| Current Path : /proc/thread-self/root/home/ift/mails/40/ |
Linux ift1.ift-informatik.de 5.4.0-216-generic #236-Ubuntu SMP Fri Apr 11 19:53:21 UTC 2025 x86_64 |
| Current File : //proc/thread-self/root/home/ift/mails/40/1545797416.zrspam.401129_2018_12_26 |
From Aaron481Smith@yahoo.jp Wed Dec 26 05:10:16 2018
Return-Path: <Aaron481Smith@yahoo.jp>
X-Original-To: tjungblut@ift-informatik.de
Delivered-To: tjungblut@ift-informatik.de
Received: by ift-informatik.de (Postfix, from userid 5555)
id C31BF3D200073; Wed, 26 Dec 2018 05:10:16 +0100 (CET)
Received: from localhost by h2486555.stratoserver.net
with SpamAssassin (version 3.4.0);
Wed, 26 Dec 2018 05:10:16 +0100
From: tobias.jungblut@ift-informatik.de
To: <tobias.jungblut@ift-informatik.de>
Subject: *****SPAM***** tobias.jungblut
Date: Tue, 25 Dec 2018 22:31:53 -0500
Message-Id: <9f8a01d49ca1$a2815680$992c90d4@Aaron481Smith>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
h2486555.stratoserver.net
X-Spam-Flag: YES
X-Spam-Level: ******
X-Spam-Status: Yes, score=6.7 required=5.0 tests=BAYES_50,HTML_MESSAGE,
LOCALPART_IN_SUBJECT,PYZOR_CHECK,RCVD_IN_BRBL_LASTEXT,RCVD_IN_XBL,RDNS_NONE,
SPF_HELO_SOFTFAIL,TVD_RCVD_SPACE_BRACKET,UNPARSEABLE_RELAY autolearn=no
autolearn_force=no version=3.4.0
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_5C22FF28.E6B82515"
This is a multi-part message in MIME format.
------------=_5C22FF28.E6B82515
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Spam detection software, running on the system "h2486555.stratoserver.net",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hello, I am a spyware software developer. Your account has
been hacked by me in the summer of 2018. I understand that it is hard to
believe, but here is my evidence (I sent you this email from your account).
[...]
Content analysis details: (6.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.4 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
[110.172.170.66 listed in zen.spamhaus.org]
0.0 TVD_RCVD_SPACE_BRACKET No description available.
1.4 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[110.172.170.66 listed in bb.barracudacentral.org]
0.7 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)
1.1 LOCALPART_IN_SUBJECT Local part of To: address appears in Subject
0.0 HTML_MESSAGE BODY: HTML included in message
0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60%
[score: 0.5000]
1.4 PYZOR_CHECK Listed in Pyzor (http://pyzor.sf.net/)
0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines
0.8 RDNS_NONE Delivered to internal network by a host with no rDNS
The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam. If you wish to view
it, it may be safer to save it to a file and open it with an editor.
------------=_5C22FF28.E6B82515
Content-Type: message/rfc822; x-spam-type=original
Content-Description: original message before SpamAssassin
Content-Disposition: attachment
Content-Transfer-Encoding: 8bit
Received: from yahoo.jp (unknown [110.172.170.66])
by ift-informatik.de (Postfix) with SMTP id 8E67D3D200065
for <tobias.jungblut@ift-informatik.de>; Wed, 26 Dec 2018 05:10:10 +0100 (CET)
Received: from smtp4.cyberemailings.com ([102.212.221.11]) by mail.gimmicc.net with ASMTP; Tue, 25 Dec 2018 23:09:18 -0500
Received: from nntp.pinxodet.net ([Tue, 25 Dec 2018 22:53:57 -0500])
by smtp18.yenddx.com with ASMTP; Tue, 25 Dec 2018 22:53:57 -0500
Received: from smtp.endend.nl ([Tue, 25 Dec 2018 22:51:28 -0500])
by mailout.endmonthnow.com with ESMTP; Tue, 25 Dec 2018 22:51:28 -0500
Received: from external.newsubdomain.com ([166.241.134.44]) by smtp.mixedthings.net with SMTP; Tue, 25 Dec 2018 22:31:53 -0500
Message-ID: <9f8a01d49ca1$a2815680$992c90d4@Aaron481Smith>
From: tobias.jungblut@ift-informatik.de
To: <tobias.jungblut@ift-informatik.de>
Subject: tobias.jungblut
Date: Tue, 25 Dec 2018 22:31:53 -0500
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0006_01D49CA1.202D89B0"
X-MSMail-Priority: Normal
X-Mailer: Microsoft Windows Live Mail 14.0.8117.416
X-MimeOLE: Produced By Microsoft MimeOLE V14.0.8117.416
This is a multi-part message in MIME format.
------=_NextPart_000_0006_01D49CA1.202D89B0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Hello,
I am a spyware software developer. Your account has been hacked by me in =
the summer of 2018.
I understand that it is hard to believe, but here is my evidence (I sent =
you this email from your account).
The hacking was carried out using a hardware vulnerability through which =
you went online (Cisco router, vulnerability CVE-2018-0296).
I went around the security system in the router, installed an exploit the=
re. When you went online, my exploit downloaded my malicious code (rootki=
t) to your device. This is driver software, I constantly updated it, so y=
our antivirus is silent all time.
Since then I have been following you (I can connect to your device via th=
e VNC protocol). That is, I can see absolutely everything that you do, vi=
ew and download your files and any data to yourself. I also have access t=
o the camera on your device, and I periodically take photos and videos wi=
th you.
At the moment, I have harvested a solid dirt... on you... I saved all you=
r email and chats from your messangers. I also saved the entire history o=
f the sites you visit.
I note that it is useless to change the passwords. My malware update pass=
words from your accounts every times.
I know what you like hard funs (adult sites). Oh, yes .. I'm know your se=
cret life, which you are hiding from everyone. Oh my God, what are your l=
ike... I saw THIS ... Oh, you dirty naughty person ... :)
I took photos and videos of your most passionate funs with adult content,=
and synchronized them in real time with the image of your camera. Believ=
e it turned out very high quality!
So, to the business! I'm sure you don't want to show these files and visi=
ting history to all your contacts.
Transfer $996 to my Bitcoin cryptocurrency wallet: 1GUBJLcDp19DHhRbH1up8d=
WwPAeWJfENCz
My system automatically recognizes the translation. As soon as the specif=
ied amount is received, all your data will be destroyed from my server, a=
nd the rootkit will be automatically removed from your system. Do not wor=
ry, I really will delete everything, since I am 'working' with many peopl=
e who have fallen into your position. You will only have to inform your p=
rovider about the vulnerabilities in the router so that other hackers wil=
l not use it.
Since opening this letter you have 48 hours. If funds not will be receive=
d, after the specified time has elapsed, the disk of your device will be =
formatted, and from my server will automatically send email and sms to al=
l your contacts with compromising material.
I advise you to remain prudent and not engage in nonsense (all files on m=
y server).
Good luck!
------=_NextPart_000_0006_01D49CA1.202D89B0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: base64
PCFET0NUWVBFIEhUTUwgUFVCTElDICItLy9XM0MvL0RURCBIVE1MIDQuMCBUcmFuc2l0aW9uYWwv
L0VOIj4NCjxIVE1MPjxIRUFEPg0KPE1FVEEgaHR0cC1lcXVpdj1Db250ZW50LVR5cGUgY29udGVu
dD0idGV4dC9odG1sOyBjaGFyc2V0PWlzby04ODU5LTEiPg0KPE1FVEEgY29udGVudD0iTVNIVE1M
IDguMDAuNzYwMC4xNjYyNSIgbmFtZT1HRU5FUkFUT1I+DQo8U1RZTEU+PC9TVFlMRT4NCjwvSEVB
RD4NCjxCT0RZIGJnQ29sb3I9I2ZmZmZmZj48Rk9OVCBmYWNlPUFyaWFsIHNpemU9Mj4NCjxESVY+
DQoNCkhlbGxvLA0KPGJyPjxicj4NCkkgYW0gYSBzcHl3YXJlIHNvZnR3YXJlIGRldmVsb3Blci4g
WW91ciBhY2NvdW50IGhhcyBiZWVuIGhhY2tlZCBieSBtZSBpbiB0aGUgc3VtbWVyIG9mIDIwMTgu
DQo8YnI+PGJyPg0KSSB1bmRlcnN0YW5kIHRoYXQgaXQgaXMgaGFyZCB0byBiZWxpZXZlLCBidXQg
aGVyZSBpcyBteSBldmlkZW5jZSAoSSBzZW50IHlvdSB0aGlzIGVtYWlsIGZyb20geW91ciBhY2Nv
dW50KS4NCjxicj48YnI+DQpUaGUgaGFja2luZyB3YXMgY2FycmllZCBvdXQgdXNpbmcgYSBoYXJk
d2FyZSB2dWxuZXJhYmlsaXR5IHRocm91Z2ggd2hpY2ggeW91IHdlbnQgb25saW5lIChDaXNjbyBy
b3V0ZXIsIHZ1bG5lcmFiaWxpdHkgQ1ZFLTIwMTgtMDI5NikuDQo8YnI+PGJyPg0KSSB3ZW50IGFy
b3VuZCB0aGUgc2VjdXJpdHkgc3lzdGVtIGluIHRoZSByb3V0ZXIsIGluc3RhbGxlZCBhbiBleHBs
b2l0IHRoZXJlLiBXaGVuIHlvdSB3ZW50IG9ubGluZSwgbXkgZXhwbG9pdCBkb3dubG9hZGVkIG15
IG1hbGljaW91cyBjb2RlIChyb290a2l0KSB0byB5b3VyIGRldmljZS4gVGhpcyBpcyBkcml2ZXIg
c29mdHdhcmUsIEkgY29uc3RhbnRseSB1cGRhdGVkIGl0LCBzbyB5b3VyIGFudGl2aXJ1cyBpcyBz
aWxlbnQgYWxsIHRpbWUuDQo8YnI+PGJyPg0KU2luY2UgdGhlbiBJIGhhdmUgYmVlbiBmb2xsb3dp
bmcgeW91IChJIGNhbiBjb25uZWN0IHRvIHlvdXIgZGV2aWNlIHZpYSB0aGUgVk5DIHByb3RvY29s
KS4gVGhhdCBpcywgSSBjYW4gc2VlIGFic29sdXRlbHkgZXZlcnl0aGluZyB0aGF0IHlvdSBkbywg
dmlldyBhbmQgZG93bmxvYWQgeW91ciBmaWxlcyBhbmQgYW55IGRhdGEgdG8geW91cnNlbGYuIEkg
YWxzbyBoYXZlIGFjY2VzcyB0byB0aGUgY2FtZXJhIG9uIHlvdXIgZGV2aWNlLCBhbmQgSSBwZXJp
b2RpY2FsbHkgdGFrZSBwaG90b3MgYW5kIHZpZGVvcyB3aXRoIHlvdS4NCjxicj48YnI+DQpBdCB0
aGUgbW9tZW50LCBJIGhhdmUgaGFydmVzdGVkIGEgc29saWQgZGlydC4uLiBvbiB5b3UuLi4gSSBz
YXZlZCBhbGwgeW91ciBlbWFpbCBhbmQgY2hhdHMgZnJvbSB5b3VyIG1lc3NhbmdlcnMuIEkgYWxz
byBzYXZlZCB0aGUgZW50aXJlIGhpc3Rvcnkgb2YgdGhlIHNpdGVzIHlvdSB2aXNpdC4NCjxicj48
YnI+DQpJIG5vdGUgdGhhdCBpdCBpcyB1c2VsZXNzIHRvIGNoYW5nZSB0aGUgcGFzc3dvcmRzLiBN
eSBtYWx3YXJlIHVwZGF0ZSBwYXNzd29yZHMgZnJvbSB5b3VyIGFjY291bnRzIGV2ZXJ5IHRpbWVz
Lg0KPGJyPjxicj4NCkkga25vdyB3aGF0IHlvdSBsaWtlIGhhcmQgZnVucyAoYWR1bHQgc2l0ZXMp
LiBPaCwgeWVzIC4uIEknbSBrbm93IHlvdXIgc2VjcmV0IGxpZmUsIHdoaWNoIHlvdSBhcmUgaGlk
aW5nIGZyb20gZXZlcnlvbmUuIE9oIG15IEdvZCwgd2hhdCBhcmUgeW91ciBsaWtlLi4uIEkgc2F3
IFRISVMgLi4uIE9oLCB5b3UgZGlydHkgbmF1Z2h0eSBwZXJzb24gLi4uIDopDQo8YnI+PGJyPg0K
SSB0b29rIHBob3RvcyBhbmQgdmlkZW9zIG9mIHlvdXIgbW9zdCBwYXNzaW9uYXRlIGZ1bnMgd2l0
aCBhZHVsdCBjb250ZW50LCBhbmQgc3luY2hyb25pemVkIHRoZW0gaW4gcmVhbCB0aW1lIHdpdGgg
dGhlIGltYWdlIG9mIHlvdXIgY2FtZXJhLiBCZWxpZXZlIGl0IHR1cm5lZCBvdXQgdmVyeSBoaWdo
IHF1YWxpdHkhDQo8YnI+PGJyPg0KU28sIHRvIHRoZSBidXNpbmVzcyEgSSdtIHN1cmUgeW91IGRv
bid0IHdhbnQgdG8gc2hvdyB0aGVzZSBmaWxlcyBhbmQgdmlzaXRpbmcgaGlzdG9yeSB0byBhbGwg
eW91ciBjb250YWN0cy4NCjxicj48YnI+DQpUcmFuc2ZlciAkOTk2IHRvIG15IEJpdGNvaW4gY3J5
cHRvY3VycmVuY3kgd2FsbGV0OiAxR1VCSkxjRHAxOURIaFJiSDF1cDhkV3dQQWVXSmZFTkN6DQo8
YnI+PGJyPg0KTXkgc3lzdGVtIGF1dG9tYXRpY2FsbHkgcmVjb2duaXplcyB0aGUgdHJhbnNsYXRp
b24uIEFzIHNvb24gYXMgdGhlIHNwZWNpZmllZCBhbW91bnQgaXMgcmVjZWl2ZWQsIGFsbCB5b3Vy
IGRhdGEgd2lsbCBiZSBkZXN0cm95ZWQgZnJvbSBteSBzZXJ2ZXIsIGFuZCB0aGUgcm9vdGtpdCB3
aWxsIGJlIGF1dG9tYXRpY2FsbHkgcmVtb3ZlZCBmcm9tIHlvdXIgc3lzdGVtLiBEbyBub3Qgd29y
cnksIEkgcmVhbGx5IHdpbGwgZGVsZXRlIGV2ZXJ5dGhpbmcsIHNpbmNlIEkgYW0gJ3dvcmtpbmcn
IHdpdGggbWFueSBwZW9wbGUgd2hvIGhhdmUgZmFsbGVuIGludG8geW91ciBwb3NpdGlvbi4gWW91
IHdpbGwgb25seSBoYXZlIHRvIGluZm9ybSB5b3VyIHByb3ZpZGVyIGFib3V0IHRoZSB2dWxuZXJh
YmlsaXRpZXMgaW4gdGhlIHJvdXRlciBzbyB0aGF0IG90aGVyIGhhY2tlcnMgd2lsbCBub3QgdXNl
IGl0Lg0KPGJyPjxicj4NClNpbmNlIG9wZW5pbmcgdGhpcyBsZXR0ZXIgeW91IGhhdmUgNDggaG91
cnMuIElmIGZ1bmRzIG5vdCB3aWxsIGJlIHJlY2VpdmVkLCBhZnRlciB0aGUgc3BlY2lmaWVkIHRp
bWUgaGFzIGVsYXBzZWQsIHRoZSBkaXNrIG9mIHlvdXIgZGV2aWNlIHdpbGwgYmUgZm9ybWF0dGVk
LCBhbmQgZnJvbSBteSBzZXJ2ZXIgd2lsbCBhdXRvbWF0aWNhbGx5IHNlbmQgZW1haWwgYW5kIHNt
cyB0byBhbGwgeW91ciBjb250YWN0cyB3aXRoIGNvbXByb21pc2luZyBtYXRlcmlhbC4NCjxicj48
YnI+DQpJIGFkdmlzZSB5b3UgdG8gcmVtYWluIHBydWRlbnQgYW5kIG5vdCBlbmdhZ2UgaW4gbm9u
c2Vuc2UgKGFsbCBmaWxlcyBvbiBteSBzZXJ2ZXIpLg0KPGJyPjxicj4NCkdvb2QgbHVjayENCg0K
DQo8L0RJVj48L0ZPTlQ+PC9CT0RZPjwvSFRNTD4=
------=_NextPart_000_0006_01D49CA1.202D89B0--
------------=_5C22FF28.E6B82515--