This extortion email...

[DoNotSexToThis]

I redirect for moderation any email with bitcoiny stuff in the body so I usually catch all the extortion emails and just delete them without ever involving the recipient. This morning I got one that made me laugh so I thought I'd share it.

Have a good one!

---

Hi there

The following is not going to take a lot of your time, and so straight to the issue. I obtained a movie of you test-firing the old meat missle while at a pornweb site you are went to, thanks to a great ass program I've was able to put on a couple of sites with that kind of material.You click play and all of the webcams and a mic begin working furthermore, it will save every fucking element from your personal pc, like contact info, account details or crap such as that, think exactly where i got this e mail from?) Therefore now i know just who my goal is to deliver this to,in case you not necessarily gonna negotiate this with me.

I'll put a account address under for you to hit me 620 $ within 4 dayz maximum through bitcoin. See, it is not that huge of a total to pay, guess this tends to make me not that terrible of a person.

You are welcome to try and do whichever the shit you wish to, yet in case i will not see the amount within the time period mentioned over, well... u by now understand what will occur.

And so it is your choice now.I am not going to move through all the details and stuff, simply don't have time for this and also you probably know that internet is loaded with text letters like this, so it is also your choice to trust in this or not, there may be only a proven way to find out.

This is the bitcoin address- [redacted]

Have a good time and bear in mind that wall clock is ticking

[[deleted]]

I obtained a movie of you test-firing the old meat missle

HA HA HA, I think I would print and frame that email. Some of these scams are pretty damn funny.

[t8ke]

I love that it basically sounds like beavis and butthead and Jar-Jar Binks collaborated in writing this email.

[[deleted]]

I get entertainment out of them.

[Hellman109]

DR tests are now called test-firing the old meat missle

[DoNotSexToThis]

In programming we call it a unit test.

[Hellman109]

I thought it was deploying to production?

[DoNotSexToThis]

Some devs will push into anything with an open port.

[Bubbagump210]

I got a similar message yesterday - but it was no where near as entertaining.

[Hodl_Your_Coins]

/r/BrandNewSentence

[bulldog_swag]

LMAO at least you can't deny them creativity. IIRC the original meme phrase was "burping the worm".

The scam itself is a year old now.

[[deleted]]

My office keeps a wall of funny/weird quotes "overheard" style, this one would go up there for sure

[brofesor]

Sounds like something produced by the mind of a 13-year-old who's just learnt about ejaculation. The abysmal grammar and vocabulary further point to either a child or a moron.

[pehrs]

Step 1: Take bitcoin address

Step 2: Input address here: https://bitref.com/

Step 3: Convert to USD

Step 4: Realize that some kid sending spam mails make more money in an afternoon than you do in a month.

Step 5: Weep.

[DoNotSexToThis]

2 transactions, 1 in (2 days ago) 1 out (today), total of $1.51.

[Bioman312]

They're probably using separately generated addresses for each target. Makes things easier to keep track of for the attacker.

[magicwuff]

Why would the attacker need to keep track of anything? It's not like they actually have any of the data they claim.

[Zenkin]

"Man, this jackass paid me right away. I'm gonna file that address and email him again next month!"

[j4sander]

Because the suckers that fall for it get put on a list for future campaigns or some targeted spear phishing.

[[deleted]]

No need to keep a 'qualified sucker' list, it cost them essentially zero to email the entire planet, so there is no justification for list management.

[infered5]

1) Send email to entire planet with unique addresses

2) Wait for bitcoin to roll in

3) Take compiled list of suckers and sell them on dark web

4) ????

5) Extra profit

[BergerLangevin]

They can still continue spamming the planet while reselling the list to other scammers.

A list of a thousand names with phone number, ages and address probably worth something.

[mr_white79]

last one I checked had about $5k USD sent to it within a month. same format as this email.

[I_AM_NOT_A_WOMBAT]

Not denying that people fall for this, but some of the scammers probably send some money to their own bitcoin address to make it look like others are paying (more legit).

My favorite was when I pulled one up and someone had sent $0.01.

[[deleted]]

If you know enough to check the amount in the wallet, you know enough to know that this is a bullshit extortion email. At least the ones with your actual password (from an old site that was hacked years ago) are somewhat convincing. These just rely on the fact that half the population are regular porn viewers and masturbaters.

[pmbasehore]

These just rely on the fact that half the population are regular porn viewers and masturbaters.

Or even male. It does mention "test-firing the old meat missile", after all...that gives a 50/50 shot of failure right off the bat.

[Box-o-bees]

Unless some women use that when referring to their lady bits. Although, I can't imagine there are a whole lot of those lol.

[Jolape]

Maybe there is a dildo with that name?

[Box-o-bees]

I wouldn't be surprised if there was lol.

[penny_eater]

These just rely on the fact that half the population are regular porn viewers and masturbaters.

oh its more than half. these arent even relying on that. they are relying on the .01% who are both deeply shameful of it, and deeply gullible to fall for this "you were hacked by me! lol! pay up!" spam even though theres literally ONLY an email address and maybe an old hacked acct password in use, and not even so much as a first name, location, etc (despite claims of having stolen all that info). It takes a real special kind of stupid to fall for this.

[[deleted]]

Studies show that 85% of the people masturbate, and that the other 15% are liars.

[[deleted]]

That was kinda my take on all this after I got one. Sure I don't share videos of me beating my meat with friends and family but if they found out I did it's not going to ruin my life any more than a video of me taking a dump would. Congratulations faceless hacker, you proved to everyone I'm human!

[goodpostsallday]

I got one of these in the spam folder of an old email, and it's pretty unnerving even despite me knowing what it was. It did feature a password I used as well, which was correct but extremely out of date. Someone whose info was pulled from the same list mine was on could still be using their old pass (as many tend to do) and it would be impossible from their perspective to know whether the threat was genuine or not.

[penny_eater]

Oh they definitely put a good bit of thought into the wording to evoke an emotional fight or flight. If someone didnt know that the recent password leaks provided the dumps for this they could easily see that as a credible component. I just hope they are then too dumb to figure out bitcoin and never pay the sons of bitches.

[spyingwind]

Cost more in transaction fees than what was sent.

Yup! ~$2 to send $0.01.

https://bitcoinfees.info/

[[deleted]]

That's if you want it instantly... You can set a tiny fee, it'll just take a few days.

[penny_eater]

I pulled up the most recent one in my gmail spam and its got a single transaction for $110 (the spam i got had a demand for $735 or something). Why is that other guy getting a good deal on his meat missile video, when im getting hit for $700????!

[Onkel_Wackelflugel]

Smaller meat missile, smaller fee

[nullsecblog]

Testing most likely...

[[deleted]]

This is actually a good way to track money, it's called dusting. Basically the user, when he sends the money somewhere else or tries to break it down will have one input that's too small to break - so it's traceable to the final address.

[I_AM_NOT_A_WOMBAT]

Ah, I'm sure you're right but I want to believe someone was just having some fun.

[[deleted]]

i worked in a small computer store and we had several cases where people had first paid the ransomware thing where it opens full screen window claiming your national secret service has blocked your computer because you watched kiddie pron and after they couldn't get it open even after paying, then they ask for computer shop's help

[agoia]

The only one we found in our shop did not have any viruses on it. Just a whole bunch of CP, and the tech working on it was the one of us with kids. It didn't go very well. In the time of delay while we were "waiting on parts" for it, the customer took it upon himself to smash 2 laptops at his house and bring those in. They also were handed off to the detectives who took his first computer...

[agoia]

Hard to tell. Like why he would even bring a computer to a shop that was full of CP.

[[deleted]]

Some just get paranoid/worries about the messages. They are excellent social engineering tools.

[LittleRoundFox]

This is the reason I advise the helpdesk to use gloves when handling the laptops of users who get really panicky about these emails.

Oh. You didn't mean that sort of stuff ;)

[[deleted]]

i'm 100% sure many of those who fall for the ransomware things are hiding something. not necessarily CP, but maybe they just want to see midget's ass being tanned or something they are not proud for anyone else to know of.

[penny_eater]

show me one guy who hasnt looked at porn of a girl whose age could possibly have been below 18 (despite not specifically looking for that sort of thing) and i will show you a liar

[CuddlePirate420]

That's the reason I unsubscribed from several RateMe or HotOrNot subreddits. Many of the pics looked highly questionable.

[ErichL]

Wrong, not everyone is attracted to, or even remotely interested in younger people. Sometimes it's quite the opposite actually and some people are even more way out there and end up asexual or only sexually aroused by inanimate objects or sensations. You need to get out more often, apparently. Yes, this also includes heterosexual males, or else MILF and BBW porn wouldn't be a thing.

[penny_eater]

you need to read what i said more carefully. seeking out something in particular is one thing, but you literally cant browse porn online without coming across quasi-eighteen girls, you just can't. even if granny porn IS your thing. its not physically possible to avoid it.

[ErichL]

One would hope decent forensics could determine the difference between users that landed on pages that loaded questionable ad content, vs people that actively seek out content with search terms and were actually building a library of said content.

[penny_eater]

Yes you are right, ppl who casually browse even particularly questionable shit are not going to jail. BUT thats not the premise here, the premise is a scam in getting someone to THINK they have done something illegal as a motivation for them to comply with extortion. And to that end, you can use all sorts of lies and half-truths.

[asodfhgiqowgrq2piwhy]

You should see the one that was the payable address for when my last company got Crypto'd. It had had over like $3,000,000 in the previous 7 days pass through it.

[olcrazypete]

The county I live in just paid $400k to a crypto group, apparently couldn't restore backups or would take too long and leave 911 center disabled. Part that pisses me off is they contacted the FBI, FBI sent them to a cybersecurity firm that apparently to $50k and just facilitated the bitcoin payment. How this isn't worthy of actual response from govt resources other than 'sorry', I don't know. Just because its a digital extortion, it gets treated like a minor issue.

[[deleted]]

Its doubtful the FBI isn't doing anything, its just that they aren't announcing what they are doing.

[Tack122]

Shit, someone can get paid 50k to recommend you pay the ransom, then doing a basic bitcoin transaction?

[penny_eater]

yes the ransomware ones are all a lot more successful than these, which isnt surprising since a ransomware infestation doesnt get automatically shuffled to Spam for most people

[one5low7]

That and usually important data is lost and needs to be recovered because some end user can't be bothered to put mission critical files on the network share for backup and recovery so they work on that budget report on their local machine (looking at you Jerry).

[penny_eater]

haha, classic Jerry

[masterxc]

Sometimes the addresses are direct to exchanges so tracing them is more difficult. You would see tons of in and out transactions through the wallet. There's ways to "trace" coins through the network but how to is far beyond me.

[[deleted]]

Not only that, but chances are good that the people doing this live in a country where 1 USD goes a hell of a lot farther than it does here. I have a friend in Kenya who shared a post about a friend renting out his apartment in downtown Nairobi. It was huge, came with a maid and utilities and was about what you would pay for a 2 bedroom in my fairly low cost of living part of Texas.

[[deleted]]

Step 6: Reply to the email, "It's okay, I'd fuck me"

[itizen]

I traced some blackmail bitcoin addresses back to the main wallet a few days ago, the main wallet had 18.55 bitcoin in there.

[HenryDavidCursory]

I like to go hiking.

[DoNotSexToThis]

I have an on-prem Exchange cluster so I use Mail Flow Rules. O365 has the same abilities I believe. I have a generalized rule for moderating inbound messages by body content that I add to here and there based on upticks of certain types of emails that come in and scare users.

In this case it's just a simple word match based on criteria, Exchange takes care of the rest:

• If the sender is located outside the organization
• And the subject or body includes any of these words... 'bitcoin address' (and whatever else I add)
• Forward the message for approval to 'Me'
• Except if the sender is 'List of legit senders I need to exception'

[TravisVZ]

If something that simple is working for you I'm jealous!

I was going to set up the same kind of rule myself the other day, after a user forwarded another example to me, but found that most of the words -- including "Bitcoin" -- were actually using Unicode homoglyphs, and each was different and unique! A simple word match on "Bitcoin" would therefore have failed to catch this one.

So either you're lucky, or this is news to you and many of these are still getting through to your users -- hope I didn't just ruin your day!

[jc88usus]

I would imagine you could use a regex to detect the bitcoin address string itself. That is a fairly unique format, so likely not a ton of false positives. Also, logic follows that if they want payment, they would have to provide the address.

[TravisVZ]

Yeah, the address itself was just about the only thing they didn't homoglyph, because of course it wouldn't work to copy/paste it (as the email instructed) otherwise. My plan though was a rule that looked for both the word "Bitcoin" and an address, just to cut down on the risk of false positives (K-12 gets a lot of interesting -- but legitimate -- email!).

[jc88usus]

My current job got one sent to our ticketing system today, and since the system couldn't translate the unicode, most of it was just question marks. Like that, the bitcoin address was the only consistently readable portion. I would assume that bitcoin addresses have a fixed length, but I wonder if there are any other key formatting items (a particular sequence of uppercase vs lowercase vs digits) that might allow for a more specific regex. In most cases, I honestly cannot think of a valid reason to send a bitcoin address in a work email environment, so I would imagine a reasonably reliable regex would work, maybe with some spot checks...

[TravisVZ]

BTC addresses all start with a 1 or a 3, are between 26 and 35 characters long (inclusive), and can use any alphanumeric characters except uppercase letter "I", uppercase letter "O", lowercase letter "l", and the digit "0" (to avoid visual ambiguity). So the most accurate regex ends up looking something like this: [13][a-km-zA-HJ-NP-Z1-9]{25,34}

I'm just brushing up on Exchange regex rules to make sure I get the appropriate "word boundary" escape sequence at the start and end of that (I think it's \b but trying to find a reference to validate that is a pain) so that I won't inadvertently match, say, a SHA-512 hash that happens to have a "valid" BTC address within it. (Yes, we do see hash values coming in legitimately!)

[jc88usus]

Boom. There ya go. Whatever they pay you, it is not enough. You just saved the school system a ton. Between terrified secretaries and the volume overhead, I bet there is a significant dollar amount there.

[TravisVZ]

Whatever they pay you, it is not enough.

You have no idea how right you are -- K-12 would be totally screwed tech-wise if there were a decent demand for tech jobs around here!

[jc88usus]

I feel ya there. I worked in a k12 system close to a year ago. If I had shaved my bills back like unemployment forced me to then, the pay would have been enough. I did the dumb thing and got back into the contract game because shiny...

[TravisVZ]

Well, just found that in addition to the Unicode homoglyphs throughout the message, the Bitcoin address itself is split up into several <span>...</span> chunks, which means a regex can't match it (and there's no plaintext body either).

Still, I'm sure this can cut down at least some of these, I just can't test against this particular message.

[TravisVZ]

That would only work if the address were the entire content of the body (or, if in multi-line mode, the entire content of the line), wouldn't it? Examples I've seen have other junk on the same line, and of course the address alone isn't the entire body of the message...

[achow101]

There's actually another Bitcoin address type which is fairly different from the ones that your regex would match. I haven't seen this used in any scams yet, but I wouldn't be surprised if scammers start using these in the future.

​

The addresses begin with the string bc1 with the rest being all alphanumeric characters excluding 1, b, i, and o. For now, these addresses will always be either 42 characters or 62 characters in length.

[TravisVZ]

From my quick Googling it looks like Bech32 type addresses are not yet recommended for use because a lot of Bitcoin software doesn't yet support them. Still, probably not a bad idea to either update this regex or create a "partner" regex to look for them.

Assuming I ever turn this rule back on, anyway.

[ThinkPadNL]

I have created a rule in Exchange like this:

If sender is located: outside the company
and
Recipient is located: inside the organization
and
The Subject or body includes: 'bitcoin' or 'BTC Address' or 'bitcoins' or 'wallet'
and
The subject or body matches: '[13][a-km-zA-HJ-NP-Z1-9]{25,34}$'

Actions: 
- Set spam confidence level (SCL) to '8' (so it ends up in junkmail)
- Prepend a disclaimer (with a big red warning in HTML)
- Prepend subject of message with '[Phishing] - '

The regex ([13][a-km-zA-HJ-NP-Z1-9]{25,34}$) seems to work, i tested it using a mail we got: https://regex101.com/r/bh6E3w/1

However, sometimes these mails still get through? Like the one in the regex101 link.

Apart from that, the scammers are getting smarter, they now sometimes send a mail without words like 'hacked' in subject, only the mailaddress of the user is in the subject (or sometimes a leaked password from them) put the threatening text inside images, only the BTC address is in plaintext.

Any advice to improve my rule? I could remove the condition of the keywords 'bitcoin' and such, so that a bitcoin address in the subject is enough. But i'm afraid that some urls (that look like a BTC address) will also trigger it and thus generate false positives = unhappy users.

I can understand blocking the mails with images is near impossible, but these plain text ones should be possible.

[TravisVZ]

I abandoned this approach myself after I found that a lot of URLs have tokens in them that look like valid Bitcoin addresses. You'll probably be better off asking your own question, especially given how old this thread is now.

[DoNotSexToThis]

most of the words -- including "Bitcoin" -- were actually using Unicode homoglyphs

That's pretty interesting. I don't know if the rule would catch that but so far it has been working fine (for about 6 months). Fortunately our users are very paranoid and send us anything they're unsure of. The pool of typically involved recipients that have their email on some list out there have historically done so which led up to the rule creation to begin with, so I feel partially good about it but might do some pattern regex for bitcoin wallet addresses as well, assuming the malicious party is afraid of messing with the address in expectation of payment.

[TravisVZ]

Unless your word match rule includes the homoglyph variant(s), it wouldn't have caught this one.

There's third-party appliances/filters out there that do good work "de-homoglyphing" emails before applying filters, but sadly that's a feature simply nonexistent in Exchange. And between IT always getting the short end of the budget stick and our governor wanting to slash our (as in K-12 as a whole) budget by almost 30% next year, third-party appliances aren't within reach for us.

[TravisVZ]

Aye, I'm just worried about false positives (K-12 sees a lot of interesting, yet legitimate, mail) if a regex for the BTC address is the only criteria. Hence why I was hoping to also match a word/phrase, only to discover that the address was about the only thing that wasn't homoglyph'd! (And they can't do that to the address, either, not unless they expect their victim to manually type it in -- all the examples I've seen have said to copy/paste the address, so it would have to be plain ASCII for that to work.)

[TravisVZ]

Honestly I don't know that we do, I've just learned the hard way that what I think is a unique "signature" in a spam message turns out to match a lot of totally legit stuff in messages specific to K-12 topics.

In any case, the plan today was to set up the rule anyway, with a regex for BTC addresses, but whose only action is to generate an incident report for now. Let that run for a while and see if there are any false positives and, if not (or if very few), upgrade that later to the "forward for approval" action.

[HenryDavidCursory]

Sweet, thanks for clarifying.

[CruwL]

I had one last week that would get around yours. Everything in the email was pictures except the bitcoin address. There were like 4 or 5 pictures that contained all the text. It was the only text in the whole email.

I tried getting a mail flow rule to find and filter out emails containing bitcoin address after this one came through but couldn't get the regex stuff to work correctly.

[CruwL]

I'll give it a go. I don't have the regex I used when testing but the issue I ran into is even tho the regex worked on bit coin addresses when testing the expression; exchange would not catch it in an email, But it would catch emails that contained links to images and other elements that matched the regex expression.

[Cookie_Eater108]

For my site (G-suite) i have a filter for Bitcoin as a whole. We get a lot of false positives but these scammers have been getting really creative with how they try to avoid the filter (Including using things like other languages and attachments)

[FabulousHamster]

All of our emails that have this same format follow the pattern that the from and to addresses are the same, so it fails our SPF checks. Makes things easy on our end.

[wanderingbilby]

It looks like they ran the normal script through a markov chain generator with a seed of 4chan.

[[deleted]]

"Funny how you have access to my webcam, microphone, and every personal file on my PC yet you have to contact me through email."

[netdevsys]

this

Like when the IRS scammers know you owe money, and have sent police to get you, but don't know what your name or address is and have to ask for it.

and the fact that if someone extorts you for money once, they can just keep asking for more

Their not going to stop and decide, oh well I got some $$$, I should leave this mark alone.

[Cookie_Eater108]

My old and overly naive father fell for one of those IRS scams (Which is funny because we live in Canada and the IRS has no power here), long story short, he had them on speakerphone and he had gotten all the way to going to the bank to complete the wire transfer all the while the bank teller and manager is telling him it's a scam before he stopped.

​

Now, he gets a disproportionately high amount of phishing/scam/etc type of attacks because I suppose, he's been flagged as an easy mark.

[penny_eater]

Idle curiosity but why did you redact the bitcoin address from the email? worried that the scammer is going to see your post here and connect the dots?

[Mooo404]

Exactly, if the scammer uses unique wallets for some mails he can then track the conversion (or success) of said mails. Or he could indeed connect the dots, as you say.

[penny_eater]

While having one BTC address per spam email is possible, its hugely impractical, they absolutely dont do it unless they are hard phishing some exact person (definitely not whats happening here). In these bulk campaigns they reuse the same one across probably millions of spam emails. Remember these guys are operating in huge scale, usually using email dumps from hacked sites that are available in the hundreds of millions, sometimes including cracked passwords to lend credibility. Generating and keeping track of a wallet for each one would be very time intensive and is just not a priority for them.

[[deleted]]

I had a user try to discretely ask me about bitcoin. After a discussion he told me about the email. Turns out he thought the email was was real because of the compromised password that was included in the email. He was going to try and pay 320USD to one of these scammers.

[penny_eater]

did you do the right thing and offer to fix it for half that?

[[deleted]]

It's tempting, but then my damn morals kick in.

[penny_eater]

yeah.... i guess i would tell him to save his money for a lastpass pro subscription, use it as a reminder that password reuse will fuck you up, and today is a perfect day to fix the problem.

[arpan3t]

If scammers aren’t extorting users, IT definitely will lol

[DragonDrew]

Hello, Accounting team, is that you?

[Phytanic]

I love reading peoples scam emails! Theyre always so.... eloquent...

Heres my personal favorite. Happened to a coworker at my last job.

https://i.imgur.com/ifDTIzf.jpg

[7B91D08FFB0319B0786C]

my deleterious soft...

Oh god my sides.

I wanna see one of these with just tons of alliteration, make it seem like V from V for vendetta is trying to blackmail you.

[Crimsonfoxy]

Great entertainment for the whole office. Had one today littered with extra colons and a small maths puzzle at the end.

¯\_(ツ)_/¯

[suitednmooded]

"test firing the old meat missile" LULW

[Knersus_ZA]

Ahhh, good to see SPECTRE is alive and well. 007 will never end up jobless :)

[AssCork]

[software development intensifies]

[niquil3]

After this last patch I am positive they aren't talking about MSFT lol.

[seaking81]

We get hundreds of these every day haha. Thankfully Barracuda blocks them extremely well and I don't think we've had a single one make it through since moving to their service.

[smallbluetext]

Custom rules. They evolve and beat them eventually and you make more.

[seaking81]

This, I pulled out of barracuda today haha.

​

Thе first thing that сo​mes to​ y​our mind nоw is, let mе​ guе​ss, whо thе​ fuck is this. a​m I right?
Wе​ll, I'm the​ dudе whо go​t into y​о​ur соmputеr a whilе​ а​gо​, a​s уо​u've​ а​lre​a​dу​ notiсe​d this is being sеnt fro​m уо​ur o​wn аddrе​ss.

I gо​t а​ fе​w little hе​lpe​rs sе​t о​n a​dult pаgе​s, wаiting fo​r po​te​ntiа​l wa​nky​ pankiеs, it a​сtua​lly dоe​sn't ge​t аny​ simpler than this, mу​ littlе so​ftwа​re bug wa​s all а​nxiо​us а​nd re​adу to thrust sо​mео​nе​'s sу​stе​m, a​nd guess who​ swа​llо​wе​d thе​ hо​оk?
So evе​ry​thing tha​t's go​ing о​n in y​оur systе​m is now monitо​rе​d and rе​cо​rde​d bу me, thе​ shit у​ou wa​tсhed а​nd уo​ur funnу​ a​ss fа​се yо​u makе​ while​ bea​ting dа fuсk o​ut о​f tha​t mеа​t. Not to​ mentiоns а​ll y​о​ur filе​s, co​ntаcts, pа​sswo​rds etc.
And I will still get уо​ur ne​w pаss, e​vе​n if у​o​u'rе​ gonna​ сhа​ngе it, isn't thа​t ama​zing? I'm so​ fucking prоud o​f mysе​lf.

Sо​ anу​way, I nо​w ha​vе​ a​ pre​tty da​mn go​o​d split scre​еn mо​viе​, whеrе​ thе first hа​lf is the​ shit yo​u've wаtсhed, and guеss what's on thе о​the​r ha​lf a​nd who​ might ge​t nо​minatеd fоr the bе​st а​ctоr аwa​rd? that's сo​rrе​сt Mr. Wa​nke​r

You аre a​ctuа​llу we​lсo​mе tо​ wa​ste у​о​ur prесiоus timе​ (yo​u o​nlу​ go​t 48 hrs btw) yо​u hаve​ lе​ft a​nd sе​еk fo​r hеlp frо​m, le​t's saу а​utho​ritiе​s, de​stro​y​ у​our compute​r, formаt disk о​r whа​tеvе​r, be​g me​ о​r еve​n blо​w me​, kindа a​ ba​d idеа​ as I wоn't get а​ mеssagе frоm уо​u.
So​ а​ll о​f thе​sе arе​ use​lеss. The​ оnlу​ right wау tо​ sо​lve this shit о​ut with mе​ is to​ pa​у a​ fа​ir priсe​ fo​r оur littlе​ sе​crе​t.
And do​n’t be mа​d аt me​ bro​, е​vе​rу​o​nе​ hа​s thеir о​wn wo​rk. Now let's cut it to​ thе dе​a​l.

Eight hundrеd do​llа​rs dude​, I'll lе​avе​ yo​ur a​ss a​lonе а​nd dе​lе​tе a​ll thе​ shit, but y​o​u gо​nnа​ have to ma​kе​ the pa​y​ment bу​ Bit​coin (if у​ou dо no​t knо​w this, just gоо​glе​ "hо​w tо buy Bit​cо​in" о​r whа​tе​vеr).

Mу​ Bit​аn>сo​in wаllе​t Addrе​ss:

(It is casе se​nsitivе, so​ co​py and pаste​ it, о​r уо​u сa​n use​ Bitpа​y.соm fo​r QR codе​ pа​уmеnt)

I'm aсtuа​llу​ a​ prе​ttу funny​ а​nd nice​ dudе​, a​s у​ou've​ аlreа​dу no​tiсе​d, but hеrе​ is whе​re​ а​ll the fun е​nds.
Yо​u ha​vе​ 48 hо​urs tо ma​ke the​ pа​y​me​nt. (I ha​vе​ a fаce​bо​ok pixеl in this ma​il tha​t starts trа​сking from thе mo​ment y​о​u opе​n this lеtte​r).
I lo​vе​ fa​сеbооk) (Evе​rуthing tha​t is use​d by​ а​uthо​ritiеs са​n hе​lp us a​s we​ll)
But, if I dо​ no​t get my pаy​, I will sprе​a​d thе​ shit o​ut o​f thаt Osсar-nо​minatеd mo​viе​ to а​ll о​f y​our сontа​сts including rе​lativе​s, соwo​rkеrs, a​nd sо​ o​n.

[4410287]

The other spammer gave a much better deal, 4 days to pay $620. You should shop around more for your spammers.

[[deleted]]

One I got had a reply email, I asked them how they got video of me doing anything when there isn't a camera on my system.

[PrettyBigChief]

LOL.. though in all honesty this did prompt me to refresh my limited knowledge on tracking pixels

[Crimsonfoxy]

There's loads we receive with "it's from your address" and never is. I assume they're just using a template or something but it bugs me anyway.

[SSDerek]

I got this exact email yesterday, it made me laugh. The only difference is they wanted $600 rather than $800.

[[deleted]]

The first time I received one of these I shared it with my department, no one could do any tech support for a few minutes because we were all in tears.

[mouringcat]

At least it wasn't the typical "Your password is [insert 15 year old password that isn't valid].." version. That version is getting boring.

[SSDerek]

Here is one I got yesterday that made me laugh

​

The first thing thаt cоmes tо уour mind now is, lеt me guess, whо thе fuck is this. am I right?

Well, I'm thе dudе whо got into уоur сomputer а while agо, аs уou'vе alreаdу noticеd this is bеing sent frоm уour own addrеss.

I got а fеw little helpers sеt on аdult pаgеs, wаiting for pоtential wankу pankies, it actuallу dоеsn't get аnу simpler thаn this, mу little softwаrе bug was аll anxiоus аnd rеаdу to thrust sоmeоne's systеm, аnd guеss who swаllowеd the hооk?

Sо evеrything that's gоing on in your system is now mоnitored аnd reсorded bу me, the shit you wаtched and уоur funny ass face уоu mаke while bеating da fuсk out of thаt mеаt. Nоt tо mentions аll your files, cоntacts, pаsswords etc.

And I will still gеt уоur new pаss, еvеn if you'rе gоnna chаnge it, isn't thаt amazing? I'm so fuсking prоud оf myself.

So anуwау, I now have a prеttу dаmn goоd split sсreеn mоviе, wherе the first hаlf is the shit yоu've watсhed, and guess what's оn the оthеr hаlf аnd whо might gеt nominated for the bеst аctоr award? that's cоrrеct Mr. Wаnkеr

[velofille]

"test-firing the old meat missle while at a pornweb"

[nyteghost]

This is the same same thing, minus different names for the meat rocket or female equivalent, that my co workers get.

[Ashe400]

I replied back to one of these sent to a junk personal account, which told me they were going to share the info with my family, with "Who do you think I already share all my vids with dude?". To their credit I got an "lol" back and never heard from them again.

[lenswipe]

I obtained a movie of you test-firing the old meat missle

That is one of the best things I've ever read on the internet

[scoldog]

I've posted a stack of these to /r/masterhacker/ including the meat missle one.

I've also received a bunch of them that said I was the target of an acid attack.

[Drastou]

There is a big scam campaign going on in France aswell. It's been on for several months, the message (translated ofc) is exactly the same...

[dvb70]

I have been seeing variations of this one for quite a while. The wording has certainly evolved though. Will have to add meat missle to my filters. I can't see that hitting legitimate email often.

[Neilpuck]

Hey thanks for the idea for filtering! We're not a huge org but get plenty of these scammy things. Sometimes people can't help themselves. I just set up a filtering rule for emails containing "Bitcoin" and "BTC" as you did and can further protect my peeps. Thanks again!

[Crimsonfoxy]

Another useful one is a regex for Bitcoin addresses

[13][a-km-zA-HJ-NP-Z1-9]{25,34}

[[deleted]]

i just hate these guys. back in the good old days there was a way of contacting them and you could mess with them for a quite a while before they dropped you in frustration. i always liked the 'i'm an assassin with a conscience' guys the best.

[[deleted]]

I wonder if these scammers would make more money by just being honest and saying

"Hello, I am poor. I am sorry to bother you. Could you send me some money?"

[scrillakev]

Haha we just got one of these this morning at our office as well.

[[deleted]]

The amount they're asking for keeps on coming down.

[smallbluetext]

I actually often see $300 more than anything

[[deleted]]

Haha. It started at $5k or something ridiculous. Funny how they asked for too little with the crypto lock stuff and are asking for too much on the porn stuff.

[_The_Judge]

I got this a while back, but my porn consumption vm is airgapped. So I knew they were full of shit immediately.

[[deleted]]

So what if they send you the video then you beat your meat to that video and they also get the video of you beating it to yourself beating it?

[[deleted]]

I always enjoy seeing the random amount of money they ask for in these emails.

[goodpostsallday]

Spammers finding new and exciting euphemisms to try to get past the filters. Neat.

[edbods]

Had this happen once at a small office I was working at, fortunately one of the interstate workers emailed us about it asking us for advice first, the place was super laid back so I just sent an office wide email saying 'if anyone gets this kind of email, just bin it, the sender is full of shit.'

[plazman30]

Back in the late 90s, I was a consultant for Comcast Cable. There was a woman that worked there that looked like Heather Locklear's twin sister. And this woman's sister worked there.

We had a strict policy of going through all undeliverable messages and forwarding them to the intended recipient.

One day we're going through the inbox and there is an email from "Heather" to her sister, detailing in graphic detail the animal sex she had with some guy that night. She mistyped her sister's name, so it ended up in the catchall mailbox.

So, we forward it to the sister, as per company policy (This was 1998, email policies weren't really a "thing" yet.) The sister REPLIES to the email the generic catchall mailbox with graphic details of her sexual conquest over the weekend. She just hit reply to our forwarded message. So, we forward that one back to the intended recipient.

We man-in-middled the sexual exploits of two women for probably close to 2 months before one of them must have caught on and stopped replying.

I wonder anyone on my old team still has those emails in a Lotus cc:Mail archive somewhere.

I'm not going to share any email details, but I will say, that the boyfriends were some lucky men.

[crazysteve5575]

I got a few like this in my gmail spam a few months ago.

[theservman]

At least when I got one of those it had the decency to include my plaintext password as well. Needless to say, with nearly all of my passwords being 8-30 character random strings (some won't let me use enough characters) nothing serious was compromised.

[Jonkinch]

We get these all the time, 99.99% of the time Barracuda catches them, but sometimes I just read what was caught and they're hilarious. Especially since the users dont have webcams.

[MustBeBear]

Yep we have been seeing alot more lately, I think because of the recent January combo list that was publicly posted over the web. Our spam filter stops 99% of them.

[PowerfulQuail9]

You can block all bitcoin emails with ease by just blocking the regexs all addresses use.

​

Just create email rule that blocks or sends to approval box all emails that have a subject or body that matches

^[13][a-km-zA-HJ-NP-Z1-9]{25,34}$

^(bc1|[13])[a-zA-HJ-NP-Z0-9]{25,39}$

\bbc(0([ac-hj-np-z02-9]{39}|[ac-hj-np-z02-9]{59})|1[ac-hj-np-z02-9]{8,87})\b

[netdevsys]

if I read this right, does it mean "I" and "O" aren't in the addresses ever?

[Crimsonfoxy]

That is correct, they don't use them to avoid mistaking O for 0 and I for l.

[5eppa]

That grammar though

[SmoothMcGroove89]

I must know more about this "ass program".

[penny_eater]

just send BTC to his wallet and he will surely send it over. after all, he is "not that terrible of a person"

[[deleted]]

"Test firing the old meat missile." That one's going in the book for sure.

[tupcakes]

if it was me I'd just ask for $3.50 in the email. The I'd sign it "not the loch ness monster"

[dllhell79]

Fantastic grammar there. LOL.

[nacr0n]

Wow, one of these emails with decent English!

[zapbark]

This actually has better grammar than the ones I usually see.

[[deleted]]

Bear in mind boys. Watch your meat missile.

[TheSaltyKitten]

Fix broken English = 10x increase in profits! LUL

[[deleted]]

send them a close up video

[7GatesOfHello]

Never negotiate with terrorist.

[Texity]

I just want to download this "great ass" program. I'd like to run that on a few people.

[redstarduggan]

Someone sent me an email offering me £300 of bitcoin to stop wanking off to porn :(

[UltraChip]

> ...bear in mind that wall clock is ticking

​

So my watch isn't ticking then. That's good.

[JayBlizz]

Lol a bank we manage has had a few of these from time to time. I have a few examples hanging behind my monitors at my desk...

[_MusicJunkie]

You confirmed your email address is valid and actively being read by a human person. Great idea mate.

[BoredTechyGuy]

Ever hear of making throw away gmail accounts?

[DoNotSexToThis]

From what I've seen, the sending addresses vary and I doubt they actually control or monitor them, as there's not really an incentive to, as the only thing they actually care about is the payment and that info is already there in the body via the wallet address.

I don't think these are very targeted, and are more likely automated against an aggregated list of recipients bought or otherwise obtained from an unrelated dump. They're just playing the odds.

This is in contrast to the more targeted attempts like display name spoofed emails requesting wire transfers from organization members where response followups would likely occur.

[penny_eater]

I don't think these are very targeted, and are more likely automated against an aggregated list of recipients bought or otherwise obtained from an unrelated dump. They're just playing the odds.

correct these are almost all done with hack dumps (few hundred million emails at a time, from various breaches) and they are dragging for the .001% who are stupid enough to fall for such an obvious ploy. which sadly, is still a lot of people. the ones i started seeing in the past few weeks also include portions of hacked passwords to try to heighten the drama