I've been getting these emails for a while now. If you realize that it's just a scam, they're providing a service similar to Have I Been Pwned, delivered directly to your inbox!
They've earned nearly 3BTC off of this scam if BitRef is accurate: <a href="https://bitref.com/15ZHnf1MPn6ybb8yUeAoCQ1AJtiKhg3NrP" rel="nofollow">https://bitref.com/15ZHnf1MPn6ybb8yUeAoCQ1AJtiKhg3NrP</a>
I have been getting a variation of this email for months sent to mailer-daemon@ on a mail server on a VM that hosts absolutely no personal information or credential about anyone.<p>If you Google some phrases from it it seems like it's been going around nearly verbatim for years.<p>I think they are probing for mail servers which don't try to force any kind of authentication on From: headers. So mailing lists would probably be a fit for them. They have no idea who their targets are. They are just looking for gullible people to scam.
I'm surprised it doesn't include a link to a "security site" with a domain like "passwordcheck.ru" to verify that the new password is secure.<p>The thing that confuses me about this is that it includes the password. Certainly most people would go "that's not my password" and ignore it. Are they trying to filter out the results to only people with atrocious passwords?
Ouch [1]<p>I like the cut of whoever sent 0.00000666 BTC's jib.<p>[1] <a href="https://www.blockchain.com/btc/address/15ZHnf1MPn6ybb8yUeAoCQ1AJtiKhg3NrP" rel="nofollow">https://www.blockchain.com/btc/address/15ZHnf1MPn6ybb8yUeAoC...</a>
> This is a hacker code of honor.<p>Had me right there. The entertainment value alone would be worth it, if I did not also have to calm down those (few) of my clients who are a little more, shall we say, persuadable?<p>Then out comes the "good security practices" text, along with credit card monitoring recommendations text, etc.<p>"I know it's true, 'cause I saw it on tv." - John Fogerty
a lot of people get this spam. I received as similar one. it's spam filter configuration of lkml and I doubt that it is an actual targeted attack.<p><i>> After that, I made a full dump of your disk (I have all your address book, history of viewing sites, all files, phone numbers and addresses of all your contacts).</i><p><i>> I made a screenshot of the intimate website where you have fun (you know what it is about, right?).
After that, I took off your joys (using the camera of your device). It turned out beautifully, do not hesitate.
</i><p>+1 for social engineering.<p>and very similar to the thousands of other such mails sent out every day by scammers.
> Do not worry, the timer will start at the moment when you open this letter. Yes, yes .. it has already started!<p>The most impressive part of this hack is that he got read receipts for emails!
The mysterious individual extorting me assures me that paying their ransom via bitcoin is even easier than a credit card transaction.<p>How informative and thoughtful of them.
I've seen similar emails in my DMARC rejected email reports.<p>The unique thing about these ones is that they send it from your own address. I.e. they spoof your address so that it looks like your account really has been compromised.<p>Like this:<p>From: me@example.com<p>To: me@example.com