Sexual Blackmail phishing

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 18 Aug 2022 07:13:03 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oOfJx-000Pa6-H2

for dave@doctor.nl2k.ab.ca;

Thu, 18 Aug 2022 07:12:25 -0600

Resent-From: The Doctor

Resent-Date: Thu, 18 Aug 2022 07:12:25 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mob-109-118-16-191.net.vodafone.it ([109.118.16.191]:44541)

by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oOfFT-0004NQ-RG

for sales@nk.ca;

Thu, 18 Aug 2022 07:07:53 -0600

Message-ID: <323380E4568157323380E45681573233@Y340QUF>

From:

To:

Subject: Don't miss your unsettled payment. Complete your debt payment now.

Date: 18 Aug 2022 15:43:18 +0100

MIME-Version: 1.0

Content-Type: text/plain;

charset="ibm852"

Content-Transfer-Encoding: 8bit

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 6.00.2900.5931

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5994

X-Spam_score: 11.7

X-Spam_score_int: 117

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi! Sadly, there are some bad news that you are about to hear.

About few months ago I have gained a full access to all devices used by you

for internet browsing. Shortly after, I started recording all int [...]



Content analysis details: (11.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.6 HK_RANDOM_ENVFROM Envelope sender username looks random

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel

letters

1.0 HK_RANDOM_FROM From username looks random

1.5 NIX_SPAM RBL: Listed in NIX_SPAM DNSBL (thanks to heise.de)

[109.118.16.191 listed in ix.dnsbl.manitu.net]

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.0 BITCOIN_XPRIO Bitcoin + priority

0.5 PDS_BTC_ID FP reduced Bitcoin ID

0.9 BITCOIN_EXTORT_01 Extortion spam, pay via BitCoin

0.0 PDS_BTC_MSGID Bitcoin ID with T_MSGID_NOFQDN2

3.2 HELO_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname (IP

addr 1)

0.0 HDR_ORDER_FTSDMCXX_DIRECT Header order similar to spam

(FTSDMCXX/boundary variant) + direct-to-MX

0.0 MIMEOLE_DIRECT_TO_MX MIMEOLE + direct-to-MX

3.1 DOS_OE_TO_MX Delivered direct to MX with OE headers

0.0 NO_FM_NAME_IP_HOSTN No From name + hostname using IP address

Subject: {SPAM?} Don't miss your unsettled payment. Complete your debt payment now.



Hi!



Sadly, there are some bad news that you are about to hear.

About few months ago I have gained a full access to all devices used by you for internet browsing.

Shortly after, I started recording all internet activities done by you.



Below is the sequence of events of how that happened:

Earlier I purchased from hackers a unique access to diversified email accounts (at the moment, it is really easy to do using internet).

As you can see, I managed to log in to your email account without breaking a sweat: (sales@nk.ca).



Within one week afterwards, I installed a Trojan virus in your Operating Systems available on all devices that you utilize for logging in your email.

To be frank, it was somewhat a very easy task (since you were kind enough to open some of links provided in your inbox emails).

I know, you may be thinking now that I'm a genius.



With help of that useful software, I am now able to gain access to all the controllers located in your devices (e.g., video camera, keyboard, microphone and others).

As result, managed to download all your photos, personal data, history of web browsing and other info to my servers without any problems.

Moreover, I now have access to all accounts in your messengers, social networks, emails, contacts list, chat history - you name it.

My Trojan virus continues refreshing its signatures in a non-stop manner (because it is operated by driver),

hence it remains undetected by any antivirus software installed in your PC or device.



So, I guess now you finally understand the reason why I could never be caught until this very letter...



During the process of your personal info compilation, I could not help but notice that you are a huge admirer and regular guest of websites with adult content.

You endure a lot of pleasure while checking out porn websites, watching nasty porn movies and reaching breathtaking orgasms.

Let me be frank with you, it was really hard to resist from recording some of those naughty solo scenes with you in main role and compiling them in special videos

that expose your masturbation sessions, which end with you cumming.



In case if you still have doubts, all I need is to click my mouse and all those nasty videos with you will be shared to friends, colleagues, and relatives of yours.

Moreover, nothing stops me from uploading all that hot content online, so all public can watch it too.

I sincerely hope, you would really not prefer that to happen, keeping in mind all the dirty things you like to watch,

(you certainly know what I mean) it will completely ruin your reputation.



However, don't worry, there is still a way to resolve this:

You need to carry out a $1450 USD transfer to my wallet (equivalent amount in bitcoins depending on exchange rate at the moment of funds transfer),

hence upon receiving the transaction, I will proceed with deleting all the filthy videos with you in main role.

Afterwards, we can forget about this unpleasant accident. Furthermore, I guarantee that all the malicious software will also be erased from your devices and accounts.

Mark my words, I never lie.



That is a great bargain with a low price, I assure you, because I have spent a lot of effort while recording

and tracking down all your activities and dirty deeds during a long period of time.

In case if you have no idea how to buy and transfer bitcoins - feel free to check the related info on the internet.



Here is my bitcoin wallet for your reference: 1ReCKyhNPdHkbNCjf3EyRgr6XZX78rURd



>From now on, you have only 48 hours and countdown has started once you opened this very email (in other words, 2 days).



The following list contains things you should definitely abstain from doing or even attempting:

> Abstain from trying to reply this email (since the email is generated inside your inbox alongside with return address).

> Abstain from trying to call or report to police or any other security services. In addition, it's a bad idea if you want to share it with your friends,

hoping they would help. If I happen to find out (knowing my awesome skills, it can be done effortlessly,

because I have all your devices and accounts under my control and unceasing observation) - kinky videos of yours will be share to public the same day.

> Abstain from trying to look for me - that would not lead anywhere either. Cryptocurrency transactions are absolutely anonymous and cannot be tracked.

> Abstain from reinstalling your OS on devices or throwing them away. That would not solve the problem as well,

since all your personal videos are already uploaded and stored at remote servers.



Things you may be confused about:

> That your funds transfer won't be delivered to me.

Chill, I can track down any transactions right away, so upon funds transfer I will receive a notification as well,

since I still control your devices (my trojan virus has ability of controlling all processes remotely, just like TeamViewer).

> That I am going to share your dirty videos after receiving money transfer from you.

Here you need to trust me, because there is absolutely no point to still bother you after receiving money.

Moreover, if I really wanted all those videos would be available to public long time ago!



I believe we can still handle this situation on fair terms!



Here is my last advice to you... in future you better ensure you stay away from this kind of situations!

My advice - don't forget to regularly update your passwords to feel completely secure.



Medical spam/phish from CloudWebManage New York City

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 18 Aug 2022 00:31:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oOZ3A-0006ra-1u

for dave@doctor.nl2k.ab.ca;

Thu, 18 Aug 2022 00:30:40 -0600

Resent-From: The Doctor

Resent-Date: Thu, 18 Aug 2022 00:30:40 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [45.126.126.25] (port=39847 helo=ear-pro.net)

by doctor.nl2k.ab.ca with esmtp (Exim 4.95 (FreeBSD))

id 1oOTta-000Nb1-Jb

for doctor@doctor.nl2k.ab.ca;

Wed, 17 Aug 2022 19:00:30 -0600

From:_Hair Health

Subject:_Doctor Forced To Resign After Unveiling Hair Regrowth Hack

Date: Thu, 18 Aug 2022 02:59:04 +0200

To: doctor@doctor.nl2k.ab.ca

Reply-To: "Adobe Creative Cloud"

MIME-Version: 1.0

X-mailer: nlserver, Build 6.7.0

Message-ID:

X-250ok-CID: P26341-121020

TenantHeader: 1d0e6311-6f98-4c5b-8b0e-rWM5LDPcfDUFB1j6IO8jxNT

Affinity: prod.default

X-cust_MessageID: 1938757681

X-cust_DeliveryID: 350826

X-cust_InstanceName: aci_prod

MessageMaxRetry:2000

MessageRetryPeriod: 3600

MessageWebValidityDuration: 2592000

MessageValidityDuration: 432000

X-cust_IMSOrgID:

Content-Transfer-Encoding: 7bit

Content-Type: text/html; charset="UTF-8"

X-Spam_score: 10.8

X-Spam_score_int: 108

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: This is shocking! A weird doctor from New Jersey was forced

out of his practice after he unveiled a billion-dollar secret he wasn't supposed

to know. The real reasonwhy you are losing your hair…



Content analysis details: (10.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of

words

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8 confidence level

above 50%

[cf: 100]

0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%

[cf: 100]

1.7 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)

0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

-0.0 T_SCC_BODY_TEXT_LINE No description available.

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML

tag

2.5 HDRS_MISSP Misspaced headers

0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To

0.0 TO_NO_BRKTS_NORDNS_HTML To: misformatted and no rDNS and HTML

only

Subject: {SPAM?} _Doctor Forced To Resign After Unveiling Hair Regrowth Hack



This is shocking!





A weird doctor from New Jersey was forced out of his practice after he unveiled a billion-dollar secret he wasn't supposed to know.





The real reasonwhy you are losing your hair…









And the simple daily habit you can do to restore it, no matter of your age or current condition.





His secret is so amazing, it sent the entire hair regrowth industry back to the drawing board, and it’s currently losing them millions of dollars.





His method is available for a very short period of time and only to selected people.





See if you qualify here...



USPS Phish from France

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 17 Aug 2022 16:33:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.95 (FreeBSD))

(envelope-from )

id 1oORaW-0007Va-Ck

for dave@doctor.nl2k.ab.ca;

Wed, 17 Aug 2022 16:32:36 -0600

Resent-From: The Doctor

Resent-Date: Wed, 17 Aug 2022 16:32:36 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 163-172-255-117.rev.poneytelecom.eu ([163.172.255.117]:38352 helo=sd-130379.localdomain)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.95 (FreeBSD))

(envelope-from )

id 1oOPME-000FlL-Qo

for doctor@doctor.nl2k.ab.ca;

Wed, 17 Aug 2022 14:09:46 -0600

Received: by sd-130379.localdomain (Postfix, from userid 1001)

id BD622A8B66B; Wed, 17 Aug 2022 20:07:04 +0000 (UTC)

To: doctor@doctor.nl2k.ab.ca

Subject: =?UTF-8?Q?USPS=C2=AE_Expected_Delivery?=

Date: Wed, 17 Aug 2022 20:07:04 +0000

From: Support

Message-ID:

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="b1_c35642b2d243446f0009b8b19254dbfa"

Content-Transfer-Encoding: 8bit



This is a multi-part message in MIME format.



--b1_c35642b2d243446f0009b8b19254dbfa

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit























Hi there,















































Â

 We have issues with your shipping address



USPS Allows you to Redeliver your package to your address in case of delivery failure or any other case.You can also track the package at any time, from shipment to delivery.

UPDATE HERE TO FIX YOUR BILLING



















































Head of Customer SuccessÂ





















































Â





















































 | USPS , 750 B St #1400, San Diego, CA 92101, United States







































--b1_c35642b2d243446f0009b8b19254dbfa

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit



































Hi there,
















































Â


 We have issues with your shipping address




USPS Allows you to Redeliver your package to your address in case of delivery failure or any other case.
You can also track the package at any time, from shipment to delivery.



UPDATE HERE TO FIX YOUR BILLING






















































Head of Customer Success
Â




























































Â
















































 | USPS , 750 B St #1400, San Diego, CA 92101, United States
































--b1_c35642b2d243446f0009b8b19254dbfa--