This video, we're taking a look at a real scam.
This involves Bitcoin in sextortion.
So I'm going to make this video because these these kind of emails have been making the rounds quite
a bit lately.
And this is actually one that hit a user at one at the place I am working at right now.
So I took in some of the critical information, like the actual email address and that.
But let's take a look at this email.
So when this email.
The two address was spoofed.
So it's actually spoofing one of the email addresses that that user actually had.
So if you continue on this email, it says, Hello, my name is Talk.
My nickname in Darknet is Zachary 31.
That tends to change.
Even if it's the same person running this scam, they tend to change whatever their supposed dark name
is or Darknet name is.
I checked your mailbox more than six months ago.
Through it, I infected your operating system with a virus Trojan created by me and have been monitoring
you for a long time.
So your password is or password from and then they give the user email address is, then they give the
supposed password for that particular email.
Now, the way that works is typically the person will go grab my information from a data dump.
So I could buy a data dump for around ten, $20 or so, grab a bunch of usernames and passwords.
And that's what these people are typically doing or searching, Aaron, and finding a data dump that
was published for free.
Now in here, they'll pick up to look for people with email addresses and passwords saying at least
these may still be valid or they may be changed.
They really don't know and generally don't care because once they send these emails out, when a person
generally sees, Oh, this is my email and this is really the password that's associated to it, they
begin to panic whether they actually did anything wrong or not.
And that's how these scams work.
Now, let's continue with the email.
Even if you change your password after that, it doesn't matter.
My virus intercepted all of your caching data from your computer and automatically saved access for
me.
I have access to all your accounts, social networks, email browsing, history.
Accordingly, I have the data of all your contact files from your computers, photos, videos.
I was most struck by the intimate content sites that you occasionally visit.
You have a very weird or very wild imagination, I tell you.
During your pastime entertainment here, I took screenshots through your camera of your device, synchronizing
with what you're watching.
Oh, my God.
You're so funny and excited.
I think you don't want one of all your contacts.
Get these files right.
If you are of the same opinion, then I think that $837 is quite fair price to destroy the dirt I created.
So there is extortion part and generally for people, whether they actually did anything wrong or not,
they generally worry that, hey, my, so my critical data is out there that he's going to dump or maybe
he's just going to dump a bunch of bogus information.
I have been going all these crazy sites when I haven't been to my contacts.
So this plays on fear for people.
Send the above amount my bitcoin wallet.
And he gives the Bitcoin address, which I'm going to copy right now and I'm going to show you why in
a moment.
As soon as the above amount is received, I guarantee the data will be deleted.
I do not need it otherwise.
His files in history of his insights will will get all your contacts from your devices.
I'll send everyone your contact.
Access to your email, access logs and.
Carefully saved it.
Since reading this letter, you have 48 hours after reading this message, I'll receive an automatic
notification that you have seen the letter.
And it goes on to.
Essentially saying that.
That they feel like they're doing you a service.
So let's break this down a little bit.
Supposedly someone has her email and password.
So in general, again, that that usually freaks people out because let's be honest, people usually
have.
Really bad passwords and they have a bad habit of recycling passwords.
That's why you shouldn't recycle passwords of all possible.
The legitimacy of this is a lot of people say, yeah, that is my email, that's my password, or that
used to be my password, as you know.
So they contextualize it by saying, even if you change your password, I still have access.
So that that also freaks people out.
But again, this generally comes from data dumps.
So you do want to keep that in mind that in that regard it's kind of worthless.
But they are trying to scam you.
They are trying to get money from you.
And if you're doing Osten, then this gets a little tricky.
So Bitcoin are designed to be anonymous, so it is kind of hard to track them.
What you can do is there are certain tricks where if you send.
A certain amount of Bitcoin to someone, you can kind of trace where it's going.
I don't recommend actually spending money or giving any amount of money to anyone that's trying to scam
you or extort you.
But in order to help alleviate some fear from people, if you're doing a U.S. investigation for someone,
again, they don't have to do anything wrong.
People that don't do anything wrong still might freak out because they you know, they're still worried
that this person is on my account.
They have my, you know, critical information that they have email that's confidential and they're
going to send it out to everyone.
Or they might spread a bunch of lies about me and embarrass me, especially people in higher positions
as CEOs, managers and whatnot.
It's kind of hard for them to have their reputation tarnished, whether it's real or not.
So a lot of people feel compelled to actually pay these ransoms.
So what you could do is there's a couple of things you could do.
One is you could trade, you could do a Bitcoin lookup.
And if you go to Bitcoin, who's who?
Dot com, you could enter in the bitcoin wallet to kind of see a little bit of the transaction history
of it.
Now the other thing you could do is you can go to De Hashed and have I been phoned and put that email
address in that that they said they got ahold of.
And you also can go to phone passwords.
I generally like to use all these sites.
You put the email address, you put the password in.
That way, you could say, hey, your email has been part of, you know, a data breach breaches dates
back at this time which kind of matches this information here.
Your password is also came up in a data breach.
It's been part of these breaches.
So this is where this is coming from, you know, so this is how they got your information.
It's not they actually hacked your account.
This is your actual information.
At that point, you tell the user, you change your password.
If you don't change it already, if you're using Gmail or there's similar services, make sure you sign
out of all the accounts, review the security check, make sure that no one's been logging your account.
Chances are no, they haven't logged in your account.
But it's always good to run that that check.
Now let's go back to the Bitcoin address.
Look up.
So I'm going to pieces in here and we have there a bitcoin.
I'm just going to click a little magnifying glass and start to search.
Can we give this sick?
And here we go.
Okay, so this is pretty cool.
So we can actually see quite a bit of history on this.
So we can see this Bitcoin address appeared on four websites.
I can click to see what websites they've been on.
There's the wallet name.
The current balance is almost one bitcoin and.
Well, you can see there's eight transactions, which when I look this up yesterday, you only had two.
So apparently you got a few more people now.
You can look at the first transaction.
If we click on Scam Alert, we could see all these people that reported this a scam.
And again, this is this can add legitimacy to your report when you're reporting back to someone, say,
hey, this is a scam, don't pay it.
Here's a bunch of scam alerts for that particular email.
And you can see all these are sextortion, hack, blackmail and whatnot.
And if I click on any of these things here.
You can see it's a similar format.
My nickname is Darknet and the name is Changed Kelby 27.
I hacked or your mailbox six months ago.
Infect your operating system with a Trojan password is playing point blank.
So essentially it's the same email address again.
And the other thing I like about running the Bitcoin wallet through here is some of these other ones
here.
They people did get additional information, including the IP address.
And again, you can take that IP address.
You can run it through IP tracer.
And if you do that, you'll find out this person's from South America, which kind of.
Lends credibility to why the English is a little broken.
Is not a Native American.
United States individual.
So.
That's all a great information.
And again, it's this will really go a long way for you when you put it in a report that saying that,
hey, don't pay this.
You can see all these people report all these different scams.
And if I click on here, I can see the different websites and it's come up on scam survivors dot com.
This Twitter post is talking about it.
Another Twitter post talking about we can take a look at the transaction history.
So we could say we can see this Bitcoin wallet paid that address and how much they they got and on the
time and date.
So that's that's additional interesting information just to have.
Again, it's going to be pretty hard to trace back to the actual individual, but it is interesting
to take a look at what the pattern of this is.
And also, you can run this through maltego if you want to verify this information, which I did yesterday
when it had two transactions.
Transactions also appear to maltego same amount, same wallets and whatnot.
So again, if you really need to prove that to your client, that, hey, this is a scam, this is all
the odd things going on with it.
The way you can kind of verify the information is dearest.
Have I been pwned pone passwords bitcoin address lookup which is bitcoin whose hukum and then run a
maltego scan.
So this is all about bitcoin scams and sextortion scams.
Thank you for watching the video.