Basic scare scam. Mails sent via open proxies. Report added linking all known addresses used by the same scammer.

1JEvR3g6o6AbBZLWm9bvdVyeWk3yC8Rs8w Bragging about non-existent 'malware' desparately begs for Bitcoin. Forged send address and timestamp Leaves identifying fingerprints that trace sender: - Received: from 77-85-182-143.ip.btc-net.bg ([77.85.182.143]:42600 helo=smtpclient.apple) iPhone Mail (21B91) - Received: from [177.140.107.143] (port=9082 helo=b18c6b8f.virtua.com.br) Sending domain has no anti-forgery methods Date: is 3 to 6 hours before Received: date Delivered to internal network by a host with no rDNS Delivered direct to MX with Outlook headers

Standard sextortion scam email. I didn't respond, but thought it best to report the Bitcoin address they're attempting to use.

Received: from * (*. [*]) by * with ESMTPS id p2-20020a170902c70200b001cfa6128913si1411220plp.115.2023.12.20.02.43.22 for <*> (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 20 Dec 2023 02:43:26 -0800 (PST) Received: from ppp-58-8-10-136.revip2.asianet.co.th (58.8.10.136) by * (unknown) id jD2B1q22UyDR for <*>; Wed, 20 Dec 2023 10:43:11 +0000 Received-SPF: none (*: no SPF records found for pulojo@formdmail.com) receiver=*; client-ip=58.8.10.136; envelope-from="pulojo@formdmail.com"; helo=ppp-58-8-10-136.revip2.asianet.co.th; Authentication-Results: *; dmarc=none header.from=formdmail.com policy.dmarc=none; spf=none (*: no SPF records found for postmaster@ppp-58-8-10-136.revip2.asianet.co.th) smtp.helo=ppp-58-8-10-136.revip2.asianet.co.th; spf=none (*: no SPF records found for pulojo@formdmail.com) smtp.mailfrom=pulojo@formdmail.com; arc=none smtp.remote-ip=58.8.10.136 ARC-Authentication-Results: i=1; *; dmarc=none header.from=formdmail.com policy.dmarc=none; spf=none (*: no SPF records found for postmaster@ppp-58-8-10-136.revip2.asianet.co.th) smtp.helo=ppp-58-8-10-136.revip2.asianet.co.th; spf=none (mx.cloudflare.net: no SPF records found for pulojo@formdmail.com) smtp.mailfrom=pulojo@formdmail.com; arc=none smtp.remote-ip=58.8.10.136 DKIM-Signature: v=1; a=rsa-sha256; s=2023; d=email.cloudflare.net; c=relaxed/relaxed; h=Date:Subject:To:From:reply-to:cc:resent-date:resent-from:resent-to :resent-cc:in-reply-to:references:list-id:list-help:list-unsubscribe :list-subscribe:list-post:list-owner:list-archive; t=1703068999; x=1703673799; bh=hinbO8t8gadbYE44BDU97LlwlNGwBF5N8rQo3ce3w/M=; b=jXJrHFQFQj 2neQyhU3GpB1aEwSagRyWddeRjIXAHq+5sbb+XbrBWWnoJK9WyEHhzcBcwNY5y5TC8mpY2q7dwu krwVEZ0FsfBnRZvTZVamKhOH47M14aBXCwjAnddSch6hFyau0lORqB8X7o5R9lT9cVEJc70lqpL uZwOhuwsVDDln+N0eQ3aO5XYUoygTIhJR5qyAQ0UsUD+kYMLUuSCL2eiE68eFCjkr6L1I13K9A6 PnLnHEsEXQzWH9t98+kMMdXL65kXMAjHfZu48a/blroKWzmwjn65GgFIx84/9A3ERC89UCbTtw6 075fIJC24UNh9veBpmKGH1ohwnw9j2gQ==; Message-ID: <6A52A22A959ADA1D25D55DE2EDAD6A52@6COJGU39>

20 Dec 2023 18:59:37UTC: scammer contacted us by e-mail with threatening content (e.g. blackmail, sextortion, ...) demanding payment to bitcoin address below Mail originating from IP: 105.111.82.125 (No abuse address found in whois databases) Mail apparently from: <mkinman@bellsouth.net> Mail Subject: No reply. First up to 512 characters of mail body: Hello, my perverted friend. We've actually known each other for a while, at least I know you. You can call me Big Brother or the All-Seeing Eye. I'm a hacker who a few months ago gained access to your device, including your browser history and webcam. I recorded some videos of you jerking off to highly controversial "adult" videos. I doubt you'd want your family, coworkers, and your entire xxxxxxxxxxxxx@xxxxxxxxx contact list to see footage of you pleasuring yourself, especially considering how kinky you

20 Dec 2023 18:51:30UTC: scammer contacted us by e-mail with threatening content (e.g. blackmail, sextortion, ...) demanding payment to bitcoin address below Mail originating from IP: 41.143.4.154 (No abuse address found in whois databases) Mail apparently from: <nancyw.rich@sbcglobal.net> Mail Subject: No reply. First up to 512 characters of mail body: Hello, my perverted friend. We've actually known each other for a while, at least I know you. You can call me Big Brother or the All-Seeing Eye. I'm a hacker who a few months ago gained access to your device, including your browser history and webcam. I recorded some videos of you jerking off to highly controversial "adult" videos. I doubt you'd want your family, coworkers, and your entire xxxxxxxxx@xxxxxxxxxxxxx contact list to see footage of you pleasuring yourself, especially considering how kinky your

The usual sextortion spammy email.

Sextorsion spam to old email unused for several years but found in multiple aged data breaches.

Sextorsion spam to old email unused for several years but found in multiple aged data breaches.

Standard sextortion email demanding bitcoin.

20 Dec 2023 15:32:39UTC: scammer contacted us by e-mail with threatening content (e.g. blackmail, sextortion, ...) demanding payment to bitcoin address below Mail originating from IP: 186.19.24.12 (abuse report also sent to: ipadmin@telecentro.net.ar) Mail apparently from: <asdsfqw245@uukx.info> Mail Subject: No reply. First up to 512 characters of mail body: Hello, my perverted friend. We've actually known each other for a while, at least I know you. You can call me Big Brother or the All-Seeing Eye. I'm a hacker who a few months ago gained access to your device, including your browser history and webcam. I recorded some videos of you jerking off to highly controversial "adult" videos. I doubt you'd want your family, coworkers, and your entire xxxxxx@xxxxxxxxxxxx contact list to see footage of you pleasuring yourself, especially considering how kinky your fav

20 Dec 2023 14:55:44UTC: scammer contacted us by e-mail with threatening content (e.g. blackmail, sextortion, ...) demanding payment to bitcoin address below Mail originating from IP: 167.56.0.13 (abuse report also sent to: ipadmin@antel.net.uy) Mail apparently from: <dragana@vaultoffer.info> Mail Subject: No reply. First up to 512 characters of mail body: Hello, my perverted friend. We've actually known each other for a while, at least I know you. You can call me Big Brother or the All-Seeing Eye. I'm a hacker who a few months ago gained access to your device, including your browser history and webcam. I recorded some videos of you jerking off to highly controversial "adult" videos. I doubt you'd want your family, coworkers, and your entire xxxxxxxxx@xxxxxxxxxxxxx contact list to see footage of you pleasuring yourself, especially considering how kinky your

20 Dec 2023 14:53:42UTC: scammer contacted us by e-mail with threatening content (e.g. blackmail, sextortion, ...) demanding payment to bitcoin address below Mail originating from IP: 79.131.26.205 (abuse report also sent to: abuse@ote.gr) Mail apparently from: <wvco43281@first.baburn.com> Mail Subject: No reply. First up to 512 characters of mail body: Hello, my perverted friend. We've actually known each other for a while, at least I know you. You can call me Big Brother or the All-Seeing Eye. I'm a hacker who a few months ago gained access to your device, including your browser history and webcam. I recorded some videos of you jerking off to highly controversial "adult" videos. I doubt you'd want your family, coworkers, and your entire xxxxxxxxxxxxx@xxxxxxxxx contact list to see footage of you pleasuring yourself, especially considering how kinky your

I feel really sorry for this person. He wastes his time sending this to me over and over for months now and yet he is getting nothing for his effort. You can tell he has to manually do this because sometimes it comes from BBuckley and other times it comes from bbuckley. He is manually spoofing my very old old email address. There is something seriously wrong with him. Spamcop hasn't had an email service for over 15 years. What he is claiming to have done is technologically impossible. He's not releasing anything because he doesn't have anything...on anyone and he has no access to anyone's contact list so I hope no one pays him because he won't do anything but continue to hack networks and send out his scam. He's sending this to hundreds of people every night, not just me. You can tell by the amount of reports on the Blockchain abuse site. And those are just the people who reported his bitcoin wallet.

20 Dec 2023 12:08:40UTC: scammer contacted us by e-mail with threatening content (e.g. blackmail, sextortion, ...) demanding payment to bitcoin address below Mail originating from IP: 41.30.209.87 (abuse report also sent to: abuse@mail.3g.vodacom.co.za) Mail apparently from: <vuneoqe@pop.printemailtext.com> Mail Subject: No reply. First up to 512 characters of mail body: Hello, my perverted friend. We've actually known each other for a while, at least I know you. You can call me Big Brother or the All-Seeing Eye. I'm a hacker who a few months ago gained access to your device, including your browser history and webcam. I recorded some videos of you jerking off to highly controversial "adult" videos. I doubt you'd want your family, coworkers, and your entire xxxxxx@xxxxxxxxxxxx contact list to see footage of you pleasuring yourself, especially considering how kinky your fav