API tools faq
paste
wavellan

20260406_EMAIL_SCAM_1

wavellan
Apr 6th, 2026
168
0
Never
9
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 6.47 KB | None | 0 0
raw download clone embed print report
  1. Information about your online security
  2. You've been HACKED<[email protected]>
  3. ​you​
  4. Hello,
  5.  
  6. We are ShinyHunters hacking group.
  7. We've known each other for a while, at least we know you.
  8. A few months ago, we gained access to your devices and started monitoring your online activities.
  9.  
  10. What happened:
  11. We got access to the database CarGurus.com where you had an account with and easily accessed your e-mail.
  12. You weren't very careful about the links you opened.
  13. A week later, we installed an exploit on your devices including your phone, giving us access to your microphone,
  14. camera, keyboard, and all your data.
  15. We have your photos,browsing history, conversations, and contact list.
  16.  
  17. Besides other things, we discovered that you frequently visit adult websites and watch explicit videos.
  18. We managed to record you and created videos of you pleasuring yourself.
  19. With a few clicks, we can share these videos with your friends,
  20. colleagues, and family or even make them public.
  21.  
  22. Proposal:
  23. Send us $2000 in Bitcoin to the following wallet:
  24. 13qZjzWJsvLidZ7SMgu9ACs8s7HwvdWoNP
  25.  
  26. We'll delete everything immediately.
  27. You have 48 hours from the moment you opened this e-mail.
  28. Once the payment is received, we'll remove the malware from your devices.
  29.  
  30. What you should NOT do:
  31. Do not reply (email is sent from a hacked account).
  32. Do not contact the police or anyone else—we'll release the videos along with other stuff all over the internet.
  33. Do not try to reset your devices—everything is stored on remote servers.
  34.  
  35. What you don’t need to worry about:
  36. Will see your payment immediately—The wallet is generated specially for you.
  37. Will not share your videos or other things after payment—There is no reason to keep causing problems.
  38.  
  39.  
  40.  
  41.  
  42. Received: from LVUPR05MB998558.namprd05.prod.outlook.com (::1) by
  43. PH0PR05MB8672.namprd05.prod.outlook.com with HTTPS; Sun, 5 Apr 2026 06:00:38
  44. +0000
  45. Received: from DS7P222CA0014.NAMP222.PROD.OUTLOOK.COM (2603:10b6:8:2e::34) by
  46. LVUPR05MB998558.namprd05.prod.outlook.com (2603:10b6:408:3a4::11) with
  47. Microsoft SMTP Server (version=TLS1_2,
  48. cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9769.17; Sun, 5 Apr
  49. 2026 06:00:36 +0000
  50. Received: from CY4PEPF0000EE3B.namprd03.prod.outlook.com
  51. (2603:10b6:8:2e:cafe::40) by DS7P222CA0014.outlook.office365.com
  52. (2603:10b6:8:2e::34) with Microsoft SMTP Server (version=TLS1_3,
  53. cipher=TLS_AES_256_GCM_SHA384) id 15.20.9769.31 via Frontend Transport; Sun,
  54. 5 Apr 2026 06:00:33 +0000
  55. Authentication-Results: spf=pass (sender IP is 222.227.81.179)
  56. smtp.mailfrom=jtw.zaq.ne.jp; dkim=pass (signature was verified)
  57. header.d=jtw.zaq.ne.jp;dmarc=pass action=none
  58. header.from=jtw.zaq.ne.jp;compauth=pass reason=100
  59. Received-SPF: Pass (protection.outlook.com: domain of jtw.zaq.ne.jp designates
  60. 222.227.81.179 as permitted sender) receiver=protection.outlook.com;
  61. client-ip=222.227.81.179; helo=mta-sp-w03.jcom.zaq.ne.jp; pr=C
  62. Received: from mta-sp-w03.jcom.zaq.ne.jp (222.227.81.179) by
  63. CY4PEPF0000EE3B.mail.protection.outlook.com (10.167.242.14) with Microsoft
  64. SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9769.17
  65. via Frontend Transport; Sun, 5 Apr 2026 06:00:34 +0000
  66. Received: from mta-or-w01.jcom.zaq.ne.jp by osmta1015-jc.im.kddi.ne.jp
  67. with ESMTP
  68. id <20260405060033169.OTSZ.117048.mta-or-w01.jcom.zaq.ne.jp@mta-sp-w03.jcom.zaq.ne.jp>;
  69. Sun, 5 Apr 2026 15:00:33 +0900
  70. Received: from xsbvl by omta1015-jc.im.kddi.ne.jp with SMTP
  71. id <[email protected]>;
  72. Sun, 5 Apr 2026 15:00:32 +0900
  73. Message-ID: <[email protected]>
  74. From: "You've been HACKED" <[email protected]>
  75. To: you <you>
  76. Subject: Information about your online security
  77. Date: Sat, 4 Apr 2026 23:00:15 -0700
  78. MIME-Version: 1.0
  79. Content-Type: text/plain; charset="utf-8"
  80. Content-Transfer-Encoding: 8bit
  81. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=jtw.zaq.ne.jp; s=default-1th84yt82rvi; t=1775368833;
  82. bh=rsD+dklRv//JSvhtD4Pgy4fondVuT1M+WbDnn570zlY=;
  83. h=From:To:Subject:Date;
  84. b=emlTVBxq2qsd3Jl10m3ALqAOIhSF/VbbJi9WOlUUx4gZXDEx5+uK4J1eEbn1EaOM0+oNlkg3
  85. P4UhhSx2P5zq+z71z04d8luXXDo7B5RoAJDQ6+a1RyXYmLICWEgGgYWJpO+NXoO1HXXUTZzwx4
  86. +va0JLuUIG61lMr8ikvIwweqz+uFb4HTEZJ/dU6Jl1vXDFA+hn+n2B9GhcogjIR20rGw9c9/R7
  87. 1HuiGuDI5NKwgzivthy3CrRvRhK+BcEw69SfFFzsCIQoXHmiM4L2PIIOfihLRW8GHacC5ILhdL
  88. W3Gf6WUF8n6mPGaszKtLa6Xny5ZutLZ+PYiKdjL6AdC4g6Fg==
  89. Return-Path: [email protected]
  90. X-MS-Exchange-Organization-ExpirationStartTime: 05 Apr 2026 06:00:34.8540
  91. (UTC)
  92. X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
  93. X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000
  94. X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
  95. X-MS-Exchange-Organization-Network-Message-Id:
  96. 392f53f7-027a-4855-3d84-08de92d8a72d
  97. X-EOPAttributedMessage: 0
  98. X-EOPTenantAttributedMessage: 0d4bfd0a-5b8b-4c86-b245-3f11f8ea539a:0
  99. X-MS-Exchange-Organization-MessageDirectionality: Incoming
  100. X-MS-PublicTrafficType: Email
  101. X-MS-TrafficTypeDiagnostic:
  102. CY4PEPF0000EE3B:EE_|LVUPR05MB998558:EE_|PH0PR05MB8672:EE_
  103. X-MS-Exchange-Organization-AuthSource:
  104. CY4PEPF0000EE3B.namprd03.prod.outlook.com
  105. X-MS-Exchange-Organization-AuthAs: Anonymous
  106. X-MS-Office365-Filtering-Correlation-Id: 392f53f7-027a-4855-3d84-08de92d8a72d
  107. X-MS-Exchange-Organization-SCL: 5
  108. X-Forefront-Antispam-Report:
  109. CIP:222.227.81.179;CTRY:JP;LANG:en;SCL:5;SRV:;IPV:NLI;SFV:SPM;H:mta-sp-w03.jcom.zaq.ne.jp;PTR:mta-sp-w03.jcom.zaq.ne.jp;CAT:PHISH;SFS:(13230040)(704160811799003)(16143499012);DIR:INB;
  110. X-Microsoft-Antispam: BCL:0;ARA:13230040|704160811799003|16143499012;
  111. X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Apr 2026 06:00:34.2606
  112. (UTC)
  113. X-MS-Exchange-CrossTenant-Network-Message-Id: 392f53f7-027a-4855-3d84-08de92d8a72d
  114. X-MS-Exchange-CrossTenant-Id: 0d4bfd0a-5b8b-4c86-b245-3f11f8ea539a
  115. X-MS-Exchange-CrossTenant-AuthSource:
  116. CY4PEPF0000EE3B.namprd03.prod.outlook.com
  117. X-MS-Exchange-CrossTenant-AuthAs: Anonymous
  118. X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
  119. X-MS-Exchange-Transport-CrossTenantHeadersStamped: LVUPR05MB998558
  120. X-MS-Exchange-Transport-EndToEndLatency: 00:00:03.8096520
  121. X-MS-Exchange-Processed-By-BccFoldering: 15.20.9769.018
  122. X-MS-Exchange-ExternalInOutlookResult: NotEnabled
  123. X-Microsoft-Antispam-Mailbox-Delivery:
  124. ucf:0;jmr:0;auth:0;dest:J;OFR:SpamFilterAuthJ;ENG:(910005)(944506478)(944626604)(4710137)(4715077)(4999163)(920097)(930201)(3100021)(140003);RF:JunkEmail;
  125. X-Microsoft-Antispam-Message-Info:
  126.  
Advertisement
Comments
  • Gelzozak
    Gelzozak
    200 days
    Comment was deleted
  • Lartavor
    Lartavor
    197 days
    Comment was deleted
  • User was banned
  • User was banned
  • User was banned
  • User was banned
  • Fyndimcu
    Fyndimcu
    28 days
    Comment was deleted
  • User was banned
  • Wahikep
    Wahikep
    5 days
    Comment was deleted
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!