· 7 years ago · Nov 15, 2018, 07:58 PM
1Delivered-To: xxxxxxxxxxxxxxxxxxx@gmail.com
2Received: by 2002:a2e:2d12:0:0:0:0:0 with SMTP id t18-v6csp4372968ljt;
3 Tue, 13 Nov 2018 02:36:02 -0800 (PST)
4X-Google-Smtp-Source: AJdET5dvnXlOEWzERwkfIci6rG5SpS1Y+E0Io82MPuTiVgVYUSmRSwqoHYY+rOcPH4mhDPc0Ev/H
5X-Received: by 2002:a63:cb4a:: with SMTP id m10mr4063870pgi.105.1542105362581;
6 Tue, 13 Nov 2018 02:36:02 -0800 (PST)
7ARC-Seal: i=1; a=rsa-sha256; t=1542105362; cv=none;
8 d=google.com; s=arc-20160816;
9 b=EsxWVjbOo7j3kkvb5LTjahuP7YWje8NPoG6pTWBoMI9qboDVipG/a8MssMpkzloC7a
10 44qbugHJyHqEZ5SQyNdG2x1maIPSs7U0l6KfSxg865kTcEhcb6vqGgPw6Ld0iLWI4AyF
11 mPOGNaqIdDB5XMDX8uIyWDYKGmxuR873pcxPnrByybl9WDiiYRdYUGVIv6iMTo1tLWmk
12 i6emR5hUkttL4FYcpLW3LHwpczYVlLLUGVsL1ZEPXMu+QguIQhv94YJ1D0gnOVUUM65S
13 fNhL+kTDM5VctjCDJ7y8jzPqyZjBF1I1vtn4cd5p2/ceqRd/HHDsNnT2YmVAhQ5DrFBy
14 P4gQ==
15ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
16 h=content-language:thread-index:content-transfer-encoding
17 :mime-version:message-id:date:subject:to:from;
18 bh=71D5eYsL48KxEjyTB8j5ebKOxCVaNEaPrmyiKpTiSyg=;
19 b=Ivo6oiJjiuiPWwoTIzzdiX6fo9eYmAwpxvAui27+yNMO0cJIw5hGszD806XrMPTuN3
20 hiyFAv39pALeQ4yhTVUYTiXRMkNRR1giGPiYTY8se5wAYcqx4aaEOIqkLi09UQv9Sdq8
21 NQzQzEFNfZEk1auA3ljoBvcB2Ria2ncn5gVFFgPS5ZfegaqpXImgwk1J2sY9Q0SgBbuP
22 xw0Y2BacgfFsLLyRbYcCXsaBjxWkNRPVYr3KKZsP9u9N8UPhBA9uiJamL32o83DjeyB0
23 6QwPqrUq8fK11lOEhBE2BVLLGFCDpDw2HIUoAkkvwWuTuKBaS7aw/LKSzrcPARVSgfQE
24 cfSA==
25ARC-Authentication-Results: i=1; mx.google.com;
26 spf=softfail (google.com: domain of transitioning xxxxxxxxxxxxxxxxxxx@gmail.com does not designate 41.218.111.158 as permitted sender) smtp.mailfrom=xxxxxxxxxxxxxxxxxxx@gmail.com;
27 dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
28Return-Path: <xxxxxxxxxxxxxxxxxxx@gmail.com>
29Received: from sanzi-nossacasa-loja2-malange.cust.ao.afrisp.net ([41.218.111.158])
30 by mx.google.com with ESMTP id g69-v6si20402843plb.400.2018.11.13.02.35.59
31 for <xxxxxxxxxxxxxxxxxxx@gmail.com>;
32 Tue, 13 Nov 2018 02:36:02 -0800 (PST)
33Received-SPF: softfail (google.com: domain of transitioning xxxxxxxxxxxxxxxxxxx@gmail.com does not designate 41.218.111.158 as permitted sender) client-ip=41.218.111.158;
34Authentication-Results: mx.google.com;
35 spf=softfail (google.com: domain of transitioning xxxxxxxxxxxxxxxxxxx@gmail.com does not designate 41.218.111.158 as permitted sender) smtp.mailfrom=xxxxxxxxxxxxxxxxxxx@gmail.com;
36 dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
37From: <xxxxxxxxxxxxxxxxxxx@gmail.com>
38To: xxxxxxxxxxxxxxxxxxxgmai <xxxxxxxxxxxxxxxxxxx@gmail.com>
39Subject: Account Issue. Changed password. (your password:xxxxxxxxxxxxxxxxxxxgmai)
40Date: 13 Nov 2018 11:29:52 +0000
41Message-ID: <002a01d47b45$072790d5$6fe4f68e$@gmail.com>
42MIME-Version: 1.0
43Content-Type: text/plain; charset="ibm852"
44Content-Transfer-Encoding: 8bit
45X-Mailer: Microsoft Outlook 15.0
46Thread-Index: Acvs5bjhyunmf6l4vs5bjhyunmf6l4==
47Content-Language: en-us
48
49
50
51
52
53
54
55Dear user of gmail.com!
56
57I am a spyware software developer.
58Your account has been hacked by me in the summer of 2018.
59
60I understand that it is hard to believe, but here is my evidence:
61- I sent you this email from your account.
62- Password from account xxxxxxxxxxxxxxxxxxx@gmail.com: xxxxxxxxxxxxxxxxxxxgmai (on moment of hack).
63
64The hacking was carried out using a hardware vulnerability through which you went online (Cisco router, vulnerability CVE-2018-0296).
65
66I went around the security system in the router, installed an exploit there.
67When you went online, my exploit downloaded my malicious code (rootkit) to your device.
68This is driver software, I constantly updated it, so your antivirus is silent all time.
69
70Since then I have been following you (I can connect to your device via the VNC protocol).
71That is, I can see absolutely everything that you do, view and download your files and any data to yourself.
72I also have access to the camera on your device, and I periodically take photos and videos with you.
73
74At the moment, I have harvested a solid dirt... on you...
75I saved all your email and chats from your messangers. I also saved the entire history of the sites you visit.
76
77I note that it is useless to change the passwords. My malware update passwords from your accounts every times.
78
79I know what you like hard funs (adult sites).
80Oh, yes .. I'm know your secret life, which you are hiding from everyone.
81Oh my God, what are your like... I saw THIS ... Oh, you dirty naughty person ... :)
82
83I took photos and videos of your most passionate funs with adult content, and synchronized them in real time with the image of your camera.
84Believe it turned out very high quality!
85
86So, to the business!
87I'm sure you don't want to show these files and visiting history to all your contacts.
88
89Transfer $838 to my Bitcoin cryptocurrency wallet: 1ARbihuSkEAojNHgxsgFVKjTJDHXuimB8
90Just copy and paste the wallet number when transferring.
91If you do not know how to do this - ask Google.
92
93My system automatically recognizes the translation.
94As soon as the specified amount is received, all your data will be destroyed from my server, and the rootkit will be automatically removed from your system.
95Do not worry, I really will delete everything, since I am 'working' with many people who have fallen into your position.
96You will only have to inform your provider about the vulnerabilities in the router so that other hackers will not use it.
97
98Since opening this letter you have 48 hours.
99If funds not will be received, after the specified time has elapsed, the disk of your device will be formatted,
100and from my server will automatically send email and sms to all your contacts with compromising material.
101
102I advise you to remain prudent and not engage in nonsense (all files on my server).
103
104Good luck!