Ha ha ha. Vanavond kreeg ik een Engelstalig blackmail-mailtje: iemand die claimt mijn wachtwoorden en al mijn contacten te hebben, en precies weet welke vunzige videosites ik bezoek en die bovendien video’s heeft van de perverse dingen die ik achter mijn computer doe. Nu is mijn webcam afgeplakt, maar dat terzijde. Iemand zin om deze Lupe te helpen traceren? Misschien kunnen we het vod wat trammelant bezorgen. Oh en als er rare video’s van ‘mij’ verschijnen, dan weet u wat er aan de hand is :)
Eerst de mail, dan de headers.
Mail van Lupe:
I will directly come to the point. I know that link_me2 is your pass word. More importantly, I do know about your secret and I’ve evidence of this. You don’t know me personally and no one employed me to investigate you.
It’s just your bad luck that I stumbled across your misdemeanor. In fact, I actually placed a malware on the adult vids (porn) and you visited this site to have fun (you know what I mean). When you were busy watching video clips, your web browser started functioning as a Rdp (Remote control desktop) with a key logger which provided me access to your display screen and webcam. Just after that, my software program gathered every one of your contacts from your messenger, fb, as well as mailbox.
Next, I put in more hours than I probably should have into your life and made a double screen video. 1st part displays the recording you had been viewing and second part displays the view from your web camera (its you doing dirty things).
Honestly, I’m ready to forget all about you and allow you to continue with your daily life. And my goal is to offer you two options that will achieve that. The above choices either to ignore this letter, or perhaps pay me $3600. Let’s explore these 2 options in details.
Option 1 is to ignore this message. You should know what is going to happen if you opt this path. I definitely will send your video to your entire contacts including friends and family, colleagues, and so on. It doesn’t protect you from the humiliation your household will face when friends and family find out your sordid details from me.
Other Option is to pay me $3600. We will call it my “privacy fee”. Now let me tell you what happens if you choose this path. Your secret remains your secret. I’ll destroy the video immediately. You continue on with your daily life as if nothing like this ever happened.
Now you may be thinking, “I should go to the cops”. Let me tell you, I have covered my steps to ensure this message cannot be linked returning to me and it will not steer clear of the evidence from destroying your daily life. I’m not trying to break your bank. I just want to get paid for efforts and time I put into investigating you. Let’s assume you have chosen to make all this go away and pay me the confidentiality fee. You will make the payment through Bitcoins (if you don’t know this, type “how to buy bitcoins” in google)
Required Amount: $3600
Receiving Bitcoin Address: 169rDGiiDxTKknBYgLPDq4sCQJjKgejkni
(It is cASe sensitive, so copy and paste it carefully)
Tell no-one what you should be transferring the bitcoin for or they possibly will not sell it to you. The task to obtain bitcoin usually takes a short time so do not put it off.
I’ve a special pixel in this message, and right now I know that you’ve read this mail. You have 2 days to make the payment. If I don’t receive the BitCoin, I will, no doubt send your video recording to your entire contacts including close relatives, colleagues, and so on. You better come up with an excuse for friends and family before they find out. Nonetheless, if I do get paid, I’ll destroy the video immediately. It is a non-negotiable offer, thus please don’t waste my personal time and yours. Your time has started.
Headers:
Return-Path:
Delivered-To: karin@spaink.net
Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=40.92.255.32; helo=apc01-hk2-obe.outbound.protection.outlook.com; envelope-from=mamedwardoneilllta@outlook.com; receiver=karin@spaink.net
Received: from APC01-HK2-obe.outbound.protection.outlook.com (mail-oln040092255032.outbound.protection.outlook.com )
(using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits))
(No client certificate requested)
by mail.high5.nl (Postfix) with ESMTPS id 6D1E19AA7F9
for ; Sat, 14 Jul 2018 21:26:15 +0200 (CEST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;
s=selector1;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=qghn3dGNPjiUb7Dla0JPse1sKmoutEJrYqs/3hvjf2E=;
b=ZIkmhLDlNXW73lSHi9debfIyfg7hFw76+L3p5KmxCeOZ78O/DS16pNMqU7jVs4DD5pJWINzCJ0wBs18DrnLYJti2YpAG1No9VrRmKbYjlFHlH+vAvEQKhL7SeByRG0lwh/XT6s/Da8EIFiqoo5F9WyA0ycynf8cWGG1BOCDyqzi1UGMDhIF7AOvfFUIAf8xl7LfqEMrP8226IpWHtUOD5fXztB/qjSai9PtBD89SRcOrEhLCvFgHOhKps8nDrs2iPdR6PM9SATWY8UjJ3Lj/tG2JCrSNIw7v6KOdKVEHa3maBzRjyU3AGYcuCwNjNJ6DvCo1vA5VtR37S5iegDd2TQ==
Received: from HK2APC01FT005.eop-APC01.prod.protection.outlook.com
(10.152.248.60) by HK2APC01HT010.eop-APC01.prod.protection.outlook.com
(10.152.248.133) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.20.952.17; Sat, 14
Jul 2018 19:26:10 +0000
Received: from SG2PR06MB2409.apcprd06.prod.outlook.com (10.152.248.54) by
HK2APC01FT005.mail.protection.outlook.com (10.152.248.148) with Microsoft
SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.20.952.17 via
Frontend Transport; Sat, 14 Jul 2018 19:26:10 +0000
Received: from SG2PR06MB2409.apcprd06.prod.outlook.com
([fe80::b8a8:f9b2:c629:8b68]) by SG2PR06MB2409.apcprd06.prod.outlook.com
([fe80::b8a8:f9b2:c629:8b68%13]) with mapi id 15.20.0952.021; Sat, 14 Jul
2018 19:26:09 +0000
From: Lupe Samuel
To: “karin@spaink.net”
Subject: Re: karin – link_me2
Thread-Topic: karin – link_me2
Thread-Index: AQHUG6iE8WyrTKUjnU+QbCTBga/2IA==
Date: Sat, 14 Jul 2018 19:26:09 +0000
Message-ID:
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-incomingtopheadermarker: OriginalChecksum:2F256537CF006077ED14336DB5A56DD1DB33146BF3F2ADC96CEED5C599274899;UpperCasedChecksum:66B53EDA47EF6793B429CEBD02DE7C9204A6F0338D98E60BF228BE242C601DF3;SizeAsReceived:6788;Count:43
x-tmn: [BP208SReWpvtYUizdFjGIqUO3qnALeMP]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1;HK2APC01HT010;7:gL/TyZHWTdnWkRXhHVACvtc/D+CA3IBWY5pZdYqDMfFziFDAm19Fndc3IJBoGl1UwLaMV5hoUuQ38JD9jgKacm07Wt9NPeetex9iT5EIqNYPCbrTBm+WcTcLBbExe6ILwJTSGvVLk+bNRH1bViN1kg6pQq7SeccuOt/cKMQ68Pk01q02A/l7nfmqC8fGksSKpVfM1KH542hSmwdIOh9i86dg7gIYHF3WGKSddbKjsMX0DosyHvLPcfn2jIUQy34e
x-incomingheadercount: 43
x-eopattributedmessage: 0
x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(7020095)(201702061078)(5061506573)(5061507331)(1603103135)(2017031320274)(2017031324274)(2017031323274)(2017031322404)(1603101448)(1601125500)(1701031045);SRVR:HK2APC01HT010;
x-ms-traffictypediagnostic: HK2APC01HT010:
x-exchange-antispam-report-cfa-test: BCL:0;PCL:0;RULEID:(82015058);SRVR:HK2APC01HT010;BCL:0;PCL:0;RULEID:;SRVR:HK2APC01HT010;
x-forefront-prvs: 07334CBCCD
x-forefront-antispam-report: SFV:NSPM;SFS:(7070007)(189003)(199004)(87572001)(86362001)(8676002)(2501003)(5250100002)(7696005)(8936002)(106356001)(20460500001)(6916009)(74316002)(105586002)(1730700003)(5660300001)(81156014)(5640700003)(229853002)(54896002)(14454004)(55016002)(82202002)(6346003)(68736007)(25786009)(99286004)(26005)(426003)(2900100001)(486006)(476003)(2351001)(14444005)(256004)(56003)(6246003)(19627235002)(10156002)(33656002)(97736004)(104016004)(53906005)(102836004)(6436002)(98824002)(42262002);DIR:OUT;SFP:1901;SCL:1;SRVR:HK2APC01HT010;H:SG2PR06MB2409.apcprd06.prod.outlook.com;FPR:;SPF:None;PTR:InfoNoRecords;MX:1;A:1;LANG:;
received-spf: None (protection.outlook.com: outlook.com does not designate
permitted sender hosts)
authentication-results: spf=none (sender IP is )
smtp.mailfrom=mamedwardoneilllta@outlook.com;
x-microsoft-antispam-message-info: UIUU1e46EGQCTrn0M1cBDU3Yahm7igV3tA24Uy2Q0ByZm1MgCVPmwh+iA4JRIB2D1Zctyvjh0aSJJcgkBTvxq/gN1YLFDUnULb5lO5roMdzF9p5jcbLFQyUy7BzQHjjcfuiMkSl0kKBv3buJF6+kbyg88CH5xfCEKkqx6boKHXvicP3FtJn2UpwGQChY5sFtO9NaOgRYf7dpeXPL0cCfZqnpbi/A63zJVY7RiyN+8ko=
Content-Type: multipart/alternative;
boundary=”_000_SG2PR06MB2409E2937AC07AF15AE66C2BC85F0SG2PR06MB2409apcp_”
MIME-Version: 1.0
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 7181d4b0-87d6-4f4e-ba33-0d3746212cec
X-MS-Exchange-CrossTenant-Network-Message-Id: 70f93cd1-0374-4155-7f21-08d5e9bfa770
X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 7181d4b0-87d6-4f4e-ba33-0d3746212cec
X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Jul 2018 19:26:09.9517
(UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Internet
X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-Transport-CrossTenantHeadersStamped: HK2APC01HT010
–_000_SG2PR06MB2409E2937AC07AF15AE66C2BC85F0SG2PR06MB2409apcp_
Content-Type: text/plain; charset=”Windows-1252″
Content-Transfer-Encoding: quoted-printable