Abuse to Bitcoin address
15iiic5PmfGvE3TyMP1JyYh1W9KxQLGQL6

Sextortion

Abuser: chuvashia@rfn.ru

Supposedly from my own e-mail address (which I do not mention here ...) Return-Path: <chuvashia@rfn.ru> Received: from proofpoint3.rfn.ru (proofpoint2.rfn.ru [80.247.46.69]) Received: from pps.filterd (proofpoint3.rfn.ru [127.0.0.1]) by proofpoint3.rfn.ru (8.16.0.27/8.16.0.27) with SMTP id x2U1fMeV006768 Received: from rfn.ru (nut.rfn.ru [80.247.32.131]) by proofpoint3.rfn.ru with ESMTP id 2rhwn4r61u-1 Received: from [78.30.252.30] (account vesti21@rfn.ru HELO [host-30-252-30-78.sevstar.net]) X-Sender-Info: chuvashia@rfn.ru Subject: The signs in front of the at-sign of my own email address The hacker had no success so far, see here: https://bitcoinwhoswho.com/address/15iiic5PmfGvE3TyMP1JyYh1W9KxQLGQL6

Sweden, 2019-03-30 11:57:55

Ransomware

Abuser: cmr@barretos.sp.gov.br, bospopproxy09.eigbox.net

Randsome ware my account has been affected, renew your password immediately. The message is in a picture format. Return-Path: <cmr@barretos.sp.gov.br> Delivered-To: Received: from bospopproxy09.eigbox.net ([10.20.15.1]) by bospop03.eigbox.net with LMTP id eGhUNNytn1wPfQAAUsCngg for <########################>; Sat, 30 Mar 2019 13:56:44 -0400 Received: from bosmailscan01.eigbox.net ([10.20.15.1]) by bospopproxy09.eigbox.net with LMTP id 6BYnNNytn1wSDwAAlYqATA ; Sat, 30 Mar 2019 13:56:44 -0400 Return-path: <cmr@barretos.sp.gov.br> Envelope-to: Delivery-date: Sat, 30 Mar 2019 13:56:44 -0400

Canada, 2019-03-30 18:32:29

Sextortion

Abuser: cjtaoci@vip.163.com

Image of text. Threatens exposure of data if not paid.

United States, 2019-03-30 19:25:48

Ransomware

Abuser: 15iiic5PmfGvE3TyMP1JyYh1W9KxQLGQL6

Asking to pay 1000$

India, 2019-03-31 17:20:21

Sextortion

Abuser: Return-Path: - IP 114.7.162.6 - ISP: INDOSAT (Indonesia)

Same as other reports.

Portugal, 2019-03-31 18:13:33

Blackmail scam

Abuser: Unknown

Blackmail scammer

Estonia, 2019-03-31 21:52:43

Ransomware

Abuser: siswanta@unisri.ac.id⁩

image file with extortion demand

United States, 2019-03-31 23:37:55

Blackmail scam

Abuser: ogino@portalgraphics.net (spoofed, no doubt)

claimed to have hacked my computer, camera, and email account. Since it came in on an email forwarding account it could not be hacked. The entire message was a single jpg. Stupid idiot told me to cut and paste his bitcoin address but he put it in the graphic. How can one cut and paste from a graphic? Idiot. Received: from unknown (HELO ?host.9.148.broadband.redcom.ru?) (ogino@portalgraphics.net@212.19.9.148) by 0 with SMTP; 1 Apr 2019 07:44:50 +0900 List-ID: 1062772806.gmayo.local List-Subscribe: http://portalgraphics.net/mailman/listinfo/portalgraphics.net

United States, 2019-03-31 23:42:14

Blackmail scam

Abuser: Idiot

The guy who made this email is a fucking stupid idiot :-D Made my day.

Czechia, 2019-04-01 05:26:10

Ransomware

Abuser: ziaangela@ziaangela.it

Ransomeware email asking for $1000. Supposedly sent from email account I own. Message contains image file asking for bitcoin payment to be sent to 15iiic5PmfGvE3TyMP1JyYh1W9KxQLGQL6. Header info: Received: (qmail 19086 invoked by uid 30297); 1 Apr 2019 04:17:20 -0000 Received: from unknown (HELO p3plibsmtp01-09.prod.phx3.secureserver.net) ([72.167.238.225]) (envelope-sender <ziaangela@ziaangela.it>) by p3plsmtp10-04-25.prod.phx3.secureserver.net (qmail-1.03) with SMTP for <xxxxxxxxxxxxxxx>; 1 Apr 2019 04:17:20 -0000 Received: from WIN-IES35EM77RK.home ([81.29.208.253]) by CMGW with ESMTP id AoNnhKtxHBs7oAoNnhacol; Sun, 31 Mar 2019 21:17:19 -0700 Received: from [host-84-54-202-216.stavropol.ru] ([84.54.202.216]) by home with MailEnable ESMTP; Mon, 1 Apr 2019 07:26:09 +0200 Abuse-Reports-To: <abuse@mailer.ziaangela.it>X-Aid: 0432442972X-Mailer: Sendy (https://sendy.co) X-Ip-Spam: Suspect X-Nonspam: WhitelistX-Sender-Info: ziaangela@ziaangela.it

United States, 2019-04-01 12:44:53

Blackmail scam

Abuser: 15iiic5PmfGvE3TyMP1JyYh1W9KxQLGQL6

Received:from [235-180-252-87.filibe.net] (unknown [87.252.180.235])

France, 2019-04-02 10:48:59

Blackmail scam

Abuser: hb@hbmonte.com

Received: from 177-86-156-46.netecom.net.br ([177.86.156.46]:49303 helo=[177-86-156-108.netecom.net.br]) by server.saveonlocaldeals.com with esmtpsa (TLSv1:ECDHE-RSA-AES256-SHA:256) (Exim 4.91) (envelope-from <hb@hbmonte.com>) id 1hAb50-000822-7N for [my email]; Sun, 31 Mar 2019 10:05:10 -0400 List-ID: tbfsheqeecx8b9p2eu48aa7pm6e list <582f2z9fg31gpdsqywxgzctf3.784333.list-id.hbmonte.com>

United States, 2019-04-02 19:54:03