx.bsslaw.net ([194.154.196.196])<o:p></o:p> by host.choiceserver1.com with esmtp (Exim 4.69)<o:p></o:p> (envelope-from <internet@absa.co.za>)<o:p></o:p> id 1NK3IK-0007rG-Fv<o:p></o:p> for support@choicehosting.co.za; Mon, 14 Dec 2009 07:16:29 +0200<o:p></o:p> Received: from MAIL-SERVER.BSSLAW.local (Not Verified[192.168.10.1]) by mx.bsslaw.net with MailMarshal (v6,7,2,8378)<o:p></o:p> id <B4b25ca050000>; Mon, 14 Dec 2009 06:15:49 +0100<o:p></o:p> Received: from User ([41.28.112.10]) by MAIL-SERVER.BSSLAW.local with Microsoft SMTPSVC(6.0.3790.3959);<o:p></o:p> Mon, 14 Dec 2009 06:15:48 +0100<o:p></o:p> From: "ABSA ONLINE"<internet@absa.co.za><o:p></o:p> Subject: {Spam?} {Disarmed} ACCOUNT NOTIFICATION<o:p></o:p> Date: Mon, 14 Dec 2009 05:16:12 -0000<o:p></o:p> MIME-Version: 1.0<o:p></o:p> Content-Type: text/html;<o:p></o:p> charset="Windows-1251"<o:p></o:p> Content-Transfer-Encoding: 7bit<o:p></o:p> X-Priority: 3<o:p></o:p> X-MSMail-Priority: Normal<o:p></o:p> X-Mailer: Microsoft Outlook Express 6.00.2600.0000<o:p></o:p> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000<o:p></o:p> Bcc:<o:p></o:p> Message-ID: <NODE01PXCFbN4TZyabY000001c6@MAIL-SERVER.BSSLAW.local><o:p></o:p> X-OriginalArrivalTime: 14 Dec 2009 05:15:48.0833 (UTC) FILETIME=[7F60F510:01CA7C7C]<o:p></o:p> X-Choicehosting-MailScanner-Information: Please contact the ISP for more information<o:p></o:p> X-Choicehosting-MailScanner-ID: 1NK3IK-0007rG-Fv<o:p></o:p> X-Choicehosting-MailScanner: Found to be clean<o:p></o:p> X-Choicehosting-MailScanner-SpamCheck: spam, SpamAssassin (not cached,<o:p></o:p> score=11.434, required 5, FORGED_MUA_OUTLOOK 4.20,<o:p></o:p> FORGED_OUTLOOK_HTML 0.00, FORGED_OUTLOOK_TAGS 0.00,<o:p></o:p> HTML_IMAGE_ONLY_28 1.52, HTML_MESSAGE 0.00, MIME_HTML_ONLY 1.67,<o:p></o:p> MISSING_HEADERS 1.58, SPF_SOFTFAIL 0.65, SUBJ_ALL_CAPS 1.81)<o:p></o:p> X-Choicehosting-MailScanner-SpamScore: sssssssssss<o:p></o:p> X-Choicehosting-MailScanner-From: internet@absa.co.za<o:p></o:p> <o:p> </o:p> <o:p> </o:p> -----Original Message----- From: ABSA ONLINE [mailto:internet@absa.co.za] Sent: 14 December 2009 07:16 Subject: {Spam?} {Disarmed} ACCOUNT NOTIFICATION<o:p></o:p> <o:p> </o:p> Absa Bank Group<http://www.absa.co.za/absacoza/images/homepage/logo_btm.gif> function checkForm() { var valid = false; if (document.form01.sq.value == '') { alert("Please type the word(s) you wish to search for."); } else { valid = true; } return valid; } <o:p></o:p> <o:p> </o:p> INTRODUCING: Absa New Secure Server<o:p></o:p> <o:p> </o:p> We have been warning customers to upgrade to our new server. Fraudsters have devised a new method of defrauding customers. With this new fraud scheme they use the traditional method of identity theft (phishing), Hacking into customers online banking, to avoid phishing and identity theft we advice you login to our secure server <o:p></o:p> <o:p> </o:p> <o:p> </o:p> Go straight to your Absa for procedures to follow:<o:p></o:p> <o:p> </o:p> Click Here to continue <http://marionlodge.sproductions.co.za/catalog/pub/get_ready/absa.htm> <o:p></o:p> Absa Bank will not be responsible for loss of funds to hackers as a result of failure to comply with this important new directives. We are committed to serving you better. Bank and stay safe online.Security Management <o:p></o:p> Absa Bank Group<o:p></o:p> <o:p> </o:p> Please do not reply to this e-mail. Mail sent to this address cannot be answered.<o:p></o:p> For assistance, log in to your absa Online account and choose the "Help" link on any page. <o:p></o:p> <o:p> </o:p> absa bank Email ID # 1009 <o:p></o:p> <o:p> </o:p> <o:p> </o:p> </div> </body> </html>