Forum Discussion
Scary Email Scams...
Yup, that's it.
You should know that the majority of what's in there is fake.They have nothing else on you - no video, no nothing. There is usually no active pixel image in the html, either (the kind that spams use to validate you've opened it - why you should never, ever download remote images in an email).
Your email/password combination was likely obtained from a prior breach posted to the dark web, and retrieved by whoever created this thing. Have to admit that combined with the text, it adds a pretense of credulity.
The bitcoin accounts are always valid, otherwise they'd have no way of getting compensated, and yes they are barely traceable back to the offender. Seems they've not received a dime on that account tho.
But, if you have the headers you can look at the first "received from" line, reverse lookup the IP and figure out what the last server was used to send it to you (anything past that in the headers is likely forged). You might want to forward to their abuse/legal team and hint at possibly prosecuting the illicit activity. That's what I did with Microsoft - they'll sit up and take notice of that.
My advice is to send it to the abuse/legal team of the server that sent it last as well as possibly the FBI via the link that's earlier in the thread. I would also definitely change any passwords - especially the one stated in the email. However, I would not do anything to engage these people in any way, not even jokingly, because you validate youe existence and you don't know what they'll do as a response.
MarkJFine wrote:
But, if you have the headers you can look at the first "received from" line, reverse lookup the IP and figure out what the last server was used to send it to you (anything past that in the headers is likely forged). You might want to forward to their abuse/legal team and hint at possibly prosecuting the illicit activity. That's what I did with Microsoft - they'll sit up and take notice of that.
My advice is to send it to the abuse/legal team of the server that sent it last as well as possibly the FBI via the link that's earlier in the thread. I would also definitely change any passwords - especially the one stated in the email.
The only thing I could figure out to do in order to see anything more than the sender email address is to "View Message Source", and it shows a huge amount of info, all of which is foreign to me. I don't know what it is I'm supposed to be looking for or seeing.
There's all kinds of info in the message source, but one thing you see (I haven't looked at a message source in a long time, but I imagine they haven't changed much) is where the email comes from (gmail, for instance). Sometimes there are IP addresses there too. Most of the rest makes no sense to me, but I'll be happy to send it to the Feds.
GabeU wrote:The only thing I could figure out to do in order to see anything more than the sender email address is to "View Message Source", and it shows a huge amount of info, all of which is foreign to me. I don't know what it is I'm supposed to be looking for or seeing.
The trick is to always look for the first "Received From" then there will be an IP in square brakets. That is the IP of the server that HELO'd your email server before it sent it. Everything else can be forged, including the servername that's supposed to be associated with the IP. Not likely the IP itself was was forged during a HELO handshake.
Edit: Looks like this:
Received: from APC01-SG2-obe.outbound.protection.outlook.com (mail-sg2apc01hn0245.outbound.protection.outlook.com [104.47.125.245])
