I there
I received one of those Pegasus mails. The information I could get goes next. Thanks In advance:
Received: from AS8P193MB1432.EURP193.PROD.OUTLOOK.COM (::1) by AS8P193MB2141.EURP193.PROD.OUTLOOK.COM with HTTPS; Thu, 22 Aug 2024 21:29:34 +0000 Received: from PH7PR17CA0039.namprd17.prod.outlook.com (2603:10b6:510:323::18) by AS8P193MB1432.EURP193.PROD.OUTLOOK.COM (2603:10a6:20b:39b::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7897.19; Thu, 22 Aug 2024 21:29:33 +0000 Received: from SN1PEPF00036F3F.namprd05.prod.outlook.com (2603:10b6:510:323:cafe::10) by PH7PR17CA0039.outlook.office365.com (2603:10b6:510:323::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7897.19 via Frontend Transport; Thu, 22 Aug 2024 21:29:32 +0000 Authentication-Results: spf=softfail (sender IP is 195.133.35.148) smtp.mailfrom=outlook.com; dkim=none (message not signed) header.d=none;dmarc=fail action=none header.from=outlook.com; Received-SPF: SoftFail (protection.outlook.com: domain of transitioning outlook.com discourages use of 195.133.35.148 as permitted sender) Received: from mac106.com (195.133.35.148) by SN1PEPF00036F3F.mail.protection.outlook.com (10.167.248.23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7897.11 via Frontend Transport; Thu, 22 Aug 2024 21:29:31 +0000 X-IncomingTopHeaderMarker: OriginalChecksum:D8A20EA3873FB4DAEB18E204CCBFF79CAA80679CFC167681960A885A3F15D2D7;UpperCasedChecksum:279915844C9D9397C02E91B49ED12CFE8A8AB629153E0BF42E753818B536A55F;SizeAsReceived:319;Count:7 Message-ID: <******@outlook.com> From: ******@outlook.com To: ******@outlook.com Subject: You have been hacked Date: Thu, 22 Aug 2024 21:29:29 -0700 Content-Type: multipart/alternative; boundary="00672e0117042e2003a9e03642878ca80e93" X-IncomingHeaderCount: 7 Return-Path: ******@outlook.com X-MS-Exchange-Organization-ExpirationStartTime: 22 Aug 2024 21:29:31.7314 (UTC) X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000 X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit X-MS-Exchange-Organization-Network-Message-Id: a0bf435e-7ce7-48dc-8ae3-08dcc2f182cf X-EOPAttributedMessage: 0 X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0 X-MS-Exchange-Organization-MessageDirectionality: Incoming X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: SN1PEPF00036F3F:EE_|AS8P193MB1432:EE_|AS8P193MB2141:EE_ X-MS-Exchange-Organization-AuthSource: SN1PEPF00036F3F.namprd05.prod.outlook.com X-MS-Exchange-Organization-AuthAs: Anonymous X-MS-UserLastLogonTime: 8/22/2024 8:51:52 PM X-MS-Office365-Filtering-Correlation-Id: a0bf435e-7ce7-48dc-8ae3-08dcc2f182cf X-MS-Exchange-EOPDirect: true X-Sender-IP: 195.133.35.148 X-SID-PRA: ******@OUTLOOK.COM X-SID-Result: FAIL X-MS-Exchange-Organization-SCL: 5 X-Microsoft-Antispam: BCL:0;ARA:1444111002|461199028|15080799003|6115599003|3600799018|2980499032|440099028|3412199025|1370799030|1290799027|1360799030|1710799026|7110799015; X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Aug 2024 21:29:31.2158 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: a0bf435e-7ce7-48dc-8ae3-08dcc2f182cf X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa X-MS-Exchange-CrossTenant-AuthSource: SN1PEPF00036F3F.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000 X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8P193MB1432 X-MS-Exchange-Transport-EndToEndLatency: 00:00:03.6206653 X-MS-Exchange-Processed-By-BccFoldering: 15.20.7897.007 X-Microsoft-Antispam-Mailbox-Delivery: ucf:0;jmr:0;ex:0;psp:1;auth:0;dest:J;OFR:SpamFilterAuthJ;ENG:(5062000308)(920221119095)(90000117)(920221120095)(90011020)(91015020)(90015022)(91040095)(9050020)(9080021)(9100341)(1018006)(944500132)(2008001181)(4810010)(4910033)(10005027)(9620004)(9525003)(10150021)(9320005)(9245025)(120001);RF:JunkEmail; X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MjtHRD0xO1NDTD02 X-Microsoft-Antispam-Message-Info: =?utf-8?B?WjUyc2c1ODJmeURFY21QS21zZmNtaGRhakN5MFJaU2lyZXJFTjF3OW5seGhM?= =?utf-8?B?U0tDUWVQSzRxNGd5dTd5aHVZVFMyUmk4d0pZRW1EeTMxWTY5WWhGVldNeFRo?= =?utf-8?B?WGZvL2NCKzFUVzF3NWp4VitmS0VrcWtxVTRqenYrVzFIZ21zSUczS09yM1lz?= =?utf-8?B?Yk5hNWFsNnpqSUU5cFhMZUNLZ0J6bm50OE16b3JpMTVVZk1nODM1a2ZIZUMz?= =?utf-8?B?Q283V3ZiK29waUJuakkyckJiVTZ6dHF3cUtTMGp6MWpwa1Q0RVdSN1VyVGRr?= =?utf-8?B?c2llMVhMMW9wNVNiaTN4Wlk2Z0dkRitlQUJCVXNXNW1Eb2tVb2tGNTZXMEF6?= =?utf-8?B?ZUhOcFdhbFRiZFlseU1TRStXei9jN0M1TzdZaGJqbE9JaGNUL2NyeE1TbDBL?= =?utf-8?B?eks2djh2eVEwWE0xNlFXZ0VzV2krME5MbVJkeTRvUGplZGR0QjFhNStMKytY?= =?utf-8?B?ZlhSS1NCeUViVWJuSkJQUjV3a2JhNjh4ZnBVN0RiYXpCRUVUNVd3WnJ2YzJD?= =?utf-8?B?eDRYNVFObjBtdXlONzJ3QjVQZGg4clp5SkFOeHNRNnhUcC94akt0RDQzWVNp?= =?utf-8?B?d01WTzd1RFVLQ2tmSG1OMnVkQ3VuSXpuR2xLWkw1Tnp5eVEwOUdNV0llZDhp?= =?utf-8?B?VkJ4YXpUeU8vUWhBY2VsU1k5ZUhPMXI4Zkl5Njk1UzcrUVREME5SZkRtVFE2?= =?utf-8?B?bXVNdHRObUVYOG5TSEs1L3lPbTZ3TExOR1lYRkhHajhhWTlWYVdHcnBRTXZh?= =?utf-8?B?ZWVxaytCYzBuZWIyd0prcjI4T01qQi9zRnVoNHAxZGNsSEFPVGNsSFpSODd6?= =?utf-8?B?MXM1YjZwNnMrRTQ2MExqWUI0N1NYc0ZpQmVlSUloNFRFR04rQk8waFJtQzk4?= =?utf-8?B?T1VYbkxsNDR5WURXdEwxbVgvWXlWYy9XaGZURVZ6eFowVTQ2Vjd4d3lxWUpD?= =?utf-8?B?Ym5rVGtIbERZS29mRkdVYmxLL0RTYXdQcEZBN1QyWXgrUk1YR1NMWGlXUUFE?= =?utf-8?B?cEMxQ3F5MEpUY2RKdHBoQzRTZVRWN0ZDM21LM1o2bDZQbXJ2R1JWZTZmSHNa?= =?utf-8?B?TWMweTZHV3llajRxb2hmeStnN1ZXc2xHOWl4LzZ6dU5uWjhLWDN3b0Evcmgz?= =?utf-8?B?TnBMdXRRNFYyMStFL0hSNE1QQ2lyMFFDeTVjRGp1MUFaMUZ5cnhwQXVWUFN4?= =?utf-8?B?VGtXelh3YTY4WDdmMDNzQjIwNFFZYlBRWHZSb3JZbndSLzhZcGw1UU9WWnFI?= =?utf-8?B?aEhjVHlWcm1ZQWpQVUlOaW5ZTkRCMTBNTzM2M1lIS1I5RU5sSXZqNnNUK2pR?= =?utf-8?B?NnBRY0VES2haZUhKQXZGMDI3RkU2aU90SWNrdW9HaUhtZHhDMis4Z0puTEFJ?= =?utf-8?B?OWhDWEhGY0RSUHphcEM3UkRiTGp6czN0bFZTWmF2cGRJNWEzdVJVQnFJNGFt?= =?utf-8?B?RzF2aFNwT1JyMHZxRlN2dG5ZcHdpbUJQRER2MFBxSyttZy9iVGRSMnI3VWM2?= =?utf-8?B?QWNsVmpBOUZXUDZyU0xmYWdUMXF5NVkvbE9GTmo1SXVvcnplOTZ3UUFkNUpm?= =?utf-8?B?ZjROTGFqcFJtWXZqeGZ5WTdSd3FuWGcvTlgxc2tDTjVCYmJVeVZtWVV2NjE3?= =?utf-8?B?ZUZNMWZDK2JOTzQ4MHVPN0QxUnM0TTEwYUpIaW5taDVSamdUblZMMDFRWk8z?= =?utf-8?B?YXY1YjJSb25Makt6by9BQWE1YTU2RzA5WDIxVW13SWU2Yy9HSTdZSnBacm1F?= =?utf-8?B?eTBidTErenBudDcyMEQwcC9HYmlMUFlFc200UWo5Umo2bTRsM1V4YXBTNFFz?= =?utf-8?B?SExZc3EzdytFV21PM2RGS3FoTTNuS2lsZ21FcjJVVzVZVFQwTXMvQnlSb0RD?= =?utf-8?B?U1crbW13SktpeS9WMDhGcjNYWE1pbHJKNTFKeitPMzhncXJEa3BGNStwYlk2?= =?utf-8?B?WEovTUdWcTJDUnp5clZUSnZtZGZRMmY5aTZCUGpwUGw4cjdwODZPSnJybmRl?= =?utf-8?B?NTJvSGpBdWdCWnFyeFF4WjJiYWxyV2VSY2c0dmJGeVdUNFJ4bUwwNmt6NDZh?= =?utf-8?B?WWQvVjU4R1hVN0EyS2ZubGFYMktyaUtpOWptcThvcnNuR092UjRLMWFhN0dj?= =?utf-8?B?V1dwaElGZklsSUpHaGxBcmsrOXB1Q2hFamQ3Rk91VDNWQXBLL3BiazhPZHNH?= =?utf-8?B?UGl1dmlPbkR2SXcyb2txTGdjamdNREd4Y2JFdDNkVkF2enJnaEhRMDR2WGFJ?= =?utf-8?B?d1d6Mkx1K0kvVSt6UjZEVlBUOGF4UlZUazhhazZDNVFjamYvd3ZTRGtYWTdE?= =?utf-8?B?TENHUnlaOXhUK3hNSEM0RFRoRUN6SEhhZ3NpVnJqemxXUXUvdFQwNWdlaFUw?= =?utf-8?B?N2I5YkF3Q2gvcEdRczdoTWZ5TW13b2l2UXVIbC9XSmFTb1VPSTI4VHJVb1J1?= =?utf-8?B?VWVrZk01dTBLMXBTZXkzYnZMSVQzc0QrLzVlWUZETTFRVVhGYWNjTitwVzNy?= =?utf-8?B?S1QyRDV1WWQ5U09aSTRyTHZQZ3hEcGtPWWk2ZU1mSDN2Y1NZY0dlWCtGZkhG?= =?utf-8?B?bWVBajd6VmUyYVBYWkVyRHFRL3FpZm94STNBUzhHYTUwdk1TRFNvdXRZd3BJ?= =?utf-8?B?dnRCQng3SFNjS2IzREwyTk5qZUV5UE92cmlPOERMR3czOXVZK2ZZcGRReFhZ?= =?utf-8?B?WjRyR2ZlNHpnMjZrQ3p6L1lNcFJzc1U3b3RXSTRJb1hhb1pPdWs0aG9HZHAw?= =?utf-8?B?TytZUFVuVDd2OThsaVRhVnFPSVlHeGlVSTRGSU13L2MvekxveW90YWFaTTM1?= =?utf-8?B?ejNNd09NYnRNTnk3Z2RuN3REMG1oZjVLTTRaVDUyQjZzdmVyT1RIZ2s5cUZa?= =?utf-8?B?S1VEU2RRK1pXNUs5YWp2V01PT0dBTzgxL0NyUnBvcE1HWWhpZ0M0c28zYjQr?= =?utf-8?B?VFVuMzhYN0dIUXJ5MzBaRUtzNExYL3FkU0d6WTRud1FabjZnR2R2cG5zUlN4?= =?utf-8?B?dFlpRkw3Rk9zVlE5b3NmN1lXYXA4dEJhTk1USnRZalBNMXBFV0lJL1VSck1V?= =?utf-8?B?YXo0aVVOTXU0N3ArRmZ1TkVsM0c2cnBSYWRHRStPTWN0RmM0QXVyWm9aaTdQ?= =?utf-8?B?QkNneVU3SFRRT0hLMjFvUnRNcnNDcGZ4SFBNR0pjZ0h5SVp1ait3N3FRTERx?= =?utf-8?Q?1KxRfT0=3D?= MIME-Version: 1.0 --00672e0117042e2003a9e03642878ca80e93 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Hello pervert, I've sent this message from your Microsoft account. I want to inform you about a very bad situation for you. However, you can= benefit from it, if you will act wis=D0=B5ly. Have you heard of Pegasus? This is a spyware program that installs on com= puters and smartphones and allows hackers to monitor the activity of devi= ce owners. It provides access to your webcam, messengers, emails, call re= cords, etc. It works well on Android, iOS, macOS=C2=A0and Windows. I gues= s, you already figured out where I=E2=80=99m getting at. It=E2=80=99s been a few months since I installed it on all your=C2=A0d=D0= =B5vi=D1=81=D0=B5s=C2=A0because you were not quite choosy about what link= s to click on the int=D0=B5rn=D0=B5t. During this period, I=E2=80=99ve le= arned about all aspects of your private life, but=C2=A0=D0=BEn=D0=B5 is o= f special significance to me. I=E2=80=99ve recorded many videos of you jerking off to highly controvers= ial=C2=A0=D1=80=D0=BErn videos. Given that the =E2=80=9Cquestionable=E2=80= =9D genre is almost always the same, I can conclude that you have sick =D1= =80=D0=B5rv=D0=B5rsi=D0=BEn. I doubt you=E2=80=99d want your friends, family and co-workers to know ab= out it. However, I can do it in a few clicks. Every number in your contact Iist=C2=A0will suddenly receive these vid=D0= =B5=D0=BEs =E2=80=93 on WhatsApp, on Telegram, on Instagram, on Facebook,= on email =E2=80=93 everywhere. It is going to be a tsunami that will swe= ep away everything in its path, and first of all, your f=D0=BErm=D0=B5r l= ife. Don=E2=80=99t think of yourself as an innocent victim. No one knows where= your =D1=80=D0=B5rv=D0=B5rsi=D0=BEn might lead in the future, so conside= r this a kind of deserved =D1=80unishm=D0=B5nt to stop you. I=E2=80=99m some kind of God who sees everything. However, don=E2=80=99t = panic.=C2=A0As we know, God is merciful and forgiving,=C2=A0=C2=A0and so = do I. But my=C2=A0m=D0=B5r=D1=81y=C2=A0is not free. Transfer 1250$=C2=A0to my Litecoin (LTC) wallet: ltc1qnacms4gkmjnshge3kz9= qgpr46qswxlhgpz9alx Once I receive confirmation of the transaction, I will=C2=A0=D1=80=D0=B5r= manently=C2=A0delete all videos compromising you, uninst=D0=B0ll Pegasus = from all of your devices, and disappear from your life. You can be sure =E2= =80=93 my benefit is only money. Otherwise, I wouldn=E2=80=99t be writing= to you, but destroy your life without a word in a second. I=E2=80=99ll be notified when you open my email, and from that moment you= have exactly 48 hours to send the money. If cryptocurrencies are unchart= ered waters for you, don=E2=80=99t worry, it=E2=80=99s very simple. Just = google =E2=80=9Ccrypto exchange=E2=80=9D or "buy Litecoin" and then it wi= ll be no harder than buying some useless stuff on Amazon. I strongly warn you against the following: * Do not reply to this email. I've sent it from your Microsoft account. * Do not contact the police. I have access to all your d=D0=B5vi=D1=81=D0= =B5s, and as soon as I find out you ran to the cops, videos will be publi= shed. * Don=E2=80=99t try to reset or destroy your d=D0=B5vi=D1=81=D0=B5s. As I= mentioned above: I=E2=80=99m monitoring all your activity, so you either= agree to my terms or the vid=D0=B5=D0=BEs are =D1=80ublished. Also, don=E2=80=99t forget that cryptocurrencies are anonymous, so it=E2=80= =99s impossible to identify me using the provided =D0=B0ddr=D0=B5ss. Good luck, my perverted friend. I hope this is the last time we hear from= each other. And some friendly advice: from now on, don=E2=80=99t be so careless about= your online security. --00672e0117042e2003a9e03642878ca80e93 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable <html><head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dutf-8"> </head> <body bgcolor=3D"#ffffff"> <div> <div> <div><font face=3D"Calibri">Hello pervert, I've sent this message from your= Microsoft account.</font></div></div></div> <div><font face=3D"Calibri"></font> </div> <div><font face=3D"Calibri">I want to inform you about a very bad situation= for you. However, you can benefit from it, if you will act wis=D0=B5ly.</f= ont></div> <div><font face=3D"Calibri"></font> </div> <div><font face=3D"Calibri">Have you heard of Pegasus? This is a spyware pr= ogram that installs on computers and smartphones and allows hackers to moni= tor the activity of device owners. It provides access to your webcam, messe= ngers, emails, call records, etc. It works well on Android, iOS, macOS = ;and Windows. I guess, you already figured out where I=E2=80=99m getting at= .</font></div> <div><font face=3D"Calibri"></font> </div> <div><font face=3D"Calibri">It=E2=80=99s been a few months since I installe= d it on all your d=D0=B5vi=D1=81=D0=B5s because you were not quit= e choosy about what links to click on the int=D0=B5rn=D0=B5t. During this p= eriod, I=E2=80=99ve learned about all aspects of your private life, but&nbs= p;=D0=BEn=D0=B5 is of special significance to me.</font></div> <div><font face=3D"Calibri"></font> </div> <div><font face=3D"Calibri">I=E2=80=99ve recorded many videos of you jerkin= g off to highly controversial =D1=80=D0=BErn videos. Given that the = =E2=80=9Cquestionable=E2=80=9D genre is almost always the same, I can concl= ude that you have sick =D1=80=D0=B5rv=D0=B5rsi=D0=BEn.</font></div> <div><br><font face=3D"Calibri">I doubt you=E2=80=99d want your friends, fa= mily and co-workers to know about it. However, I can do it in a few clicks.= </font></div> <div><font face=3D"Calibri"></font> </div> <div><font face=3D"Calibri">Every number in your contact Iist will sud= denly receive these vid=D0=B5=D0=BEs =E2=80=93 on WhatsApp, on Telegram, on= Instagram, on Facebook, on email =E2=80=93 everywhere. It is going to be a= tsunami that will sweep away everything in its path, and first of all, you= r f=D0=BErm=D0=B5r life.</font></div> <div><br><font face=3D"Calibri">Don=E2=80=99t think of yourself as an innoc= ent victim. No one knows where your =D1=80=D0=B5rv=D0=B5rsi=D0=BEn might le= ad in the future, so consider this a kind of deserved =D1=80unishm=D0=B5nt = to stop you.</font></div> <div><font face=3D"Calibri"></font> </div> <div><font face=3D"Calibri">I=E2=80=99m some kind of God who sees everythin= g. However, don=E2=80=99t panic. As we know, God is merciful and forgi= ving, and so do I. But my m=D0=B5r=D1=81y is not free.= </font></div> <div><font face=3D"Calibri"></font> </div> <div><font face=3D"Calibri">Transfer<strong> 1250$</strong> to my Lite= coin (LTC) wallet:<strong> ltc1qnacms4gkmjnshge3kz9qgpr46qswxlhgpz9alx</str= ong></font></div> <div><font face=3D"Calibri"><strong></strong></font> </div> <div><font face=3D"Calibri">Once I receive confirmation of the transaction,= I will =D1=80=D0=B5rmanently delete all videos compromising you,= uninst=D0=B0ll Pegasus from all of your devices, and disappear from your l= ife. You can be sure =E2=80=93 my benefit is only money. Otherwise, I would= n=E2=80=99t be writing to you, but destroy your life without a word in a se= cond.</font></div> <div><font face=3D"Calibri"></font> </div> <div><font face=3D"Calibri">I=E2=80=99ll be notified when you open my email= , and from that moment you have exactly <strong>48 hours</strong> to send t= he money. If cryptocurrencies are unchartered waters for you, don=E2=80=99t= worry, it=E2=80=99s very simple. Just google =E2=80=9Ccrypto exchange=E2= =80=9D or "buy Litecoin" and then it will be no harder than buyin= g some useless stuff on Amazon.</font></div> <div><font face=3D"Calibri"></font> </div> <div><font face=3D"Calibri">I strongly warn you against the following:<br>*= Do not reply to this email. I've sent it from your Microsoft account.</fon= t></div> <div><font face=3D"Calibri">* Do not contact the police. I have access to a= ll your d=D0=B5vi=D1=81=D0=B5s, and as soon as I find out you ran to the co= ps, videos will be published.</font></div> <div><font face=3D"Calibri">* Don=E2=80=99t try to reset or destroy your d= =D0=B5vi=D1=81=D0=B5s. As I mentioned above: I=E2=80=99m monitoring all you= r activity, so you either agree to my terms or the vid=D0=B5=D0=BEs are =D1= =80ublished.</font></div> <div><font face=3D"Calibri"></font> </div> <div><font face=3D"Calibri">Also, don=E2=80=99t forget that cryptocurrencie= s are anonymous, so it=E2=80=99s impossible to identify me using the provid= ed =D0=B0ddr=D0=B5ss.</font></div> <div><font face=3D"Calibri"></font> </div> <div><font face=3D"Calibri">Good luck, my perverted friend. I hope this is = the last time we hear from each other.</font></div> <div><font face=3D"Calibri">And some friendly advice: from now on, don=E2= =80=99t be so careless about your online security.</font></div></body></htm= l> --00672e0117042e2003a9e03642878ca80e93--