This is the story about an Italian scammer called "SharkWhite"

It started when my inbox started getting flooded with blackmail messages saying my webcam has been hacked.

The subject of each email is getting increasingly aggressive and also desperate.

This pissed me off to no end.

So I did a little research and managed to locate the exact whereabouts of this scammer. However, he is based in Italy and I have no way to report him to the correct authorities.

So, I am posting all my findings here on reddit.

After researching a little, I noticed a common username being used "SharkWhite" - Which lead me to this user - [sharkwhite00](https://www.blackhatworld.com/members/sharkwhite00.1225722/) - http://archive.is/EAmYH/image

The profile above shows that he is the owner and creator of many spamming bots. In particular a [Reddit account creator](https://www.blackhatworld.com/seo/shark-reddit-account-creator.1077908/) < You need to register to see this section of the forum.

If you look at the post he made here - https://www.blackhatworld.com/seo/shark-reddit-account-creator.1077908/ - You can see there is a link posted to his profile that links to - sharkbulkmail.com.

If you search google for "sharkbulkmail.com" you can see that this guy has made hundreds of bots for creating accounts and spamming those sites.

[Here](https://www.youtube.com/watch?v=GweZGStZ1v8) is one of his YouTube videos he made to promote a redtube.com spam bot. - http://archive.is/aUSkc/image

You can see the [youtube username](https://www.youtube.com/channel/UCakBWbJAlL2aKqtG3ksKOuQ) is a match. And also he posted his website in the video description. - http://archive.is/0Vs5f/image

Further google searching the SharkWhite username leads me to nulled.to - Which is a forum for criminals to talk about their scams, buy illegal software tools and engage in other nefarious shit.

Here is a [list of posts](https://www.nulled.to/index.php?app=core&module=search&do=user_activity&search_app=forums&mid=792675&search_app_filters%5Bforums%5D%5BsearchInKey%5D=&userMode=content) created by SharkWhite. You can see him talking about the best ways to steal peoples money using virus's and malware that he infects peoples computers with.

He is also a super moderator on this marketing forum - https://www.blackhatsem.com/Thread-SHARK-BULK-MAIL-BLACK-HAT-EDITION-PROMOTE-EVERY-LEGAL-AND-ILLEGAL-CONTENT-100-INBOX - http://archive.is/t7ZoF/image

In the link above, he is advertising his software that can send out millions of spam emails per day. He isnt even trying to hide his intentions, check out the title "SHARK BULK MAIL BLACK HAT EDITION PROMOTE EVERY LEGAL AND ILLEGAL CONTENT 100% INBOX"

You can also see from his user status that his member level is "SuperModerator" so I can only imagine the extent of his criminal connections from being one of the top members of a criminal underground website.

Here his is again selling the same software on hackforums.net - https://webcache.googleusercontent.com/search?q=cache:3AY6tsb7uQUJ:https://hackforums.net/showthread.php%3Ftid%3D5918126+&cd=76&hl=en&ct=clnk&gl=us - http://archive.is/R7cEC/image

Hackforums.net is another notorious criminal hangout.

Then I found him commenting on a forum that shares the leaked databases that have users emails and passwords - https://webcache.googleusercontent.com/search?q=cache:H-RMzVCEqbsJ:https://raidforums.com/Thread-Edmodo-Database-Leaked-Download%3Fpage%3D29+&cd=2&hl=en&ct=clnk&gl=us - http://archive.is/hrNZC/image

Take a moment to check out this article that explains a new type of blackmailing scam that is sent to users email address - https://nakedsecurity.sophos.com/2019/03/13/final-warning-email-have-they-really-hacked-your-webcam/

The passwords and emails are then taken from these databases, the password is added to the body of the email to make it seem more legitimate to the person being blackmailed.

"The crooks include one of your passwords. Often, it’s an old password, but usually it is (or was) genuinely yours. That’s scary, but don’t panic – these stolen passwords come from data breaches, where your data was lost by someone else. The crooks didn’t steal the password directly from you." - https://nakedsecurity.sophos.com/2019/03/13/final-warning-email-have-they-really-hacked-your-webcam/

And ask yourself this : Is a person known to be involved in criminal activities, who owns a website called sharkBULKMAIL.com, who is involved in ransomware and who also built and sold software that generates thousands of nu-traceable bitcoin wallets, likely to be also sending out bulk blackmailing emails?

I think the logical answer to this is 100% yes.

Ok, so we now have all the components required for a blackmail emailing campaign, all linked to 1 single username.

Now we just need to find this guys location.

The first thing I notice is a fiverr.com profile using his username - https://www.fiverr.com/sharkwhite - http://archive.is/WI3zn/image

This profile was created in 2014, long before he spiralled into his criminal activities. Now the thing with fiverr is that they do not allow users to remove their location from their profile. So we know that he's from Italy based on this early link to his location. Now all we need is some recent location data that corroborates this location.

I contacted a few people in the marketing community and presented them with the evidence I outlined above and they were able to get me some very incriminating evidence.

https://prnt.sc/nv8scs

In this screenshot, you can see the ip address SharkWhite00 used create his account and also to post a thread that advertised a facebook account creator.

82.56.77.85

87.15.155.61

If you do an IP location check on those IP's, you will see both are from Italy.

Check for yourself - https://www.iplocation.net/

You can take the longitude and latitude from thosse IP's and it will point you to this location - https://www.google.com/maps/place/45°41'27.2"N+9°23'57.1"E/@45.6909,9.3980869,18z/