"Belarus Phishing Expedition"

[daisy]

My nickname in darknet is biron53.
I hacked this mailbox more than six months ago, through it I infected your operating system with a virus (trojan) created by me and have been monitoring you for a long time.

So, your password from *******@*********** is ********

Even if you changed the password after that - it does not matter, my virus intercepted all the caching data on your computer and automatically saved access for me.

I have access to all your accounts, social networks, email, browsing history.
Accordingly, I have the data of all your contacts, files from your computer, photos and videos.

I was most struck by the intimate content sites that you occasionally visit.
You have a very wild imagination, I tell you!

During your pastime and entertainment there, I took screenshot through the camera of your device, synchronizing with what you are watching.
Oh my god! You are so funny and excited!

I think that you do not want all your contacts to get these files, right?
If you are of the same opinion, then I think that $824 is quite a fair price to destroy the dirt I created.

Send the above amount on my BTC wallet (bitcoin): 1EZS92K4xJbymDLwG4F7PNF5idPE62e9XY
As soon as the above amount is received, I guarantee that the data will be deleted, I do not need it.

Otherwise, these files and history of visiting sites will get all your contacts from your device.
Also, I'll send to everyone your contact access to your email and access logs, I have carefully saved it!

Since reading this letter you have 48 hours!
After your reading this message, I'll receive an automatic notification that you have seen the letter.

I hope I taught you a good lesson.
Do not be so nonchalant, please visit only to proven resources, and don't enter your passwords anywhere!
Good luck!

Note: Between 17 and 25 October, 33 victims paid.The fraudster cashed the payments on October 29 - the equivalent of almost $23K.

[Wayne]

Hello!

I'm a hacker who cracked your email and device a few months ago.
You entered a password on one of the sites you visited, and I intercepted it.
This is your password from wayne@XXXXXX on moment of hack: XXXXXX

Of course you can will change it, or already changed it.
But it doesn't matter, my malware updated it every time.

Do not try to contact me or find me, it is impossible, since I sent you an email from your account.

Through your email, I uploaded malicious code to your Operation System.
I saved all of your contacts with friends, colleagues, relatives and a complete history of visits to the Internet resources.
Also I installed a Trojan on your device and long tome spying for you.

You are not my only victim, I usually lock computers and ask for a ransom.
But I was struck by the sites of intimate content that you often visit.

I am in shock of your fantasies! I've never seen anything like this!

So, when you had fun on piquant sites (you know what I mean!) I made screenshot with using my program from your camera of yours device.
After that, I combined them to the content of the currently viewed site.

There will be laughter when I send these photos to your contacts!
BUT I'm sure you don't want it.

Therefore, I expect payment from you for my silence.
I think $817 is an acceptable price for it!

Pay with Bitcoin.
My BTC wallet: 1YnYAxprVrTo1WzPPzMo86ste5Ssp4xsy

If you do not know how to do this - enter into Google "how to transfer money to a bitcoin wallet". It is not difficult.
After receiving the specified amount, all your data will be immediately destroyed automatically. My virus will also remove itself from your operating system.

My Trojan have auto alert, after this email is read, I will be know it!

I give you 2 days (48 hours) to make a payment.
If this does not happen - all your contacts will get crazy shots from your dark secret life!
And so that you do not obstruct, your device will be blocked (also after 48 hours)

Do not be silly!
Police or friends won't help you for sure ...

p.s. I can give you advice for the future. Do not enter your passwords on unsafe sites.

I hope for your prudence.
Farewell.

IP: 115.74.200.118
ISP: Viettel Group
Organization: Viettel Group
Continent: Asia
Country: Vietnam
State/Region: Tinh Quang Nam
City: Thuan An

Note: Between October 22 - 24 the wallet recorded 7 transactions. Total lost: $3752.

[Wayne]

Yet another one. Same script as above.

Therefore, I expect payment from you for my silence.
I think $873 is an acceptable price for it!

Pay with Bitcoin.
My BTC wallet: 1JTtwbvmM7ymByxPYCByVYCwasjH49J3Vj


IP: 181.120.218.50
ISP: Tigo Paraguay
Organization: Tigo Paraguay
Continent: South America
Country: Paraguay
State/Region: Departamento Central
City: Lambaré

Note: Between 22 - 27 of October, the wallet registered 49 transactions. Total received: $30.317. A new payment of aprox. $900 was made on October 30.

[Wayne]

A third one! All identical to the previous one, but with a different IP address:

IP: 46.1.90.44
ISP: Milleni.com
Organization: Milleni.com
Continent: Asia
Country: Turkey
State/Region: Hatay
City: Arsuz

[firefly]

Note: the message looks like it's sent from the email address of the victim. The victim will see his/her own email and his/her own password used for that account some time ago. A simple check will show the truth: the entire header is forged and the IP is to only element showing that the email address of the victim has nothing to do with the message received. According to sources specialized in malware research, a botnet is used for spreading this type of messages. The bitcoin wallet mentioned in the message shows that 12 people already paid ...

From: (email address)
Date: 21 October 2018 1:34:40 PM
To: "passsword"
Subject: (email address) is hacked
return-path: (email address)
received: from 168-197-239-3.powernetsolutions.net.br
([168.197.239.3]) ... Sun, 21 Oct 2018 15:55:42
message-id:
mime-version: 1.0
content-type: text/plain; charset="ibm852"
content-transfer-encoding: 8bit
x-priority: 3
x-msmail-priority: Normal
x-mailer: Microsoft Windows Live Mail 15.4.3508.1109
x-mimeole: Produced By Microsoft MimeOLE V15.4.3508.1109

Hello!

My nickname in darknet is sancho18.
I hacked this mailbox more than six months ago,
through it I infected your operating system with a virus (trojan)
created by me and have been monitoring you for a long time.

So, your password from (email address) is (password)

Even if you changed the password after that - it does not matter, my
virus intercepted all the caching data on your computer
and automatically saved access for me.

I have access to all your accounts, social networks, email, browsing
history.
Accordingly, I have the data of all your contacts, files from your
computer, photos and videos.

I was most struck by the intimate content sites that you occasionally
visit.
You have a very wild imagination, I tell you!

During your pastime and entertainment there, I took screenshot through
the camera of your device, synchronizing with what you are watching.
Oh my god! You are so funny and excited!

I think that you do not want all your contacts to get these files, right?
If you are of the same opinion, then I think that $806 is quite a fair
price to destroy the dirt I created.

Send the above amount on my BTC wallet (bitcoin):
1NXNt72qfMhPZDffUEqryCYpEUzyR6LmgH
As soon as the above amount is received, I guarantee that the data
will be deleted, I do not need it.

Otherwise, these files and history of visiting sites will get all your
contacts from your device.
Also, I'll send to everyone your contact access to your email and
access logs, I have carefully saved it!

Since reading this letter you have 48 hours!
After your reading this message, I'll receive an automatic
notification that you have seen the letter.

I hope I taught you a good lesson.
Do not be so nonchalant, please visit only to proven resources, and
don't enter your passwords anywhere!
Good luck!

Update: 19 payments done. Total received on October 29: $11379. Few hours later another payment was done in the same day.

[daisy]

Hello!

I'm a hacker who cracked your email and device a few months ago.
You entered a password on one of the sites you visited, and I intercepted it.
This is your password from *******@************** on moment of hack: ******

Of course you can will change it, or already changed it.
But it doesn't matter, my malware updated it every time.

Do not try to contact me or find me, it is impossible, since I sent you an email from your account.

Through your email, I uploaded malicious code to your Operation System.
I saved all of your contacts with friends, colleagues, relatives and a complete history of visits to the Internet resources.
Also I installed a Trojan on your device and long tome spying for you.

You are not my only victim, I usually lock computers and ask for a ransom.
But I was struck by the sites of intimate content that you often visit.

I am in shock of your fantasies! I've never seen anything like this!

So, when you had fun on piquant sites (you know what I mean!) I made screenshot with using my program from your camera of yours device.
After that, I combined them to the content of the currently viewed site.

There will be laughter when I send these photos to your contacts!
BUT I'm sure you don't want it.

Therefore, I expect payment from you for my silence.
I think $894 is an acceptable price for it!

Pay via Bitcoin.
My BTC wallet: 1GcwYRfWesiSe2fBmsVSpNG2K11zDMhksG

If you do not know how to do this - enter into Google "how to transfer money to a bitcoin wallet". It is not difficult.
After receiving the specified amount, all your data will be immediately destroyed automatically. My virus will also remove itself from your operating system.

My Trojan have auto alert, after this email is read, I will be know it!

I give you 2 days (48 hours) to make a payment.
If this does not happen - all your contacts will get crazy shots from your dark secret life!
And so that you do not obstruct, your device will be blocked (also after 48 hours)

Do not be silly!
Police or friends won't help you for sure ...

p.s. I can give you advice for the future. Do not enter your passwords on unsafe sites.

I hope for your prudence.
Farewell.

Note: 4 payments done. Total received until October 29 - $9825.

[daisy]

Hello!

I'm a hacker who cracked your email and device a few months ago.
You entered a password on one of the sites you visited, and I intercepted it.
This is your password from ******@********** on moment of hack ********
Of course you can will change it, or already changed it.
But it doesn't matter, my malware updated it every time.

Do not try to contact me or find me, it is impossible, since I sent you an email from your account.

Through your email, I uploaded malicious code to your Operation System.
I saved all of your contacts with friends, colleagues, relatives and a complete history of visits to the Internet resources.
Also I installed a Trojan on your device and long tome spying for you.

You are not my only victim, I usually lock computers and ask for a ransom.
But I was struck by the sites of intimate content that you often visit.

I am in shock of your fantasies! I've never seen anything like this!

So, when you had fun on piquant sites (you know what I mean!) I made screenshot with using my program from your camera of yours device.
After that, I combined them to the content of the currently viewed site.

There will be laughter when I send these photos to your contacts!
BUT I'm sure you don't want it.

Therefore, I expect payment from you for my silence.
I think $814 is an acceptable price for it!

Pay via Bitcoin.
My BTC wallet: 1GcwYRfWesiSe2fBmsVSpNG2K11zDMhksG

If you do not know how to do this - enter into Google "how to transfer money to a bitcoin wallet". It is not difficult.
After receiving the specified amount, all your data will be immediately destroyed automatically. My virus will also remove itself from your operating system.

My Trojan have auto alert, after this email is read, I will be know it!

I give you 2 days (48 hours) to make a payment.
If this does not happen - all your contacts will get crazy shots from your dark secret life!
And so that you do not obstruct, your device will be blocked (also after 48 hours)

Do not be silly!
Police or friends won't help you for sure ...

p.s. I can give you advice for the future. Do not enter your passwords on unsafe sites.

I hope for your prudence.
Farewell.

Note: Five payments done between October 23 - 26. Total received until October 29 - $2408.

[daisy]

Hello!

I'm a hacker who cracked your email and device a few months ago.
You entered a password on one of the sites you visited, and I intercepted it.
This is your password from ******@********on moment of hack: ********

Of course you can will change it, or already changed it.
But it doesn't matter, my malware updated it every time.

Do not try to contact me or find me, it is impossible, since I sent you an email from your account.

Through your email, I uploaded malicious code to your Operation System.
I saved all of your contacts with friends, colleagues, relatives and a complete history of visits to the Internet resources.
Also I installed a Trojan on your device and long tome spying for you.

You are not my only victim, I usually lock computers and ask for a ransom.
But I was struck by the sites of intimate content that you often visit.

I am in shock of your fantasies! I've never seen anything like this!

So, when you had fun on piquant sites (you know what I mean!) I made screenshot with using my program from your camera of yours device.
After that, I combined them to the content of the currently viewed site.

There will be laughter when I send these photos to your contacts!
BUT I'm sure you don't want it.

Therefore, I expect payment from you for my silence.
I think $872 is an acceptable price for it!

Pay with Bitcoin.
My BTC wallet: 1JTtwbvmM7ymByxPYCByVYCwasjH49J3Vj

If you do not know how to do this - enter into Google "how to transfer money to a bitcoin wallet". It is not difficult.
After receiving the specified amount, all your data will be immediately destroyed automatically. My virus will also remove itself from your operating system.

My Trojan have auto alert, after this email is read, I will be know it!

I give you 2 days (48 hours) to make a payment.
If this does not happen - all your contacts will get crazy shots from your dark secret life!
And so that you do not obstruct, your device will be blocked (also after 48 hours)

Do not be silly!
Police or friends won't help you for sure ...

p.s. I can give you advice for the future. Do not enter your passwords on unsafe sites.

I hope for your prudence.
Farewell.

Note: Between October 22 and October 27, 51 victims paid. Total value registered until October 29 - $30288. A new payment was done on October 30.

[daisy]

I apologize for not posting the headers for the previous posts aswell. posting them here now:

1st post header
Received: from juliet.lb1.telkomsa.net (LHLO juliet.telkomsa.net)
(192.168.222.58)
Received: from as10.telkomsa.net (unknown [196.25.211.210])
Received: from 93-41-209-11.ip83.fastwebnet.it ([93.41.209.11])
Message-ID: <BFA55533AE4FC3C8D22244D938B4BFA5@8BSMLBI>
From: <>
To: "" <>
Subject: password ( for is compromised
Date: 23 Oct 2018 17:40:32
MIME-Version: 1.0
Content-Type: text/plain;
charset="ibm852"
Content-Transfer-Encoding: 8bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.1938
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.1938


2nd post header:
Return-Path:***********
Received: from juliet.lb1.telkomsa.net (LHLO juliet.telkomsa.net)
(192.168.222.58)
Received: from as10.telkomsa.net (unknown [196.25.211.210])
by juliet.telkomsa.net (Postfix) with ESMTPS id AB50258CFF
for <************>; Tue, 23 Oct 2018 22:31:16
Received: from unknown (HELO [190.233.166.94]) ([190.233.166.94])
by as10.telkomsa.net with ESMTP; 24 Oct 2018 00:31:16
Message-ID: <8B83A50936AD2F9A92B41827BC3E8B83@G9IC11VT2AY>
From: <>
To: "********" <******>
Subject: password ****( for ***** is compromised
Date: 23 Oct 2018 18:49:22 +0100
MIME-Version: 1.0
Content-Type: text/plain;
charset="ibm852"
Content-Transfer-Encoding: 8bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Windows Live Mail 15.4.3508.1109
X-MimeOLE: Produced By Microsoft MimeOLE V15.4.3508.1109

3rd post header :
Return-Path: ***********
Received: from cordelia.lb1.telkomsa.net (LHLO cordelia.telkomsa.net)
(192.168.222.61)
Received: from as7.telkomsa.net (unknown [196.25.211.210])
by cordelia.telkomsa.net (Postfix) with ESMTPS id 345811531FF
for <***********>; Tue, 23 Oct 2018 05:38:11
Received: from unknown (HELO [103.86.130.45]) ([103.86.130.45])
by as7.telkomsa.net with ESMTP; 23 Oct 2018 05:38:10
Message-ID: <2B79C585F29739B2E05C1C6B0EA02B79@telkomsa.net>

[Wayne]

New ones today. Exactly the same, but with a new BitCoin address.

My BTC wallet: 1PL9ewB1y3iC7EyuePDoPxJjwC4CgAvWTo

IP: 113.160.130.1
ISP: Vietnam Posts And Telecommunications Group
Organization: Vietnam Posts and Telecommunications(VNPT)
Continent: Asia
Country: Vietnam
State/Region: Tinh Hai Duong
City: Thanh Pho Hai Duong

IP: 84.241.47.84
ISP: Aria Shatel Company Ltd
Organization: Shatel DSL Network
Continent: Asia
Country: Iran