Subject: Careful, it's important

From: <[email-masked]>
Date: Sun, 1 Oct 2023 08:13:28 -0700 (PDT)

Spam detection software, running on the system "mx1.eskimo.com",
has identified this incoming email as possible spam.  The original
message has been attached to this so you can view it or label
similar future email.  If you have any questions, see
[email-masked] for details.

Content preview:  Hi. I have very bad news for you. Unfortunately, your private
   data was compromised. Your password was compromised through a legitimate
  website, and that led to events that I will explain to you now. Using your
   password, our team gained access to your email. We analyzed all data and
  a [...] 

Content analysis details:   (32.4 points, 5.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
 0.0 SPF_FAIL               SPF: sender does not match SPF record (fail)
 1.1 DCC_CHECK              Detected as bulk mail by DCC (dcc-servers.net)
 1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
            [Blocked - see <https://www.spamcop.net/bl.shtml?186.148.159.234>]
 0.8 GB_HASHBL_BTC          Message contains BTC address found on BTCBL
                            [1j7rycyp8d7zyoaar4hqdxujaru6d9tdbf]
 1.3 RCVD_IN_VALIDITY_RPBL  RBL: Relay in Validity RPBL,
                            https://senderscore.org/blocklistlookup/
                          [186.148.159.234 listed in bl.score.senderscore.com]
 2.7 RCVD_IN_PSBL           RBL: Received via a relay in PSBL
                            [186.148.159.234 listed in psbl.surriel.com]
 0.0 RCVD_IN_MSPIKE_BL      Mailspike blocklisted
 2.7 RCVD_IN_MSPIKE_ZBI     No description available.
 3.5 BAYES_99               BODY: Bayes spam probability is 99 to 100%
                            [score: 1.0000]
 0.2 BAYES_999              BODY: Bayes spam probability is 99.9 to 100%
                            [score: 1.0000]
 1.0 BOTNET_CLIENT          Relay has a client-like hostname
[botnet_client,ip=186.148.159.234,rdns=234.clix.static.eternet.cc,clientwords]
 1.0 BOTNET_CLIENTWORDS     Hostname contains client-like substrings
       [botnet_clientwords,ip=186.148.159.234,rdns=234.clix.static.eternet.cc]
 0.0 HTML_MESSAGE           BODY: HTML included in message
 2.0 BITCOIN_VISTA          Bitcoin + old MSFT msgid format
 0.8 BITCOIN_SPAM_07        BitCoin spam pattern 07
 1.0 FSL_BULK_SIG           Bulk signature with no Unsubscribe
 0.0 PDS_BTC_MSGID          Bitcoin ID with T_MSGID_NOFQDN2
 0.2 PDS_BTC_ID             FP reduced Bitcoin ID
 1.3 STATIC_XPRIO_OLE       Static RDNS + X-Priority + MIMEOLE
 2.5 DOS_OE_TO_MX           Delivered direct to MX with OE headers
 2.5 BITCOIN_XPRIO          Bitcoin + priority
 1.3 BITCOIN_TOEQFM         Bitcoin + To same as From
 1.0 TO_EQ_FM_DIRECT_MX     To == From and direct-to-MX
 0.0 MIMEOLE_DIRECT_TO_MX   MIMEOLE + direct-to-MX
 0.0 TO_EQ_FM_SPF_FAIL      To == From and external SPF failed
 0.0 TO_EQ_FM_DOM_SPF_FAIL  To domain == From domain and external SPF
                            failed
 1.0 XPRIO                  Has X-Priority header
 3.0 BITCOIN_EXTORT_01      Extortion spam, pay via BitCoin

The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam.  If you wish to view
it, it may be safer to save it to a file and open it with an editor.

Subject: Careful, it's important
From: <[email-masked]>
To: <[email-masked]>
Date: Sun, 1 Oct 2023 08:13:28 -0700 (PDT)

Hi.
I have very bad news for you. Unfortunately, your private data was compromised.

Your password was compromised through a legitimate website, and that led to events that I will explain to you now.
Using your password, our team gained access to your email. We analyzed all data and after going through found a vector for an attack.
That attack was a success. The result was that your machine was infected with a virus/backdoor. Our team uses individual approach to every victim, our success rate is very high.

We have gained access to the data, but the most interesting part that we are able to control your webcam and microphone. 

And you are correct. We have a nice archive with exploding video content.
It's all good, but we are here to make money. So if you don't want those videos to be leaked, please follow the instructions.

You pay $750 USD, and there will be nothing to worry about. No chats, no photos, nothing. Every single file will be deleted and virus removed from your machine

Use Bitcoin to make the transfer. Wallet address is 1J7RYCYp8D7zYoAAR4HQDXujaRU6D9tDbf , it's unique and we will know that you made the payment immediately.
You have 2 days to make the transfer, that's reasonable.
Take care.