chenshaoju · August 11, 2020 03:42
diff --git a/email.eml b/email.eml
 Delivered-To: [email protected]
 Received: by 2002:a4f:4191:0:0:0:0:0 with SMTP id o139csp4638945iva;
        Mon, 10 Aug 2020 12:09:31 -0700 (PDT)
 X-Google-Smtp-Source: ABdhPJySk29CmoFiCkUV3Ku+2q/O5TdNM/2yat7grPl/EGLFaZAxMgTcWq0/ySXJARCGexZA11Rr
 X-Received: by 2002:a62:7acb:: with SMTP id v194mr2395497pfc.302.1597086571543;
        Mon, 10 Aug 2020 12:09:31 -0700 (PDT)
 ARC-Seal: i=1; a=rsa-sha256; t=1597086571; cv=none;
        d=google.com; s=arc-20160816;
        b=JC7kufTWC8spY2pUn196q19HNnst3vhpH5WmTKDSdGiRLP6NbzgkUTzy5rsAync1iz
         Jp9rmPleyHmKbP3HQogRR/OmgmieYV+KyLCfCDc3Rf7b410jtvz8XKx1AwTcmQSoBuQr
         qJ0lwVhJvTqecBxTDItiVHGn9agaf3jzJEO+iF2k+fST0ZPnh0EzNNwApCp7OdADlKFS
         M7hb4XpErF+mDGxEbWznnyzd0EqTF5fIuQMuFNWg24G4+QNp39MCmBaMVKPxGZz9+MTU
         hrxvmQEy1PaYoTbQXMCz6CwlwO/HEFetdEECfKv3/EzU8wZ1Wz/rI1U8WuSRSrC8ILXu
         zmvg==
 ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
        h=content-transfer-encoding:mime-version:subject:to:from:date
         :message-id;
        bh=4Mgi9X/5SUIbQGZ9hinA8TblhUo0IDX2w78t7HiGMAA=;
        b=f8ibkrtD410HqSBmocKFfbHJdzE+dWuolBV6H78siI84QjJe+u9yPGiMlly8V+n8Mi
         GnXHYs8xOj4MRyqFQ1oXp4KpkP/LCXijRFTcmH15arhCxiRYe+8h/wvBdoJaP9oP7rZ9
         dHigedUg614UVFb6eVpoorEjXYALdtVSfSqlN+sNWg6PeJ3tY2nQw7SxQV4Au/tvNf+4
         +qVVtrqryXRd+v8aPXiFIBEb7TGZjfHtgNz2VqScpdae8vNLAzG4Fz5lp123COcbSKlb
         SI0U9Vm45sf/fqPjey4zNhTXio+XK0xzAqim9B1PWlLj3OUS1SUJ4BonUgJRBukGGPxm
         qMPA==
 ARC-Authentication-Results: i=1; mx.google.com;
       spf=softfail (google.com: domain of transitioning [email protected] does not designate 185.195.7.226 as permitted sender) [email protected]
 Return-Path: <[email protected]>
 Received: from Jones.alexbonini.com ([185.195.7.226])
        by mx.google.com with SMTP id e3si12099402pls.254.2020.08.10.12.09.30
        for <[email protected]>;
        Mon, 10 Aug 2020 12:09:31 -0700 (PDT)
 Received-SPF: softfail (google.com: domain of transitioning [email protected] does not designate 185.195.7.226 as permitted sender) client-ip=185.195.7.226;
 Authentication-Results: mx.google.com;
       spf=softfail (google.com: domain of transitioning [email protected] does not designate 185.195.7.226 as permitted sender) [email protected]
 Message-ID: <[email protected]>
 Date: 10 Aug 2020 23:9:32
 From: Jeffrey Morgan <[email protected]>
 To: <[email protected]>
 Subject: ma2M2GMs
 MIME-Version: 1.0
 Content-Type: text/html; charset="UTF-8"
 Content-Transfer-Encoding: 7bit

 <lAc>
 <br>
 I<jdc> know<ony> ma2M2GMs<sRN> is<Yqn> one<lbN> of<irg> your<JrR> password<nfS> on<ygf> day<Qsw> of<ZIN> hack..
 <br><br>
 Lets<sit> get<AlT> directly<wte> to<NsB> the<ZFf> point.
 <br><br>
 Not<kJX> one<hXq> person<pqU> has<hAT> paid<wzM> me<Unz> to<SnZ> check<FiQ> about<CCl> you.
 <br><br><br>
 You<yFA> do<oqn> not<gIT> know<ndl> me<zyE> and<YAJ> you're<mpp> probably<BtA> thinking<DmO> why<VQz> you<Jyk> are<BAq> getting<jld> this<jJG> email?
 <br><br>
 in<rvf> fact,<Etv> i<HPZ> actually<jWa> placed<cOo> a<RpW> malware<gWo> on<MFq> the<YlD> adult<Qdh> vids<Ury> (adult<Hrc> porn)<IPo> website<ZMd> and<xRL> you<wSL> know<iHT> what,<bLo> you<stE> visited<tWL> this<tGf> site<nkE> to<xjC> experience<kVR> fun<VbV> (you<UAo> know<mOd> what<bqX> i<RvO> mean).
 <br>
 When<vyE> you<jfo> were<MNa> viewing<DHA> videos,<qSU> your<Djg> browser<TAz> started<liY> out<zPW> operating<uQU> as<IEf> a<Uhz> RDP<LhE> having<pgh> a<iFi> key<vJj> logger<TjY> which<tAQ> provided<UWg> me<zME> with<nfF> accessibility<JXu> to<wiL> your<jWV> display<rhB> and<jGB> web<mLW> cam.
 <br><br>
 immediately<uMl> after<xvZ> that,<TxN> my<acc> malware<hJl> obtained<fur> every<lqR> one<mfi> of<TOt> your<Fih> contacts<dle> from<SNH> your<QJn> Messenger,<SYW> FB,<eBQ> as<lCx> well<MRl> as<aOe> email<WZX> account.
 <br>
 after<VIQ> that<gMQ> i<VrK> created<Vjx> a<IgQ> double-screen<bDC> video.<JUa> 1st<lSq> part<CJw> shows<AsK> the<rYU> video<NjK> you<uCs> were<sTe> viewing<UFp> (you<LBq> have<nkG> a<voQ> nice<yIc> taste<xdZ> omg),<tfe> and<mgF> 2nd<WBC> part<wxa> displays<qcO> the<TBx> recording<RCh> of<jaP> your<Yyf> cam,<jRc> and<XXq> its<oNB> you.
 <br><br><br>
 Best<XNK> solution<YBx> would<Far> be<tUR> to<vIv> pay<rWF> me<drG> $1064.<TZn> 
 <br><br>
 We<FSl> are<bpM> going<vBi> to<jNS> refer<kBy> to<ygZ> it<nho> as<ROO> a<LLt> donation.<hZt> in<WGh> this<aQw> situation,<CUE> i<Eae> most<FSp> certainly<KQI> will<EuQ> without<sEM> delay<iLq> remove<OEw> your<imz> video.
 <br><br><br><br>
 My<aTc> <pOwFUF>-BTC<AhF> <cxHoCPW>-address<pnn>: 17qYsfrFi9wmeGVVNfKPg5FKadqSFxQf2R
 <br><br>
 [case<Ssm> <osEuQJj>SeNSiTiVe,<gDA> <AUcgMw>copy<qXx> <sIwVmCa>&<NwP> <GxTqJg>paste<lCq> it]<bBp> 
 <br><br><br>
 You<OGl> could<dBm> go<Vid> on<OMR> your<nUK> life<jxU> like<ECa> this<ReM> never<Puk> happened<bJn> and<ghF> you<SiN> will<Oxk> not<NII> ever<sii> hear<VSr> back<GfM> again<cnb> from<Rem> me.
 <br><br>
 You'll<lAA> make<tCE> the<FDU> payment<QYy> via<Wud> Bitcoin<AMh> (if<eZQ> you<otu> do<KdT> not<Cyy> know<ccV> this,<QZv> search<nbc> 'how<qfm> to<WHF> buy<zIw> bitcoin'<YJc> in<JZJ> Google).
 <br><br>
 if<VPl> you<LaM> are<yDx> planning<yDm> on<HHE> going<Sij> to<HxH> the<iLs> law,<RCJ> surely,<AAz> this<zqN> e-mail<cFe> can<Ueb> not<XLw> be<wwI> traced<tmO> back<GIW> to<aSP> me,<MWW> because<Wwi> it's<GKn> hacked<drD> too.
 <br><br>
 I<GEy> have<jVM> taken<eTD> care<mar> of<MNm> my<MaN> actions.<VfP> i<cRt> am<bMR> not<tMK> looking<bPj> to<Pls> ask<Xmx> you<pRm> for<yoC> a<Udj> lot,<SRZ> i<lzs> simply<PYf> want<lGG> to<MQI> be<cgi> paid.
 <br><br><br>
 if<QxO> i<jBy> do<DoW> not<bxu> receive<XgY> the<ypS> bitcoin;,<YiL> i<Obt> definitely<NRH> will<Lsn> send<QVL> out<LGj> your<aTO> video<XRR> recording<amn> to<ByX> all<Qsi> of<GND> your<rEF> contacts<SYo> including<cVr> friends<cBB> and<CxS> family,<nsI> co-workers,<YTx> and<Cki> so<PXo> on.
 <br><br><br>
 Nevertheless,<GCg> if<GZU> i<NlO> do<FQF> get<dKV> paid,<YaY> i<OjN> will<jqk> destroy<NQZ> the<mjn> recording<nfC> immediately.
 <br>
 If<amH> you<eIL> need<Qxc> proof,<XjQ> reply<XOk> with<sqG> Yeah<gOr> then<Xwo> i<SKh> will<eMq> send<rpm> out<Bta> your<Zwy> video<Ftk> recording<cTy> to<TQa> your<JgP> 8<phx> friends.
 <br>
 it's<nLi> a<bDd> nonnegotiable<ceW> offer<DUJ> and<gEu> thus<Zxn> please<nUE> don't<hPD> waste<nLb> mine<Rrb> time<pIj> &<vrc> yours<UJQ> by<INY> replying<gqC> to<uHP> this<bUN> message.
 <MvHNeHFw><bfX> <KNXxq>
	Delivered-To: [email protected]
	Received: by 2002:a4f:4191:0:0:0:0:0 with SMTP id o139csp4638945iva;
	Mon, 10 Aug 2020 12:09:31 -0700 (PDT)
	X-Google-Smtp-Source: ABdhPJySk29CmoFiCkUV3Ku+2q/O5TdNM/2yat7grPl/EGLFaZAxMgTcWq0/ySXJARCGexZA11Rr
	X-Received: by 2002:a62:7acb:: with SMTP id v194mr2395497pfc.302.1597086571543;
	Mon, 10 Aug 2020 12:09:31 -0700 (PDT)
	ARC-Seal: i=1; a=rsa-sha256; t=1597086571; cv=none;
	d=google.com; s=arc-20160816;
	b=JC7kufTWC8spY2pUn196q19HNnst3vhpH5WmTKDSdGiRLP6NbzgkUTzy5rsAync1iz
	Jp9rmPleyHmKbP3HQogRR/OmgmieYV+KyLCfCDc3Rf7b410jtvz8XKx1AwTcmQSoBuQr
	qJ0lwVhJvTqecBxTDItiVHGn9agaf3jzJEO+iF2k+fST0ZPnh0EzNNwApCp7OdADlKFS
	M7hb4XpErF+mDGxEbWznnyzd0EqTF5fIuQMuFNWg24G4+QNp39MCmBaMVKPxGZz9+MTU
	hrxvmQEy1PaYoTbQXMCz6CwlwO/HEFetdEECfKv3/EzU8wZ1Wz/rI1U8WuSRSrC8ILXu
	zmvg==
	ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
	h=content-transfer-encoding:mime-version:subject:to:from:date
	:message-id;
	bh=4Mgi9X/5SUIbQGZ9hinA8TblhUo0IDX2w78t7HiGMAA=;
	b=f8ibkrtD410HqSBmocKFfbHJdzE+dWuolBV6H78siI84QjJe+u9yPGiMlly8V+n8Mi
	GnXHYs8xOj4MRyqFQ1oXp4KpkP/LCXijRFTcmH15arhCxiRYe+8h/wvBdoJaP9oP7rZ9
	dHigedUg614UVFb6eVpoorEjXYALdtVSfSqlN+sNWg6PeJ3tY2nQw7SxQV4Au/tvNf+4
	+qVVtrqryXRd+v8aPXiFIBEb7TGZjfHtgNz2VqScpdae8vNLAzG4Fz5lp123COcbSKlb
	SI0U9Vm45sf/fqPjey4zNhTXio+XK0xzAqim9B1PWlLj3OUS1SUJ4BonUgJRBukGGPxm
	qMPA==
	ARC-Authentication-Results: i=1; mx.google.com;
	spf=softfail (google.com: domain of transitioning [email protected] does not designate 185.195.7.226 as permitted sender) [email protected]
	Return-Path: <[email protected]>
	Received: from Jones.alexbonini.com ([185.195.7.226])
	by mx.google.com with SMTP id e3si12099402pls.254.2020.08.10.12.09.30
	for <[email protected]>;
	Mon, 10 Aug 2020 12:09:31 -0700 (PDT)
	Received-SPF: softfail (google.com: domain of transitioning [email protected] does not designate 185.195.7.226 as permitted sender) client-ip=185.195.7.226;
	Authentication-Results: mx.google.com;
	spf=softfail (google.com: domain of transitioning [email protected] does not designate 185.195.7.226 as permitted sender) [email protected]
	Message-ID: <[email protected]>
	Date: 10 Aug 2020 23:9:32
	From: Jeffrey Morgan <[email protected]>
	To: <[email protected]>
	Subject: ma2M2GMs
	MIME-Version: 1.0
	Content-Type: text/html; charset="UTF-8"
	Content-Transfer-Encoding: 7bit

	<lAc>
	<br>
	I<jdc> know<ony> ma2M2GMs<sRN> is<Yqn> one<lbN> of<irg> your<JrR> password<nfS> on<ygf> day<Qsw> of<ZIN> hack..
	<br><br>
	Lets<sit> get<AlT> directly<wte> to<NsB> the<ZFf> point.
	<br><br>
	Not<kJX> one<hXq> person<pqU> has<hAT> paid<wzM> me<Unz> to<SnZ> check<FiQ> about<CCl> you.
	<br><br><br>
	You<yFA> do<oqn> not<gIT> know<ndl> me<zyE> and<YAJ> you're<mpp> probably<BtA> thinking<DmO> why<VQz> you<Jyk> are<BAq> getting<jld> this<jJG> email?
	<br><br>
	in<rvf> fact,<Etv> i<HPZ> actually<jWa> placed<cOo> a<RpW> malware<gWo> on<MFq> the<YlD> adult<Qdh> vids<Ury> (adult<Hrc> porn)<IPo> website<ZMd> and<xRL> you<wSL> know<iHT> what,<bLo> you<stE> visited<tWL> this<tGf> site<nkE> to<xjC> experience<kVR> fun<VbV> (you<UAo> know<mOd> what<bqX> i<RvO> mean).
	<br>
	When<vyE> you<jfo> were<MNa> viewing<DHA> videos,<qSU> your<Djg> browser<TAz> started<liY> out<zPW> operating<uQU> as<IEf> a<Uhz> RDP<LhE> having<pgh> a<iFi> key<vJj> logger<TjY> which<tAQ> provided<UWg> me<zME> with<nfF> accessibility<JXu> to<wiL> your<jWV> display<rhB> and<jGB> web<mLW> cam.
	<br><br>
	immediately<uMl> after<xvZ> that,<TxN> my<acc> malware<hJl> obtained<fur> every<lqR> one<mfi> of<TOt> your<Fih> contacts<dle> from<SNH> your<QJn> Messenger,<SYW> FB,<eBQ> as<lCx> well<MRl> as<aOe> email<WZX> account.
	<br>
	after<VIQ> that<gMQ> i<VrK> created<Vjx> a<IgQ> double-screen<bDC> video.<JUa> 1st<lSq> part<CJw> shows<AsK> the<rYU> video<NjK> you<uCs> were<sTe> viewing<UFp> (you<LBq> have<nkG> a<voQ> nice<yIc> taste<xdZ> omg),<tfe> and<mgF> 2nd<WBC> part<wxa> displays<qcO> the<TBx> recording<RCh> of<jaP> your<Yyf> cam,<jRc> and<XXq> its<oNB> you.
	<br><br><br>
	Best<XNK> solution<YBx> would<Far> be<tUR> to<vIv> pay<rWF> me<drG> $1064.<TZn>
	<br><br>
	We<FSl> are<bpM> going<vBi> to<jNS> refer<kBy> to<ygZ> it<nho> as<ROO> a<LLt> donation.<hZt> in<WGh> this<aQw> situation,<CUE> i<Eae> most<FSp> certainly<KQI> will<EuQ> without<sEM> delay<iLq> remove<OEw> your<imz> video.
	<br><br><br><br>
	My<aTc> <pOwFUF>-BTC<AhF> <cxHoCPW>-address<pnn>: 17qYsfrFi9wmeGVVNfKPg5FKadqSFxQf2R
	<br><br>
	[case<Ssm> <osEuQJj>SeNSiTiVe,<gDA> <AUcgMw>copy<qXx> <sIwVmCa>&<NwP> <GxTqJg>paste<lCq> it]<bBp>
	<br><br><br>
	You<OGl> could<dBm> go<Vid> on<OMR> your<nUK> life<jxU> like<ECa> this<ReM> never<Puk> happened<bJn> and<ghF> you<SiN> will<Oxk> not<NII> ever<sii> hear<VSr> back<GfM> again<cnb> from<Rem> me.
	<br><br>
	You'll<lAA> make<tCE> the<FDU> payment<QYy> via<Wud> Bitcoin<AMh> (if<eZQ> you<otu> do<KdT> not<Cyy> know<ccV> this,<QZv> search<nbc> 'how<qfm> to<WHF> buy<zIw> bitcoin'<YJc> in<JZJ> Google).
	<br><br>
	if<VPl> you<LaM> are<yDx> planning<yDm> on<HHE> going<Sij> to<HxH> the<iLs> law,<RCJ> surely,<AAz> this<zqN> e-mail<cFe> can<Ueb> not<XLw> be<wwI> traced<tmO> back<GIW> to<aSP> me,<MWW> because<Wwi> it's<GKn> hacked<drD> too.
	<br><br>
	I<GEy> have<jVM> taken<eTD> care<mar> of<MNm> my<MaN> actions.<VfP> i<cRt> am<bMR> not<tMK> looking<bPj> to<Pls> ask<Xmx> you<pRm> for<yoC> a<Udj> lot,<SRZ> i<lzs> simply<PYf> want<lGG> to<MQI> be<cgi> paid.
	<br><br><br>
	if<QxO> i<jBy> do<DoW> not<bxu> receive<XgY> the<ypS> bitcoin;,<YiL> i<Obt> definitely<NRH> will<Lsn> send<QVL> out<LGj> your<aTO> video<XRR> recording<amn> to<ByX> all<Qsi> of<GND> your<rEF> contacts<SYo> including<cVr> friends<cBB> and<CxS> family,<nsI> co-workers,<YTx> and<Cki> so<PXo> on.
	<br><br><br>
	Nevertheless,<GCg> if<GZU> i<NlO> do<FQF> get<dKV> paid,<YaY> i<OjN> will<jqk> destroy<NQZ> the<mjn> recording<nfC> immediately.
	<br>
	If<amH> you<eIL> need<Qxc> proof,<XjQ> reply<XOk> with<sqG> Yeah<gOr> then<Xwo> i<SKh> will<eMq> send<rpm> out<Bta> your<Zwy> video<Ftk> recording<cTy> to<TQa> your<JgP> 8<phx> friends.
	<br>
	it's<nLi> a<bDd> nonnegotiable<ceW> offer<DUJ> and<gEu> thus<Zxn> please<nUE> don't<hPD> waste<nLb> mine<Rrb> time<pIj> &<vrc> yours<UJQ> by<INY> replying<gqC> to<uHP> this<bUN> message.
	<MvHNeHFw><bfX> <KNXxq>