"Belarus Phishing Expedition"

[Chickennuggets]

First I will post the email contents they sent me:

"Good evening

Your notebook computer is influenced by the corrupting program .

What is it all about??

I left the malware on a soft porn Web-site, you hit the file and right away set the rogue program to your system .

This badware made your front-facing camera filming in such a way I have the video record with you chaturbating.

During the next 4 hours the badware hijacked all the contact numbers numbers.

Right now, I got all your contact information and videorecord with you frigging, so in a case if you have a desire me to close down all the contact numbers send me 475 dollars in BTC cryptocurrency.

In other circumstances I would send the clip to all your contact numbers .

I forward you my Bitcoin wallet - 164i2rCpdRAzH8VsAASBEYb1wVeLYxSHPz You have 23 hours after getting this. If I earn this money I promise destroy the clip for ever and aye.

Im apologize for my grammar- I live in China .

P.S. t his electronic address, I have plundered hobbled it. "

It does follow the same lines as the phishing ones that mean nothing. I am only on edge because I wouldn't normally watch porn on my laptop but I did for the first time in a long time and I did go on to chaturbate which the email mentions.

I have ran a scan with my McAfee which I pay for and it found nothing.

Should I be concerned?

[SlapHappy]

It does follow the same lines as the phishing ones that mean nothing.
Should I be concerned?

No. There is no "malware," nor is there any video. It's all a pile of steaming dung. Your email address was just just found on some mailing list somewhere and spammed out along with tens, hundreds of thousands of others with the scammer hoping he will get a few to bite on his scam and send money.

Follow the same advice as in the "Belarus Phishing Expedition" topic here: viewtopic.php?f=20&t=60846

[Chickennuggets]

Thankyou, I've just delved into this site today due to this issue.
Looks like it does a lot of good

[SlapHappy]

Giving us the full header of the email, containing the scammer's email address(s) deleting your email address from the email header, would be nice. You may put that in the form at http://blackmailscams.com. Thanks.

[firefly]

Received as a spam message:

Email:

Hello...

Dont consider on my grammar, Im from China.I put the malware onto your system.Since that moment I stole all confidential info from your device. Moreover I got a little bit more evidence.The most important compromising that I got- its a videotape with your w*nking.I installed virus on a porn web page and after you installed it. When you decided with the video and tapped on a play, my virus instantly adjusted on your device.

After downloading, your web camera made the videotape with you self-abusing, moreover it saved exactly the video you wanked on. In next week my malicious software collected all your social and email contacts.

If you wish to erase all the evidence- send me 350 united state dollar in Bitcoins.
I provide you my Btc wallet address - 1MPRVrJkAQ4jcJkFyMRTVuK8VppHUf5BQ3

You have 24 h. to go since now. If I receive transfer I will erase the video evermore. Other way I will send the record to all your contacts.

Header:

Return-Path: <order@appentrepreneursassociation.com>
Received: from appentrepreneursassociation.com (appentrepreneursassociation.com. [206.189.31.158])
Received-SPF: pass (google.com: domain of order@appentrepreneursassociation.com designates 206.189.31.158 as permitted sender) client-ip=206.189.31.158;
Authentication-Results: mx.google.com;
dkim=fail header.i=@appentrepreneursassociation.com header.s=key1 header.b=GGiC2ifl;
spf=pass (google.com: domain of order@appentrepreneursassociation.com designates 206.189.31.158 as permitted sender) smtp.mailfrom=order@appentrepreneursassociation.com;
dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=appentrepreneursassociation.com
Date: Mon, 23 Apr 2018 4:19:07
From: Doolittle Grebner <order@appentrepreneursassociation.com>
Organization: bvinihqasr
X-Priority: 3 (Normal)
Message-ID: <9911258642.20180423041907@appentrepreneursassociation.com>
To:
Subject: Tiсkеt#996832734: xxx@gmail.com] 22/04/2018 Be clever

Originating IP: 206.189.31.158
Originating ISP: Digitalocean, Llc
City: London
Country of Origin: United Kingdom

Checking the bitcoin wallet sent shows that the so called hacker didn't managed to fool anyone so far... let's hope it stay that way. And on a personal note to all the ones posting in this topic: I don't even go to porn sites to download / install anything from there...

[Wayne]

Form received 2018-05-08 19:32:28

What name did the scammer use?: None
Scammer's email address if you have it.: yolanda.bridges1978@bol.com.br

What site/app did you first meet the scammer on? .: Email
How much money did they demand?: $385
Name you were told to send the money to.: None
How were you to send the money ?: Bitcoin Transaction
What steps, if any, have you already taken to block the scammer?: None so far
Are there any other details you wish to share? Anything you say may help prevent someone else from being scammed.: Bitcoin Number is:
1HHUJakV5u8hSKKm56j54Z6zdJTjKQ3NpG

[SlapHappy]

Form received 2018-06-02 02:28:51

What name did the scammer use?: andreas copp
Scammer's email address if you have it.: order@sandcreekranch.com
How old did the scammer say they were?: 30
Scammer's Skype name.: Kim Soriano
Scammer's Skype username .: kim.soriano624
What site/app did you first meet the scammer on? .: they send me an email, tell me about a page that I visited. I do not remember the name
If they asked you to leave the site/app , where did they take you to?: no
How much money did they demand?: 950 US
Name you were told to send the money to.: Westen Unions
What country/city were you told to send the money to?: Belgium
What steps, if any, have you already taken to block the scammer?: I have suspended my faceboke account and block mail in the inbox of my outlook
Are there any other details you wish to share? Anything you say may help prevent someone else from being scammed.: He says he would have visited an adult pornographic site and recorded me with my camera.

I have not transferred money or answered. just gave me the following account (I guess it's an account) Btc address - 1KhhcEKjb7x2Z57RYq7eZFgoxGk7aQKCym

[SlapHappy]

Form received 2018-06-02 20:56:11

What name did the scammer use?: Barnard Mcclanathan
Scammer's email address if you have it.: order@susanpommrehn.com
Scammer's Skype name.: None
Scammer's Skype username .: None
Address of the scammer's FaceBook, Google+ or other social media site page.: None
What site/app did you first meet the scammer on? .: None
If they asked you to leave the site/app , where did they take you to?: None
How much money did they demand?: $550 USD
Name you were told to send the money to.: a bitcoin account
What country/city were you told to send the money to?: None
If they gave you a phone number, please add it here.: None
If they posted your video on a website, please include the link.: None
How were you to send the money ?: Bitcoin
What steps, if any, have you already taken to block the scammer?: Removed Facebook account
Changed password of iCloud and Google accounts, also changed email addresses for these
Deleted email address I was contacted through
Ran malware scan on my Mac with one PUA that was associated with Flash Player...removed this

[Wayne]

Form received 2018-06-07 10:16:10

What name did the scammer use?: Asia Passe
Scammer's email address if you have it.: order@therma-fusersystems.com

Scammer's Skype name.: It´s a email threat
Scammer's Skype username .: Not informed
Address of the scammer's FaceBook, Google+ or other social media site page.: Not known
What site/app did you first meet the scammer on? .: Only email
If they asked you to leave the site/app , where did they take you to?: I have only received one mail
How much money did they demand?: 300 USD
Name you were told to send the money to.: Via bitcoin link: bitcоin wаllеt address: 1AKn9XRTs3Q7DBWYHUfKQeNwuLPkK7zdKw
What country/city were you told to send the money to?: The email noted: I'm from Estonia - so I dgf lmao
If they gave you a phone number, please add it here.: No phone number
This is some info from the mail: Тiсkеt Dеtаils: QRE-895-72912 Email: Camera ready,Notification: 06-06-2018 11:15:16 Status: Waiting for Reply 40xuQaWy9A0f07wUnJmZkO6TrI4Oy37Eu6_Priority: Normal
How were you to send the money ?: Bitcoin: bitcоin wаllеt address: 1AKn9XRTs3Q7DBWYHUfKQeNwuLPkK7zdKw
What steps, if any, have you already taken to block the scammer?: Blocked the email adress
Are there any other details you wish to share? Anything you say may help prevent someone else from being scammed.: They claim that I have visited a porn page 060618 11:15 and have recorded a compromising video. At that time I was in attendance at work. I have copied email info here:

Return-Path:
Delivered-To:
Received: from mx1.pub.mailpod1-cph3.one.com ([10.27.24.11])
by mailstorage7.cst.mailpod1-cph3.one.com with LMTP id wH+IGaRWGFtPOQAAFPM92A
for ; Wed, 06 Jun 2018 21:48:20 +0000
X-HalOne-ID: 53d6b55a-69d3-11e8-9dbe-405cfd1172c1
Received: from therma-fusersystems.com (unknown [94.103.80.118])
by mx1.pub.mailpod1-cph3.one.com (Halon) with ESMTP
id 53d6b55a-69d3-11e8-9dbe-405cfd1172c1;
Wed, 06 Jun 2018 21:48:20 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=key1; d=therma-fusersystems.com;
h=Date:From:Message-ID:To:Subject:MIME-Version:Content-Type:
Content-Transfer-Encoding; i=order@therma-fusersystems.com;
bh=51pQ03d5xbrMEoVtl5R6S0558Dslm3V2P2cCsAUuL2s=;
b=aDztKqw0g7UQ8TqhrT0Y++fNy/8B3xcijNnV1oMpTaEzMla5ms9UOnU7Jv7zjlZePBxG4Z4qGr+x
QjIQtTTnqL7WVmA8fryYGN6RrG0n9NeaGu6EFm+2fWOROsid4NtuldiRPNIC7FCdpD5vjHFxP7EQ
HJszLCKng0zgPnYAVL4=
Date: Wed, 6 Jun 2018 20:15:16 +0000
From: "=?utf-8?Q?Asia_Passe?="
Organization: toebpbb
X-Priority: 3 (Normal)
Message-ID:
To:
Subject: =?utf-8?Q?QRE=3A_=5Bkim=40nidam.dk=5D_06-06-2018_11=3A15=3A16_Your_life_can_be_destroyed?=
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit

Тiсkеt Dеtаils: QRE-895-72912
Email:
Camera ready,Notification: 06-06-2018 11:15:16
Status: Waiting for Reply 40xuQaWy9A0f07wUnJmZkO6TrI4Oy37Eu6_Priority: Normal

=
IP Address 94.103.80.118
Country Russian Federation
Country Code RU
ISP McHost.Ru
Organization McHost.Ru
PTR Resource Record therma-fusersystems.com

[Wayne]

Form received 2018-07-06 10:10:19

What name did the scammer use?: Serenity Gonzales
Scammer's email address if you have it.: "ljtysaem@www.leshengjadeite.com"@svr109.phsserv

Scammer's Skype name.: do not know (it happens by e-mail)
Scammer's Skype username .: do not know (it happens by e-mail)
How much money did they demand?: 550
What steps, if any, have you already taken to block the scammer?: I just take the email I've received and sent it to trash.
Are there any other details you wish to share? Anything you say may help prevent someone else from being scammed.: i received an e-mail saying that i had went to a porn website and they were tracking me and grab video from my cam. then i had to send bitcoins to a wallet (550 dollars) if i do not want to them share that video with my family and friends... they saying that they collected all my contacts and made a video with me at the left side and the video i has watched at the right.