Warning: Suspected phishing site!

[Tiscanny]

"Dear Customer,

Please follow this instructions carefully, for security reason you do not require a password or TVN to complete this process Our security team has noticed multiple login on your internet banking, due to this your account has been deactivated we are sorry for the inconvinence It is therefore recommended that you complete this process. Your security is important to us.

Please click on Continue to Log in below to resolve this issue, failure to do this may lead to account suspension:

Continue to Log in

You would receive a link on your cellphone and you are required to enter the last eight numbers on the link as your RVN We will activate functional upgrades on your account after this process must have been completed.

Customer Service."

This was sent from a email address: ibsupport@​absa.co.za



Now my question is:
cant absa check where this email address is linked to or trace the ip address?
it cant really be that hard seeing as it is from there mail server?

 

[ChrisHurrell]

when using Microsoft Outlook you can change the 'from' email address to anything, so dont think its actually coming from absa.co.za just because it says so.

Hover over the link and see the URL in the bottom corner of your browser. It will most likely be a deep sub directory within a website. They get access to the persons server and run the phishing site from their, unbeknownst to the website owner unless they regularly scan their directories.

Always check the link... then send a warning to Absa Internet Crime or something to that effect.

 

[bubbatentoe]

Select the email message and click "message options" (you have to go find it in Outlook 2010)
This will show the message header containing the sending mail server name & IP address.

Sadly it won't help much as individuals who send these emails never use their own mail servers or send from their own domain (if they have one).
They find an open (relay) mail server and use it to send their crap.