Received: from 177-86-156-46.netecom.net.br ([177.86.156.46]:49303 helo=[177-86-156-108.netecom.net.br]) by server.saveonlocaldeals.com with esmtpsa (TLSv1:ECDHE-RSA-AES256-SHA:256) (Exim 4.91) (envelope-from <hb@hbmonte.com>) id 1hAb50-000822-7N for [my email]; Sun, 31 Mar 2019 10:05:10 -0400 List-ID: tbfsheqeecx8b9p2eu48aa7pm6e list <582f2z9fg31gpdsqywxgzctf3.784333.list-id.hbmonte.com>

Received:from [235-180-252-87.filibe.net] (unknown [87.252.180.235])

Ransomeware email asking for $1000. Supposedly sent from email account I own. Message contains image file asking for bitcoin payment to be sent to 15iiic5PmfGvE3TyMP1JyYh1W9KxQLGQL6. Header info: Received: (qmail 19086 invoked by uid 30297); 1 Apr 2019 04:17:20 -0000_x000D_ Received: from unknown (HELO p3plibsmtp01-09.prod.phx3.secureserver.net) ([72.167.238.225]) (envelope-sender <ziaangela@ziaangela.it>) by p3plsmtp10-04-25.prod.phx3.secureserver.net (qmail-1.03) with SMTP for <xxxxxxxxxxxxxxx>; 1 Apr 2019 04:17:20 -0000 Received: from WIN-IES35EM77RK.home ([81.29.208.253]) by CMGW with ESMTP id AoNnhKtxHBs7oAoNnhacol; Sun, 31 Mar 2019 21:17:19 -0700_x000D_ Received: from [host-84-54-202-216.stavropol.ru] ([84.54.202.216]) by home with MailEnable ESMTP; Mon, 1 Apr 2019 07:26:09 +0200 Abuse-Reports-To: <abuse@mailer.ziaangela.it>X-Aid: 0432442972X-Mailer: Sendy (https://sendy.co)_x000D_ X-Ip-Spam: Suspect X-Nonspam: WhitelistX-Sender-Info: ziaangela@ziaangela.it

The guy who made this email is a fucking stupid idiot :-D Made my day.

claimed to have hacked my computer, camera, and email account. Since it came in on an email forwarding account it could not be hacked. The entire message was a single jpg. Stupid idiot told me to cut and paste his bitcoin address but he put it in the graphic. How can one cut and paste from a graphic? Idiot. _x000D_ Received: from unknown (HELO ?host.9.148.broadband.redcom.ru?) (ogino@portalgraphics.net@212.19.9.148)_x000D_ by 0 with SMTP; 1 Apr 2019 07:44:50 +0900_x000D_ List-ID: 1062772806.gmayo.local_x000D_ List-Subscribe:_x000D_ http://portalgraphics.net/mailman/listinfo/portalgraphics.net

image file with extortion demand

Same as other reports.

Asking to pay 1000$

Image of text. Threatens exposure of data if not paid.

Randsome ware my account has been affected, renew your password immediately. The message is in a picture format. _x000D_ Return-Path: <cmr@barretos.sp.gov.br>_x000D_ Delivered-To: _x000D_ Received: from bospopproxy09.eigbox.net ([10.20.15.1])_x000D_ by bospop03.eigbox.net with LMTP id eGhUNNytn1wPfQAAUsCngg_x000D_ for <########################>; Sat, 30 Mar 2019 13:56:44 -0400_x000D_ Received: from bosmailscan01.eigbox.net ([10.20.15.1])_x000D_ by bospopproxy09.eigbox.net with LMTP id 6BYnNNytn1wSDwAAlYqATA_x000D_ ; Sat, 30 Mar 2019 13:56:44 -0400_x000D_ Return-path: <cmr@barretos.sp.gov.br>_x000D_ Envelope-to: _x000D_ Delivery-date: Sat, 30 Mar 2019 13:56:44 -0400

Supposedly from my own e-mail address (which I do not mention here ...) _x000D_ Return-Path: <chuvashia@rfn.ru>_x000D_ Received: from proofpoint3.rfn.ru (proofpoint2.rfn.ru [80.247.46.69])_x000D_ Received: from pps.filterd (proofpoint3.rfn.ru [127.0.0.1])_x000D_ by proofpoint3.rfn.ru (8.16.0.27/8.16.0.27) with SMTP id x2U1fMeV006768_x000D_ Received: from rfn.ru (nut.rfn.ru [80.247.32.131])_x000D_ by proofpoint3.rfn.ru with ESMTP id 2rhwn4r61u-1_x000D_ Received: from [78.30.252.30] (account vesti21@rfn.ru HELO [host-30-252-30-78.sevstar.net])_x000D_ X-Sender-Info: chuvashia@rfn.ru_x000D_ Subject: The signs in front of the at-sign of my own email address_x000D_ _x000D_ The hacker had no success so far, see here:_x000D_ https://bitcoinwhoswho.com/address/15iiic5PmfGvE3TyMP1JyYh1W9KxQLGQL6