26 Sep 2023 07:11:52UTC: scammer contacted us by e-mail impersonating us (sending from our own domain) with threatening content (e.g. blackmail, sextortion, ...) demanding payment to bitcoin address below Mail originating from IP: 190.234.57.69 (abuse report also sent to: gestionip@telefonica.net.pe) Mail Subject: Careful, it's important First up to 512 characters of mail body: This is a multi-part message in MIME format. ------=_NextPart_000_0022_01D9F01E.04B3ACB9 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi. I have very bad news for you. Unfortunately, your private data was = compromised. Your password wasxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx to events that I will explain to you now. Using your password, our team gained access to your email. We analyzed = all data and after going through found a vector for

¡Hola! Desgraciadamente, tengo que empezar nuestra conversación con malas noticias para usted. Hace unos meses conseguí obtener acceso completo a todos los dispositivos que utiliza a diario para navegar por Internet. Desde ese momento, empecé a controlar y hacer un seguimiento de todas sus actividades en la web. Deje que le cuente exactamente cómo lo he hecho: Hace tiempo, compré a unos hackers el acceso a varias cuentas de correo electrónico (hoy en día es muy fácil hacerlo por Internet). Como supondrá, me ha resultado bastante fácil acceder a su correo

I received an email claiming there was trojanware on ALL my devices for several months, they had all my contacts and were claiming to have explicit video of me (they dont) they also claimed to have screen recorded me watching porn (again a lie) but they were going to post these non existent on my families SM unless I sent £650. When I checked the address I was horrified to see that people have been falling for this since the 7th September.

Received an email with the content attached. Obvious fake scam.

25 Sep 2023 10:00:30UTC: scammer contacted us by e-mail impersonating us (sending from our own domain) with threatening content (e.g. blackmail, sextortion, ...) demanding payment to bitcoin address below Mail originating from IP: 41.248.58.177 (no abuse address found in whois databases) Mail Subject: Careful, it's important First up to 512 characters of mail body: This is a multi-part message in MIME format. ------=_NextPart_000_0024_01D9EF9F.02751B13 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi. I have very bad news for you. Unfortunately, your private data was = compromised. Your password wasxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx to events that I will explain to you now. Using your password, our team gained access to your email. We analyzed = all data and after going through found a vector for

every few days i get a copy ad paste message demanding $600USD payed in bitcoin, they provided their wallet ID.

24 Sep 2023 21:35:55UTC: scammer contacted us by e-mail impersonating us (sending from our own domain) with threatening content (e.g. blackmail, sextortion, ...) demanding payment to bitcoin address below Mail originating from IP: 31.152.226.230 (abuse report also sent to: abuse@cosmote.gr) Mail Subject: Payment associated to your account. First up to 512 characters of mail body: Hello. Unfortunately, I need to start our conversation with bad news for you. Around few months back I managed to get full access to all devices of yours, which are used by you on a daily basis to browse internet. Afterwards, I could initiate monitoring and tracking of all your activities on the internet. I am proud to share the sequence of how it happened: In the past I bought from hackers the access to various email accounts (today, that is rather a simple thing to do online). Clearly, it was not hard

24 Sep 2023 20:55:40UTC: scammer contacted us by e-mail impersonating us (sending from our own domain) with threatening content (e.g. blackmail, sextortion, ...) demanding payment to bitcoin address below Mail originating from IP: 181.234.193.92 (abuse report also sent to: admon.ip.telefonica@gmail.com) Mail Subject: Payment associated to your account. First up to 512 characters of mail body: Hello. Unfortunately, I need to start our conversation with bad news for you. Around few months back I managed to get full access to all devices of yours, which are used by you on a daily basis to browse internet. Afterwards, I could initiate monitoring and tracking of all your activities on the internet. I am proud to share the sequence of how it happened: In the past I bought from hackers the access to various email accounts (today, that is rather a simple thing to do online). Clearly, it was not hard

24 Sep 2023 20:16:11UTC: scammer contacted us by e-mail impersonating us (sending from our own domain) with threatening content (e.g. blackmail, sextortion, ...) demanding payment to bitcoin address below Mail originating from IP: 39.63.149.25 (abuse report also sent to: abuse.irt@ptcl.net) Mail Subject: Payment associated to your account. First up to 512 characters of mail body: Hello. Unfortunately, I need to start our conversation with bad news for you. Around few months back I managed to get full access to all devices of yours, which are used by you on a daily basis to browse internet. Afterwards, I could initiate monitoring and tracking of all your activities on the internet. I am proud to share the sequence of how it happened: In the past I bought from hackers the access to various email accounts (today, that is rather a simple thing to do online). Clearly, it was not hard

24 Sep 2023 19:31:30UTC: scammer contacted us by e-mail impersonating us (sending from our own domain) with threatening content (e.g. blackmail, sextortion, ...) demanding payment to bitcoin address below Mail originating from IP: 182.191.23.243 (abuse report also sent to: abuse.irt@ptcl.net) Mail Subject: Payment associated to your account. First up to 512 characters of mail body: Hello. Unfortunately, I need to start our conversation with bad news for you. Around few months back I managed to get full access to all devices of yours, which are used by you on a daily basis to browse internet. Afterwards, I could initiate monitoring and tracking of all your activities on the internet. I am proud to share the sequence of how it happened: In the past I bought from hackers the access to various email accounts (today, that is rather a simple thing to do online). Clearly, it was not hard

24 Sep 2023 18:52:45UTC: scammer contacted us by e-mail impersonating us (sending from our own domain) with threatening content (e.g. blackmail, sextortion, ...) demanding payment to bitcoin address below Mail originating from IP: 190.114.128.231 (abuse report also sent to: niellar@tpp.com.ar) Mail Subject: Payment associated to your account. First up to 512 characters of mail body: Hello. Unfortunately, I need to start our conversation with bad news for you. Around few months back I managed to get full access to all devices of yours, which are used by you on a daily basis to browse internet. Afterwards, I could initiate monitoring and tracking of all your activities on the internet. I am proud to share the sequence of how it happened: In the past I bought from hackers the access to various email accounts (today, that is rather a simple thing to do online). Clearly, it was not hard

24 Sep 2023 17:15:22UTC: scammer contacted us by e-mail impersonating us (sending from our own domain) with threatening content (e.g. blackmail, sextortion, ...) demanding payment to bitcoin address below Mail originating from IP: 102.22.184.26 (no abuse address found in whois databases) Mail Subject: Payment associated to your account. First up to 512 characters of mail body: Hello. Unfortunately, I need to start our conversation with bad news for you. Around few months back I managed to get full access to all devices of yours, which are used by you on a daily basis to browse internet. Afterwards, I could initiate monitoring and tracking of all your activities on the internet. I am proud to share the sequence of how it happened: In the past I bought from hackers the access to various email accounts (today, that is rather a simple thing to do online). Clearly, it was not hard

24 Sep 2023 17:07:59UTC: scammer contacted us by e-mail impersonating us (sending from our own domain) with threatening content (e.g. blackmail, sextortion, ...) demanding payment to bitcoin address below Mail originating from IP: 125.99.132.194 (abuse report also sent to: abuse@hathway.net) Mail Subject: Payment associated to your account. First up to 512 characters of mail body: Hello. Unfortunately, I need to start our conversation with bad news for you. Around few months back I managed to get full access to all devices of yours, which are used by you on a daily basis to browse internet. Afterwards, I could initiate monitoring and tracking of all your activities on the internet. I am proud to share the sequence of how it happened: In the past I bought from hackers the access to various email accounts (today, that is rather a simple thing to do online). Clearly, it was not hard

24 Sep 2023 16:48:07UTC: scammer contacted us by e-mail impersonating us (sending from our own domain) with threatening content (e.g. blackmail, sextortion, ...) demanding payment to bitcoin address below Mail originating from IP: 45.230.250.211 (abuse report also sent to: luis.ballon@televisoradelsur.com) Mail Subject: Payment associated to your account. First up to 512 characters of mail body: Hello. Unfortunately, I need to start our conversation with bad news for you. Around few months back I managed to get full access to all devices of yours, which are used by you on a daily basis to browse internet. Afterwards, I could initiate monitoring and tracking of all your activities on the internet. I am proud to share the sequence of how it happened: In the past I bought from hackers the access to various email accounts (today, that is rather a simple thing to do online). Clearly, it was not hard

24 Sep 2023 16:47:24UTC: scammer contacted us by e-mail impersonating us (sending from our own domain) with threatening content (e.g. blackmail, sextortion, ...) demanding payment to bitcoin address below Mail originating from IP: 177.87.5.251 (abuse report also sent to: erinaldo@netcell.inf.br) Mail Subject: Payment associated to your account. First up to 512 characters of mail body: Hello. Unfortunately, I need to start our conversation with bad news for you. Around few months back I managed to get full access to all devices of yours, which are used by you on a daily basis to browse internet. Afterwards, I could initiate monitoring and tracking of all your activities on the internet. I am proud to share the sequence of how it happened: In the past I bought from hackers the access to various email accounts (today, that is rather a simple thing to do online). Clearly, it was not hard