as described here: https://www.hoax-slayer.net/this-account-is-now-infected-fake-blackmail-sextortion-scam/ details from email: eceived-SPF: Permerror (SPF Permanent Error: Too many DNS lookups) identity=mailfrom; client-ip=200.147.32.41; helo=smtp.uhserver.com; envelope-from=defesacivil@araras.sp.gov.br; receiver=...
Received: from smtp.uhserver.com (a2-smithers1.uhserver.com [200.147.32.41])_x000D_
by ... (Postfix) with ESMTPS id C559B304771AE_x000D_
for <...>; Fri, 26 Apr 2019 19:26:44 +0200 (CEST)_x000D_
Received: from localhost (localhost.localdomain [127.0.0.1])_x000D_
by a2-smithers1.uhserver.com (Postfix) with ESMTP id 4C79A1A0000CE_x000D_
for <...>; Fri, 26 Apr 2019 14:26:41 -0300 (BRT)_x000D_
Received: from [177-67-38-131.netslim.com.br] (unknown [177.67.38.131])_x000D_
(Authenticated sender: defesacivil@araras.sp.gov.br)_x000D_
by a2-smithers1.uhserver.com (Postfix) with ESMTPA id CC7551A0000D8_x000D_
for <...>; Fri, 26 Apr 2019 14:26:21 -0300 (BRT)