Once upon a time in Quezon City, there lived a cheerful little girl named Samara. She loved exploring her garden, filled with colorful flowers and playful birds. One sunny afternoon, while Samara was playing, she noticed a beautiful butterfly with shimmering wings.
“Hello, little butterfly!” Samara greeted. To her surprise, the butterfly spoke back, “Hello, Samara! I am Bella, the magical butterfly. Would you like to go on an adventure?”
Samara’s eyes sparkled with excitement. “Yes, please!” she exclaimed.
Bella fluttered her wings, and in an instant, Samara found herself in a magical forest. The trees were tall and glowing with soft lights, and the air was filled with the sweet scent of flowers.
“Welcome to the Enchanted Forest,” Bella said. “Here, anything is possible!”
As they walked through the forest, they met a friendly squirrel named Squeaky. “Hello, Samara! Would you like to help me find my acorns?” Squeaky asked.
“Of course!” Samara replied. Together, they searched high and low, finding acorns hidden in the most unexpected places. Samara climbed trees, peeked under bushes, and even found one inside a hollow log.
After finding all the acorns, Squeaky thanked Samara and gave her a shiny acorn as a token of friendship. “This acorn will always remind you of our adventure,” Squeaky said.
As the sun began to set, Bella fluttered her wings again, and Samara found herself back in her garden. She held the shiny acorn tightly and smiled, knowing she had made new friends and had a magical adventure.
“Thank you, Bella,” Samara said. “I will never forget this day.”
“Remember, Samara,” Bella replied, “magic is everywhere, as long as you believe.”
With that, Bella flew away, leaving Samara with a heart full of joy and a mind full of wonderful memories.
A new scam, this time extortion attempts that are originating from Microsoft’s outlook.com mail system.
[Update 25Aug2018] These emails seem to have slowed/stopped. Either scammers have given up (doubt it) or Microsoft has put in some intelligence into their system to prevent them. Well done Microsoft!
These attempts are addressed to email addresses that have had an online account password discovered previously by other hackers and include the password in the subject line of the email. The email is written in English and uses good English unlike many other scam and extortion emails.
If you’re being threatened, call your local law enforcement.
To report harassment, impersonation, child exploitation, child pornography, or other illegal activities received via an Outlook.com account, forward the offending email as an attachment to abuse@outlook.com. Include any relevant info, such as the number of times you’ve received messages from the account and the relationship, if any, between you and the sender.
To report abuse received from a non-Outlook.com account, go to https://www.abuse.net to identify the correct abuse reporting address.
I encourage you to report it as above because this lets Microsoft know they need to act, not just blocking accounts as a reactive activity but block the email from going out in a pro-active action and forwarding all relevant information to law enforcement. Lets all help catch these criminals. Don’t forget to attach the offending email, not just forward and you don’t need the mail server logs to do it.
Below are the last three email’s I received including the mail server log and email headers but I have obscured my email address and the password (from oldest to newest):
The first from Annette Moroianu <tsvswelchheubertud@outlook.com>
Second from Hipolito Payton <hthzcolbyramseypc@outlook.com>
The third from Lonnie Killip <ernesttgdpender@outlook.com>
Example 1 from Annette Moroianu <tsvswelchheubertud@outlook.com>
Mail server log
Jul 15 02:50:37 <my-server-ip> postfix/smtpd[25996]: connect from mail-pu1apc01hn0245.outbound.protection.outlook.com[104.47.126.245]
Jul 15 02:50:39 <my-server-ip> postfix/smtpd[25996]: disconnect from mail-pu1apc01hn0245.outbound.protection.outlook.com[104.47.126.245]
Email header
Return-Path: <tsvswelchheubertud@outlook.com>
Delivered-To: <me>@<my-domain>
Received: from APC01-PU1-obe.outbound.protection.outlook.com (mail-pu1apc01hn0245.outbound.protection.outlook.com [104.47.126.245])
by <my-mailserver> (Postfix) with ESMTPS id AA692210DA07
for <me>@<my-domain>; Sun, 15 Jul 2018 02:50:38 +0930 (ACST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;
s=selector1;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=YvztMgxFGW3yxa7YcHOxCj/lTNMcUrSHy4SaQ1D1jMk=;
b=k+iQVvviDgDCu9+g0k06z9uWOsbyacTVZP8Fu/JZnF4nK1zO2ijv5onwWLYCv62MpMsMqCc9/8w1V2uZBS+HoqgSkfGzo0RH5DOfLY6LUZdZTbTCyaYNrLRymA+M2DwU3moX+MYBm5s8jVhXcgT5IpYA+oCsxzDAPA6v7VRSQkOposQzVdX5CNB+3M42yxOJZvsZmW8slxEMX1aZ3v5yZldbYLaIb4mY2kxdz+l+45vCh3xhyEqaer1Cz5ZmC2uBbpJTtCZ+JAt+D1hHaP52hptaFm0tgqAjl8Zx1CkBw4ruBwXNOgDU/inx4h8Y8oIFf00O6hm5otBvjcV0wZiRcg==
Received: from SG2APC01FT024.eop-APC01.prod.protection.outlook.com
(10.152.250.60) by SG2APC01HT071.eop-APC01.prod.protection.outlook.com
(10.152.251.211) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.20.952.17; Sat, 14
Jul 2018 17:20:31 +0000
Received: from TYAPR04MB2463.apcprd04.prod.outlook.com (10.152.250.60) by
SG2APC01FT024.mail.protection.outlook.com (10.152.250.185) with Microsoft
SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.20.930.16 via
Frontend Transport; Sat, 14 Jul 2018 17:20:31 +0000
Received: from TYAPR04MB2463.apcprd04.prod.outlook.com
([fe80::9464:f9c0:413c:f322]) by TYAPR04MB2463.apcprd04.prod.outlook.com
([fe80::9464:f9c0:413c:f322%13]) with mapi id 15.20.0952.017; Sat, 14 Jul
2018 17:20:31 +0000
From: Annette Moroianu <tsvswelchheubertud@outlook.com>
To: “<me>@<my-domain>” <me>@<my-domain>
Subject: <me> – <old password>
Thread-Topic: <me> – <old password>
Thread-Index: AQHUG5b364BXpfZWiUS0sQEVUYzL3g==
Date: Sat, 14 Jul 2018 17:20:31 +0000
Message-ID: <TYAPR04MB2463293DDA285CABBBEA73B1C35F0@TYAPR04MB2463.apcprd04.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-incomingtopheadermarker: OriginalChecksum:9C77261EFB3BB47C24E06D0583EB8A2487BA0BABE2348D97DD8AF72F6119B4EE;UpperCasedChecksum:121C450B6A2940FBE217B23160AC6936C2B1EF859F91E76C5ED36311DE42FFBE;SizeAsReceived:6819;Count:43
x-tmn: [NFIPpuw5gMiYrJ/eCCk1qEvCwsvYt7EO]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1;SG2APC01HT071;7:1+GuoNuCW6C3cgLIouc383PxTbEaFcIPaRJ6Z6CdGXIR4a03LNqDRWQwYLFUXBqMA0tfudDft5Bh/zxkUyq+b20dib6EvUZZY18zETVQ0SV/shTweWwYLfja66KmceY7Sjad+/yNnbAvfZDejMheKX5lUIso48n9pHY9hxVIxtducNlQduaCeqaVRRMwcyMXfYziVlNHV0FKfWfUjK92NCTcf4yCB9P835O6XjCZDBgpHgIUgvmDPb3d6vtTAkgu
x-incomingheadercount: 43
x-eopattributedmessage: 0
x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(7020095)(201702061078)(5061506573)(5061507331)(1603103135)(2017031320274)(2017031324274)(2017031323274)(2017031322404)(1603101448)(1601125500)(1701031045);SRVR:SG2APC01HT071;
x-ms-traffictypediagnostic: SG2APC01HT071:
x-exchange-antispam-report-cfa-test: BCL:0;PCL:0;RULEID:(82015058);SRVR:SG2APC01HT071;BCL:0;PCL:0;RULEID:;SRVR:SG2APC01HT071;
x-forefront-prvs: 07334CBCCD
x-forefront-antispam-report: SFV:SPM;SFS:(7070007)(979002)(189003)(199004)(8936002)(2900100001)(551544002)(68736007)(1730700003)(81156014)(8676002)(74316002)(25786009)(7696005)(55016002)(54896002)(97736004)(256004)(14444005)(20460500001)(19627235002)(86362001)(6916009)(6436002)(5640700003)(82202002)(486006)(10156002)(56003)(476003)(5660300001)(33656002)(87572001)(106356001)(426003)(2351001)(6346003)(102836004)(2501003)(5250100002)(26005)(14454004)(53906005)(99286004)(105586002)(104016004)(173224004)(332134003)(98824002)(42522002)(42262002)(969003)(989001)(999001)(1009001)(1019001);DIR:OUT;SFP:1501;SCL:5;SRVR:SG2APC01HT071;H:TYAPR04MB2463.apcprd04.prod.outlook.com;FPR:;SPF:None;PTR:InfoNoRecords;MX:1;A:1;LANG:;
received-spf: None (protection.outlook.com: outlook.com does not designate
permitted sender hosts)
authentication-results: spf=none (sender IP is )
smtp.mailfrom=tsvswelchheubertud@outlook.com;
x-microsoft-antispam-message-info: jcftIUeEX5KMGbUPpmWIUygVxrNDEqi0wRwyVTEoYM6/8U4MEGXMzdMf4J8sg+0s23hv4d0fWN4gZjC+ZWcgnbhKvS7KJGwykge6b+8kmLY3W7BNxeJO5Og0gv/bgv++yCGvnApoaPSDWOtkyuIWf7Gz/IWy+RSZHvORLZfbw/aAW8NbqkgHe6LdSJfszvBSWaDWMnSVTD4C2NfsSRcwOGusA2j9EvydZV0tnPR4OSQ=
Content-Type: multipart/alternative;
boundary=”_000_TYAPR04MB2463293DDA285CABBBEA73B1C35F0TYAPR04MB2463apcp_”
MIME-Version: 1.0
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 54485d23-c432-40fe-8436-6091d627118c
X-MS-Exchange-CrossTenant-Network-Message-Id: 85e62cc3-6fa1-4687-6b6e-08d5e9ae19e6
X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 54485d23-c432-40fe-8436-6091d627118c
X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Jul 2018 17:20:31.0280
(UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Internet
X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SG2APC01HT071
Email body
I’m going to cut to the chase. I do know <old password> is your password. Most importantly, I know about your secret and I have evidence of it. You do not know me and no one employed me to investigate you.
It is just your bad luck that I came across your misdemeanor. The truth is, I actually setup a malware on the adult videos (porn material) and you visited this website to experience fun (you know what I mean). When you were watching video clips, your web browser began functioning as a Rdp (Remote control desktop) having a keylogger which gave me accessibility to your screen as well as cam. Right after that, my software obtained your complete contacts from your facebook, as well as email.
I then put in more time than I should’ve exploring into your life and created a two screen video. First part displays the video you were viewing and second part shows the video of your webcam (its you doing inappropriate things).
Honestly, I am ready to forget about you and allow you to continue with your daily life. And my goal is to provide you two options which will achieve that. The two option is either to ignore this letter, or just pay me $ 1900. Let us examine above 2 options in details.
Option 1 is to ignore this message. Let us see what will happen if you select this option. I will definately send your video to all of your contacts including close relatives, co-workers, and many others. It will not help you avoid the humiliation your household will have to face when friends and family learn your sordid videos from me.
Other Option is to pay me $ 1900. We’ll call this my “privacy charges”. Now let me tell you what happens if you choose this path. Your secret remains your secret. I will destroy the recording immediately. You continue on with your lifetime as though nothing like this ever occurred.
Now you must be thinking, “I should call the cops”. Without a doubt, I have covered my steps to ensure this e mail cannot be tracked back to me plus it will not stay away from the evidence from destroying your health. I am not looking to dig a hole in your pocket. I just want to get paid for my efforts I put into investigating you. Let’s assume you decide to generate pretty much everything disappear and pay me the confidentiality fee. You will make the payment through Bitcoins (if you don’t know how, search “how to buy bitcoins” on search engine)
Required Amount: $ 1900
Receiving Bitcoin Address: 1N9M8prUzY1qKcn3SpxqDzLiK7PGEfVs6V
(It is cASe sensitive, so copy and paste it)
Tell nobody what will you be using the Bitcoins for or they may not sell it to you. The method to obtain bitcoin may take a day or two so do not delay.
I’ve a specific pixel within this email, and at this moment I know that you have read through this e mail. You now have 48 hours in order to make the payment. If I don’t get the BitCoins, I will send out your video recording to your contacts including friends and family, co-workers, and so on. You better come up with an excuse for friends and family before they find out. Nonetheless, if I receive the payment, I’ll erase the video immediately. It’s a non negotiable one time offer, so please do not waste my time and yours. The clock is ticking.
Example 2 from Hipolito Payton <hthzcolbyramseypc@outlook.com>
Jul 18 14:15:12 <my-server-ip> postfix/smtpd[25649]: disconnect from mail-am5eur02hn0236.outbound.protection.outlook.com[104.47.4.236]
Email header
Return-Path: <hthzcolbyramseypc@outlook.com>
Delivered-To: <me>@<my-domain>
Received: from EUR02-AM5-obe.outbound.protection.outlook.com (mail-am5eur02hn0236.outbound.protection.outlook.com [104.47.4.236])
by <my-mailserver> (Postfix) with ESMTPS id B21782017D4B
for <me>@<my-domain>; Wed, 18 Jul 2018 14:15:11 +0930 (ACST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;
s=selector1;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=AIPs8rP4MKGzLGqpAo3E32u2sY39Dke1Y5RJ7rLKnb4=;
b=MTB5vRSvJJEHzOFORGc5xmsgI9hJ+6RHt9nbsYn8u/QDKbpSxYPjHQhKY6wOTQOlBf1zovNabVfCLBZYBjQgdJXwB+6kxRqnAxPUYnWLOxLc2ZF6MyVIcsXQXMGzY2XxF0i/2Bo/YsMESCJz4l3aEB2lFkVIaevHksfn5ATiLMVBmvNqgoixF2mnwPdP+phsHl3elYAR6XCdwSCZsl5fdew9w6yaaSyW0cXl9f22n3sxlnFk9P7il8Te5q5Kp/SGvrcXBuNY0yGD5WPGcLc6ZVdvZlMmIcSfEdcQJnAoO9yanrjCqqGTb9R6Od3zWJ/KJvfwvVCQaW/1d3MQmXPS+A==
Received: from HE1EUR02FT018.eop-EUR02.prod.protection.outlook.com
(10.152.10.59) by HE1EUR02HT058.eop-EUR02.prod.protection.outlook.com
(10.152.11.98) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.20.952.17; Wed, 18
Jul 2018 04:45:08 +0000
Received: from VI1PR04MB4832.eurprd04.prod.outlook.com (10.152.10.54) by
HE1EUR02FT018.mail.protection.outlook.com (10.152.10.248) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id
15.20.952.17 via Frontend Transport; Wed, 18 Jul 2018 04:45:08 +0000
Received: from VI1PR04MB4832.eurprd04.prod.outlook.com
([fe80::9843:f103:17bc:ed45]) by VI1PR04MB4832.eurprd04.prod.outlook.com
([fe80::9843:f103:17bc:ed45%3]) with mapi id 15.20.0952.021; Wed, 18 Jul 2018
04:45:08 +0000
From: Hipolito Payton <hthzcolbyramseypc@outlook.com>
To: “<me>@<my-domain>” <me>@<my-domain>
Subject: RE: <me> – <old password>
Thread-Topic: <me> – <old password>
Thread-Index: AQHUHlIaFeVP6c2NIkWjNfoHwcJDZw==
Date: Wed, 18 Jul 2018 04:45:08 +0000
Message-ID: <VI1PR04MB48322BFE83EB2E3A073A813FAB530@VI1PR04MB4832.eurprd04.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-incomingtopheadermarker: OriginalChecksum:E0108DA1969701BD0CF9BB1D51E5DF0FA20957C34168C7E619ACA39A6184560B;UpperCasedChecksum:8FAE9B4278A61C4330C8AAD12F0C3B2BFA1D71D83BEAD649B542B21549992B83;SizeAsReceived:6815;Count:43
x-tmn: [cwao4IvyUCk5Pq3g/+zRopq/Fr2U4PMo]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1;HE1EUR02HT058;7:zQ0K3OSr0L/wR3ryxmLFk1hDN1YNA6Xk73qeCKAnx7G8yKUa4FqqPPOeePxBF14aQkt4ZCexy2hxWwYcqQyXVGWE62C6LAx7RJBKQGckjmgfOwvHN3myMwMLWHUWyozrbZ90NQL4QyVQGpyyCENEpMkr18CXRoDeIDXvyjvWR20vHDQiGCCzwUHpOry9ja1z57Ax607yrx+GKlnmDHGPm2VvpwvBbyEcAqQ6eyJ82hO3iKEL2JuzsX8pBW9y3iDZ
x-incomingheadercount: 43
x-eopattributedmessage: 0
x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(7020095)(201702061078)(5061506573)(5061507331)(1603103135)(2017031320274)(2017031324274)(2017031323274)(2017031322404)(1603101448)(1601125500)(1701031045);SRVR:HE1EUR02HT058;
x-ms-traffictypediagnostic: HE1EUR02HT058:
x-exchange-antispam-report-cfa-test: BCL:0;PCL:0;RULEID:(82015058);SRVR:HE1EUR02HT058;BCL:0;PCL:0;RULEID:;SRVR:HE1EUR02HT058;
x-forefront-prvs: 0737B96801
x-forefront-antispam-report: SFV:SPM;SFS:(7070007)(199004)(189003)(5640700003)(8676002)(106356001)(6246003)(53906005)(81156014)(1730700003)(33656002)(55016002)(25786009)(68736007)(5660300001)(8936002)(54896002)(6916009)(97736004)(82202002)(6436002)(20460500001)(229853002)(104016004)(2351001)(56003)(10156002)(87572001)(2900100001)(14454004)(105586002)(7696005)(5250100002)(2501003)(476003)(99286004)(256004)(426003)(86362001)(6346003)(74316002)(26005)(19627235002)(102836004)(14444005)(486006)(173224004)(332134003);DIR:OUT;SFP:1501;SCL:5;SRVR:HE1EUR02HT058;H:VI1PR04MB4832.eurprd04.prod.outlook.com;FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:;
received-spf: None (protection.outlook.com: outlook.com does not designate
permitted sender hosts)
authentication-results: spf=none (sender IP is )
smtp.mailfrom=hthzcolbyramseypc@outlook.com;
x-microsoft-antispam-message-info: 4LeUQuT9XD4pJC0w1AB7KInKONvikyLBkGisZ2zqdbjxB2Y+o1w8ipwTAZWsKcDx8xtp9VEOb9EGmkAjDq8gMsLmhnbDWhauq1dzfL+xR6DHcxfGFfQ8/rEy4wjyakoEPHZaCc00HOju3rJQONSJCqWUlDfEaxmREv9GhKsxWZC91KUYj7lG2+LJTwpaq5J1J6DH4GAWc2eMrAfFvPKMJ0d9o3l3G67szlmQrGc8La4=
Content-Type: multipart/alternative;
boundary=”_000_VI1PR04MB48322BFE83EB2E3A073A813FAB530VI1PR04MB4832eurp_”
MIME-Version: 1.0
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: dd759f05-a917-4aa0-a2f5-4cc35c50e0c8
X-MS-Exchange-CrossTenant-Network-Message-Id: bcb58153-0a80-4fa7-aa42-08d5ec693cf3
X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: dd759f05-a917-4aa0-a2f5-4cc35c50e0c8
X-MS-Exchange-CrossTenant-originalarrivaltime: 18 Jul 2018 04:45:08.0647
(UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Internet
X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1EUR02HT058
Email message
Let’s get straight to the point. I’m aware <old password> is your pass word. Most importantly, I know your secret and I’ve evidence of it. You don’t know me personally and nobody employed me to check out you.
It is just your hard luck that I came across your blunder. Actually, I actually placed a malware on the adult videos (pornography) and you visited this web site to have fun (you know what I mean). While you were watching videos, your web browser began working as a Rdp (Remote control desktop) with a key logger which gave me access to your screen as well as cam. Just after that, my software gathered all your contacts from fb, as well as e-mail.
After that I put in more time than I should’ve looking into your life and created a two view video. 1st part displays the recording you were viewing and 2nd part shows the recording of your web camera (its you doing nasty things).
Frankly, I am ready to forget details about you and let you get on with your life. And I am about to give you 2 options that may achieve that. The above choices either to ignore this letter, or simply pay me $3200. Let us investigate above 2 options in more details.
Option One is to ignore this e-mail. Let us see what is going to happen if you pick this option. I definitely will send your video recording to all of your contacts including members of your family, coworkers, and so on. It doesn’t protect you from the humiliation you and your family will need to feel when friends and family find out your sordid details from me.
Other Option is to pay me $3200. We will name this my “privacy tip”. I will explain what happens if you choose this choice. Your secret remains your secret. I’ll destroy the recording immediately. You go on with your life that nothing like this ever happened.
At this point you must be thinking, “I should call the cops”. Without a doubt, I’ve covered my steps in order that this e-mail can’t be traced back to me plus it won’t stop the evidence from destroying your daily life. I’m not looking to dig a hole in your pocket. I just want to get compensated for time I place into investigating you. Let’s hope you have chosen to create all of this disappear and pay me the confidentiality fee. You will make the payment via Bitcoin (if you do not know how, type “how to buy bitcoins” on google search)
Amount to be paid: $3200
Bitcoin Address to Send to: 1F8dxmQMskgBowr6AW33P3biLfvopLTmYf
(It’s cASe sensitive, so you should copy and paste it carefully)
Expalin no-one what will you be using the bitcoin for or they may not provide it to you. The method to acquire bitcoins may take a few days so do not delay.
I have a specific pixel within this e-mail, and right now I know that you have read this email message. You have 2 days to make the payment. If I don’t receive the Bitcoins, I will definitely send your video recording to your contacts including friends and family, coworkers, and many others. You better come up with an excuse for friends and family before they find out. Nevertheless, if I do get paid, I will erase the proof immediately. It’s a non-negotiable offer, so don’t ruin my personal time & yours. Your time has started.
Example 3 from Lonnie Killip <ernesttgdpender@outlook.com>
Mail server log
Jul 20 05:58:15 <my-server-ip> postfix/smtpd[6114]: connect from mail-oln040092253041.outbound.protection.outlook.com[40.92.253.41]
Jul 20 05:58:16 <my-server-ip> postfix/smtpd[6114]: disconnect from mail-oln040092253041.outbound.protection.outlook.com[40.92.253.41]
Email header
Return-Path: <ernesttgdpender@outlook.com>
Delivered-To: <me>@<my-domain>
Received: from APC01-SG2-obe.outbound.protection.outlook.com (mail-oln040092253041.outbound.protection.outlook.com [40.92.253.41])
by <my-mailserver> (Postfix) with ESMTPS id 02A962017D4B
for <me>@<my-domain>; Fri, 20 Jul 2018 05:58:15 +0930 (ACST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;
s=selector1;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=IlBxuf2ZLh05mMk/H4w1BTOQa4+CmoMm2hMqJNFeH1I=;
b=RWSWViNPJnRsEAirkGlTFsC14MQ94q7K7chE7aStaKPTC8nxnhKDOBm67iGlAX7e02xp6mpjLBA762p8WU7cveh9UJxEDIiMix4usd/SxAikEBD7df3lQO10ptatycfQGieV8WMFYrseHfU6HxVNR3bH43BYNWgJprUOtC9vxKdx60GFeKZoDjWjaVQiGCDd+a3luJA8fOGqpHW+Ct68C6rsyDYE/9WbwDjmADWhP7fRjzlGFXuViPCiY0lkzowtODJ95lGYseB8ml9WkrdIW37Woy5zh4BSSwk8yiT9m2GTamFd+WpxfgHZJfm1N1a4ckMPs5r0rwtTYnjmlcIYjA==
Received: from SG2APC01FT117.eop-APC01.prod.protection.outlook.com
(10.152.250.51) by SG2APC01HT027.eop-APC01.prod.protection.outlook.com
(10.152.251.187) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.20.952.17; Thu, 19
Jul 2018 20:28:13 +0000
Received: from HK0PR06MB2868.apcprd06.prod.outlook.com (10.152.250.51) by
SG2APC01FT117.mail.protection.outlook.com (10.152.250.221) with Microsoft
SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.952.17 via
Frontend Transport; Thu, 19 Jul 2018 20:28:13 +0000
Received: from HK0PR06MB2868.apcprd06.prod.outlook.com
([fe80::d055:4d90:6f46:34d5]) by HK0PR06MB2868.apcprd06.prod.outlook.com
([fe80::d055:4d90:6f46:34d5%4]) with mapi id 15.20.0973.018; Thu, 19 Jul 2018
20:28:12 +0000
From: Lonnie Killip <ernesttgdpender@outlook.com>
To: “<me>@<my-domain>” <me>@<my-domain>
Subject: <me> – <old password>
Thread-Topic: <me> – <old password>
Thread-Index: AQHUH58CO4tIvvWliUC+BwtlOuFZPw==
Date: Thu, 19 Jul 2018 20:28:12 +0000
Message-ID: <HK0PR06MB2868FE5B0945AD8061C23776B8520@HK0PR06MB2868.apcprd06.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-incomingtopheadermarker: OriginalChecksum:DEF7FFAA3509CB477B67633892F3FC4BF88D3F70B21EF005913B47663E7D7120;UpperCasedChecksum:3E8C400CF84C3C597C96F9B289F1FCF4093FFFB95C5ACBE0E8BA6D899C25BD6E;SizeAsReceived:6808;Count:43
x-tmn: [gebqJzZRv9XeXgkj1lbw2mTLjxgUf9xv]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1;SG2APC01HT027;7:Fx2gLzCHm2mfbCegizpMgjFiXVVuuD8n3Qul4Vabhny3zvl8DBIax7v0ekZNFdHh380DFSAIzirH+sF/wcrQVN4cZ/TxohAIq0okGp9P9pY7as9lfqfOVyUciyOVSDTQZFp7OMvY/iC5dX7Q4trmICYM4SQKIlOm9rfOuZ84y0sWsa2lcS/kmFujjTLdZ5gnwzrPg2PjUquhOQoYkooZNRVVOrDtWGr3VcUe/kxfwDXRDRpV4bnhe2kxd6L/VYhs
x-incomingheadercount: 43
x-eopattributedmessage: 0
x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(7020095)(201702061078)(5061506573)(5061507331)(1603103135)(2017031320274)(2017031324274)(2017031323274)(2017031322404)(1603101448)(1601125500)(1701031045);SRVR:SG2APC01HT027;
x-ms-traffictypediagnostic: SG2APC01HT027:
x-exchange-antispam-report-cfa-test: BCL:0;PCL:0;RULEID:(82015058);SRVR:SG2APC01HT027;BCL:0;PCL:0;RULEID:;SRVR:SG2APC01HT027;
x-forefront-prvs: 0738AF4208
x-forefront-antispam-report: SFV:NSPM;SFS:(7070007)(199004)(189003)(486006)(68736007)(2900100001)(6436002)(99286004)(26005)(97736004)(2501003)(105586002)(106356001)(2351001)(87572001)(7696005)(104016004)(5250100002)(25786009)(55016002)(54896002)(5640700003)(14454004)(33656002)(102836004)(53906005)(6346003)(14444005)(5660300001)(20460500001)(476003)(256004)(82202002)(86362001)(8936002)(1730700003)(6916009)(8676002)(426003)(74316002)(81156014)(56003)(19627235002)(10156002)(551544002)(173224004)(98824002)(42262002);DIR:OUT;SFP:1901;SCL:1;SRVR:SG2APC01HT027;H:HK0PR06MB2868.apcprd06.prod.outlook.com;FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:;
received-spf: None (protection.outlook.com: outlook.com does not designate
permitted sender hosts)
authentication-results: spf=none (sender IP is )
smtp.mailfrom=ernesttgdpender@outlook.com;
x-microsoft-antispam-message-info: arijTiCiK4kZkCu8/T7W69tnxEgSlFRu+drROB9nI6BDqQl+Rm81vjm1KGU3zyx422h5D/JCXOdd+o7WFk1RcNgYwCIwG3R+fGGoD8vnMqWU3umrJT/bGNaB3E91LiTo3pYMkTf98Fo53nA+iPFDV9tXoVy4/Wlr9SU1MEjZwlhhwoVbmVr+SEpk1L8oxuh2aiIlyY1mAy+x21WAjzHEqDk4hB7h4aUeZmTdcu3zHbs=
Content-Type: multipart/alternative;
boundary=”_000_HK0PR06MB2868FE5B0945AD8061C23776B8520HK0PR06MB2868apcp_”
MIME-Version: 1.0
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 5dab7a8a-ebdc-4bd9-9cfd-67cde50b170b
X-MS-Exchange-CrossTenant-Network-Message-Id: 60e021e1-ecf6-4aa5-11a9-08d5edb62694
X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 5dab7a8a-ebdc-4bd9-9cfd-67cde50b170b
X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Jul 2018 20:28:12.9171
(UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Internet
X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SG2APC01HT027
Email message
Let’s get straight to the point. I’m aware <old password> is your password. More importantly, I know your secret and I’ve evidence of it. You don’t know me and no one employed me to investigate you.
It’s just your hard luck that I stumbled across your bad deeds. Well, I actually installed a malware on the adult video clips (porn) and you visited this website to have fun (you know what I mean). When you were watching video clips, your internet browser began operating as a Rdp (Remote desktop) that has a keylogger which provided me with access to your screen as well as webcam. Right after that, my software program obtained every one of your contacts from your messenger, facebook, and e-mail.
After that I gave in much more time than I should’ve looking into your life and created a two screen video. First part shows the recording you had been watching and second part displays the view from your webcam (its you doing inappropriate things).
Frankly, I want to forget details about you and let you continue with your daily life. And my goal is to present you 2 options which will make it happen. Those two choices are to either ignore this letter, or perhaps pay me $ 3900. Let’s explore above two options in details.
First Option is to ignore this e-mail. You should know what will happen if you select this option. I will send out your video to your entire contacts including relatives, colleagues, and so on. It will not save you from the humiliation your self will need to face when relatives and buddies learn your unpleasant videos from me.
Option 2 is to make the payment of $ 3900. We will name it my “privacy fee”. I will explain what happens if you choose this choice. Your secret will remain your secret. I’ll erase the video immediately. You go on with your routine life like none of this ever happened.
Now you may be thinking, “I will go to the cops”. Let me tell you, I’ve covered my steps to ensure that this email can’t be tracked back to me and yes it will not steer clear of the evidence from destroying your daily life. I’m not trying to dig a hole in your pocket. I am just looking to get paid for time I put in investigating you. Let’s assume you have decided to produce this all go away and pay me the confidentiality fee. You’ll make the payment via Bitcoins (if you don’t know how, search “how to buy bitcoins” in search engine)
Transfer Amount: $ 3900
Bitcoin Address to Send to: 1B4ox92miD4EJbL6CmJLkGFKnJYhs8vi8
(It’s cASe sensitive, so copy and paste it)
Share with no one what will you be utilising the Bitcoins for or they may not sell it to you. The process to obtain bitcoins can take a few days so do not put it off.
I have a special pixel within this email, and at this moment I know that you have read this mail. You now have 24 hours in order to make the payment. If I do not receive the BitCoin, I will send your video to all of your contacts including friends and family, colleagues, and so on. You better come up with an excuse for friends and family before they find out. Nonetheless, if I do get paid, I’ll destroy the video and all other proofs immediately. It’s a non-negotiable offer, so don’t waste my personal time and yours. Your time has started.
Outlook.com response to my reports so far
After reporting the above, I’ve received from outlook.com the following automated response. I’m curious how long I’ll be receiving the extortion attempts for.
You recently reported a message as junk or abuse. We wanted to thank you and let you know that your report has been received.
Anyone who thinks English is English when travelling is in for a surprise. Not only is there spelling differences, there are whole word differences and phrase differences. Here is a sample of some of the differences:
2014 was probably the most turbulent year of my life. The following photo’s are highlights of that year. Click on image to expand.
Laguna De Bay as seen from the roof of Rio Building, Azure Resedences, Paranaque
My darling Patty
Recent road trip along the Ocean Road in Victoria I stopped for breakfast at this picnic ground in Lorne. It’s the perfect place for a stop, beautiful scenery, sounds, and smells. Spectacular 🙂
The Great Ocean Tourist drive passes across the top of the clifs at Elliston on the West Coast of Eyre Peninsula in South Australia. A number of sculptures are spread across these cliffs.
Located on the Ayre Penninsula, South Australia, this beautiful bay is a haven for boaties, fisherman and other water lovers. The bay has almost no waves from the Southern Ocean leaving a glass like surface.
An alley way in Port Adelaide, South Australia. Port Adelaide is one of the early parts of Adelaide with a lot of factories built in the 1800’s that still stand. Most are converted now to apartments and offices. This photo was a bit of a challenge because of the high contrast between light and dark.
Often referred to as Don Dunstan’s Balls, they come and go from time to time from the Rundle Mall in Adelaide.
Two young buskers in Rundle Mall on a nice Friday afternoon in October entertaining the shoppers. They take it in turns to give a consistent show.
Semaphore, South Australia is a metropolitan beach north west of Adelaide city. Some of the sunsets we are fortunate to get are quite spectacular.
Stare at the cross between the two changing faces. What should happen is the features of the faces merge if you are at the right distance from the screen.
Hackers are getting smarter. They have learnt that most people will have one password that does it all. So once they get it from one place, it can be put into the automated robots to try it on every other site on the internet. Imagine if it’s your banking password as well as your Facebook password.
This article is not going to guarantee that you will never get hacked, but it will provide some idea’s to increase your protection from being hacked.
Rule 1: Your email password is the most important and should not be used for anything else. Reason: When this is hacked, all the thief needs to do is use the forgot password link on all other sites and they get your password for what ever you may be registered for.
How to come up with an easy to remember but hard to crack password. You use a phrase instead of a word. So think about where you went on holidays, or where your partner was born. Lets use the holidays one for the example. “Love Sydney” is the phrase that came to my mind. It really could be anything. You want to write it with correct case as well. So capital L for Love and capital S for Sydney. That gets 2 of the often required things for passwords. Now the spaces in your password. Some systems don’t like them so probably better to replace them. Decide on what you are going to use as the space. It might be the hash or a comma. We’ll use a hash for the example, so now our pass phrase is “Love#Sydney”. So we’ve got upper case and lower case. We’ve got special characters. Now we just want some numbers. Easiest one there is where you have a L and a O change them for a 1 and 0 except for the first character (some systems don’t like to start with a number). “L0ve#Sydney”.
Passwords should be at least 8 characters. An 8 char password takes a little over 2hrs to brute force crack. 10 characters is over 2,000 hours. Out example password will take 50,000 hours.
Now a way to have a unique password for each web site and be able to remember easily.
Use your password as a base and select characters from the web address to add into your password. Here is a example:
web site facebook.com. We’ll use from the right, the 2,5,6 letters. Always do from the right as some domains are very short which will break this. Remeber it’s always the same for every web site. So facebook the letters are oko. So use our space character and add the 3 chars to the end. “L0ve#Sydney#oko”.
It’s like anything new. It will take a little while to get used to it.
Remember, your email password needs to be unique and strong. I would make it at least 12 characters and I’d use a mixture.
My question after reading the label of a packet of peanuts was; if it only contains TRACES of peanuts, what is the rest?
Yummy Snack Foods 500 gram salted peanutsPeanuts may contain traces of peanuts. So what else do they contain?
Are peanuts nuts?
Well it looks like peanuts are not officially nuts. Reading Wikipedia about them they are classified as Arachis hypogaea, a legume crop grown mainly for its edible seeds. As a legume, the peanut belongs to the botanical family Fabaceae; this is also known as Leguminosae, and commonly known as the bean, or pea, family. So I suppose the statement is partially relevant, may contain traces of … other nuts.
The Wikipedia article does go onto to say further down:
Some people (0.6% of the United States population) report that they experience allergic reactions to peanut exposure; symptoms are specifically severe for this nut, and can range from watery eyes to anaphylactic shock, which is generally fatal if untreated. Eating a small amount of peanut can cause a reaction. Because of their widespread use in prepared and packaged foods, the avoidance of peanuts can be difficult. The reading of ingredients and warnings on product packaging is necessary to avoid this allergen.
Every now and then something doesn’t work as planned when buying on ebay. We see ratings and you can read all sorts of stories, but the real proof in a good ebay seller is how things are handled when something doesn’t go right. That’s what happened with Lovebuy and they really came through.
I won’t go into the detail except to say this is a shop that is there is a problem they really do help to fix it. You don’t fall on deaf ears. They help.
