Don’t pay it! No matter how convincing inclusion of that old password you used to use makes it seem, they don’t have video of you doing that. Don’t be embarrassed, if you considered paying the ransom email you’re not alone. So far 101 victims have sent 22.67 BTC to 37 of the 176 bitcoin addresses so far reported to be related to the new sextortion with/password scam email variation that first appeared July 10. Reports of previous versions of the same sextortion tactic without the password portion have been reaching us since October 2017. Inclusion of a password is unique over the last three weeks.

Follow the BTC

One of the interesting things about this scam is that virtually all bitcoin balances have NOT moved. Nothing has been touched since the victims sent payment. Unlike a lot of ransomware addresses which show immediate output transactions there has been no balance consolidation or effort to obfuscate (hint: set your email alerts for transaction notifications now!). In fact, 98.4% of the BTC sent to the 37 addresses remains untouched.

One of the few exceptions is 1LEBKnvLEZk2cUfyJ1vU5FpueakWyh4m28, which has one of only two ouput transactions associated with the new password sextortion version addresses. The output is to a Poloniex wallet address 1E2J2DAFGToqmTxK5H8fG6V3Tp3xqSiAm4.

Identification of Perpetrators

Conincidentally, in a previous blog post we demonstrated how a similarly worded sextortion scam was using a Poloniex wallet. Interestingly, scam reports under 1LEBKnvLEZk2cUfyJ1vU5FpueakWyh4m28 show both versions of the sextortion scam text (with and without password) suggesting the fraudsters used this same bitcoin address in both versions of the scam.

It doesn’t take Sherlock to conclude it likely the same scammers got their hands on some old dark web passwords and figured it was worth a shot to legitimize their email by including them.

Sextortion W/ Password Variation Scam Bitcoin Addresses

Inclusion on this list of sextortion bitcoin addresses requires some mention of a password in the scam report. Care was taken not to include bitcoin addresses from similar ongoing sextortion scam which used the same blackmail tactic but without the password included.

SCAM BITCOIN ADDRESS Current Balance Total Received # Tx Last Tx 1JHwenDp9A98XdjfYkHKyiE3R99Q72K9X4 3.021734 3.35036953 17 7/20/2018 16:45 1AoQB1GHm41XrrbZ6orcH4eKA5nummvGgr 2.77786125 2.77786125 9 7/25/2018 9:10 18gyZFAVhZ7pVBaFaTP5LDsoyGbuwFCSQa 1.50770564 1.50770564 4 7/16/2018 20:06 1QL7PkK8o38tKZHuHyqgd66rYDx8MHV5FT 1.1571992 1.1571992 4 7/16/2018 14:35 169rDGiiDxTKknBYgLPDq4sCQJjKgejkni 1.124592 1.124592 4 7/23/2018 20:08 1KBVnnJCPMDai81kMq2sUMFPKejAo7svE9 0.9866331 0.9866331 4 7/22/2018 12:14 1K8xBjjuXdE5Hdy3vEsEtKJx2RyEaYx3be 0.89982608 0.89982608 2 7/18/2018 17:31 1QAVaukg4es84us9XRTaPqztYB1XXoXEdA 0.767003 0.767003 3 7/20/2018 0:37 19224kBa2V1PyPntEhiJmkBgh6RGyGH3Vj 0.7573 0.7573 2 7/24/2018 12:51 1ycRDEbXCD1nXXoEz8pfQJjDbZSALvH29 0.6720842 0.6720842 5 7/24/2018 3:44 1Je5CbHkcdjnMfbna78y4FfomRHQX2xawU 0.66948426 0.66948426 3 7/16/2018 20:23 1N9M8prUzY1qKcn3SpxqDzLiK7PGEfVs6V 0.57901101 0.57901101 4 7/16/2018 9:03 1KjxgUYw2QC53ZiGeAG9uohcSSRUWsSsQA 0.56848647 0.56848647 2 7/17/2018 10:15 1MQNUSnquwPM9eQgs7KtjDcQZBfaW7iVge 0.54043954 0.54043954 2 7/12/2018 4:55 19aJnFC6UdNjiMRtP766hVsn7Wg4KXQHbZ 0.51831313 0.51831313 3 7/15/2018 10:15 17rtWVRWCFn9hCU9fv1ofk4P9nmH4ppyQx 0.5165 0.5165 2 7/19/2018 3:47 1G2y8hhzTPZ5BTSREL2J7WJqzrQjz89ESu 0.48642 0.48642 2 7/18/2018 23:43 15uP5UQ8i5L7Qyue1RX99HhkurYN89NXNZ 0.47930077 0.47930077 1 7/17/2018 3:35 19kQT8RpsNNAM5UQ6RjRxRcHbeHhYf6SES 0.47805442 0.47805442 4 7/18/2018 6:44 1PeMj6hcYMCu1eKUAjRq4t7N6EHwDbGyBR 0.4644 0.4644 1 7/12/2018 22:13 175MK9MUg14aXmZEmevDn5wTKRHozkwAW7 0.42614334 0.42614334 1 7/18/2018 2:04 1NwCCjuinczK47bWD1EW27juvwxDktZ4Th 0.39430662 0.39430662 2 7/17/2018 19:14 17drmHLZMsCRWz48RchWfrz9Chx1osLe67 0.3053 0.3053 1 7/12/2018 4:31 1Ga8DJwrYE33vEt14TH7mC2bV7QqYFDpAc 0.29547892 0.29547892 1 7/19/2018 14:43 1NLh41sRP8QfSkkBrps1wXQXQhyM86HQYh 0.29 0.29 1 7/17/2018 3:51 17evj6D2chJCzM5aopd2XBVDF2ykVn6mFG 0.28424486 0.28424486 4 7/22/2018 21:41 1BwbRw85ZuPWj8V7CfJRfRqev6B67QLNzN 0.28056615 0.28056615 1 7/19/2018 17:48 1DcVgcbYZGuba9SDCmGMW2w6URtue2G8hm 0.26021075 0.26021075 1 7/18/2018 3:27 1LdjLs5LTpSaLuAEQEfza9EUqQKAGEu5Xc 0.25814675 0.25814675 2 7/21/2018 8:24 1DA1PzX9q9Mwpjdde9iF6xGjUJ4JTYCsiP 0.24748938 0.24748938 2 7/23/2018 5:28 1MderAUaVEd63ZfQoBdBMV5BebRjhpZQNR 0.15 0.15 1 7/23/2018 12:28 1NM9rA5Vf77aa4T1u65GwBQEV3CALRdobd 0.12640296 0.12640296 1 7/24/2018 6:42 1LEBKnvLEZk2cUfyJ1vU5FpueakWyh4m28 0 0.03353922 2 3/12/2018 3:53 1BfineU1jtyoKC8s3yZcoHS3DwNDgQs7zX 0.019298 0.019298 2 7/24/2018 9:21 16Cq8aSzMvr9SigEE4Lmnp1dTURancp1YY 0.00014993 0.00014993 1 7/16/2018 15:18 1zqjuqozoWKE1DHcRr4t34Cv6uzUwEUsc 0.00001337 0.00001337 1 7/24/2018 16:17 1DDduNYswFXGpnZW1onqZQs62G5v4s5kHH 0.00001337 0.00001337 1 7/24/2018 16:17 15VH3EsLQCfzSDN2TB5WykU7qm3dwVrUVj 0 0 0 1AWKTr1vq3946tyuxG7Q1mLcJum4rjnmro 0 0 0 1PdRsvWnRwz7m8nViajQNjcAzgQgEiTBhx 0 0 0 126RbYy96H9BJZs8kCUAkx5exuiMsYSBbm 0 0 0 15gbv1DTTNg82qvb3cpZLLmfqXu1jJaWFE 0 0 0 19EdHu5QJX5mAQ3fbXnsQ6utCvXDLT4LNG 0 0 0 1A8Ad7VbWDqwmRY6nSHtFcTqfW2XioXNmj 0 0 0 129WARJw8X71na49fvhss4hRpt9TA6V7Jg 0 0 0 1DVFi6yawViqSsKHhiN81FgGxdNLLkdo7j 0 0 0 1YAy8oEjEXsxos5u7y5k7siJ4tSmA71sU 0 0 0 1EGG38yAtUPThMMU9Ni15mQ3rWHSk8L2u4 0 0 0 1HNxU93ZWcMJsyosNdpirrkL3mGCJLdUc3 0 0 0 1LoF9TCF8zcpWeeonp7C4427EWsXsUxKe5 0 0 0 1JsbfAMGSJnKqPHUt4ju373DWQfgpUJQzZ 0 0 0 1AgHpx8SbUwLqnzo8WtJYefJqMitM3PKb3 0 0 0 1PLrSKJmzww51A178UgGukF8bXood9ivaQ 0 0 0 1CBRokYPqGjnpjWTksvHtvfXn118jdLh8C 0 0 0 16FghVupomDqx2VSu8qrKJCxazivhhCGCp 0 0 0 1L4Vj2hJkrrwRhmfoTjmQ3xFWRP34J1iFr 0 0 0 1DULdsSARR1fH6D6DV7otavbmUQka3J9uP 0 0 0 1G4ptuhGf3A9wUWjYvR3yNs28pM9N3BgzW 0 0 0 1986EFPF7X9wwZtjAeUUZY3F4sEZLAcnFx 0 0 0 1L8etHzpS5Gew84zAYJQWqZhEFNtSii6oi 0 0 0 1BxuNr6AKrqAs6Eh8dfLAT6X2vqhgEFA6f 0 0 0 1BUg33EwpDQPjCybRNLdYLTBYinXjfN7tB 0 0 0 1CxnWaXtiYzbCgeTJBQ3sWM4vFjN9wymcH 0 0 0 1AwLWQnUnHeSh3J48sh39ahCqNS3RT9vBJ 0 0 0 1CKb72daKxcyknvzPaYUcQMfdY7AG3z2WT 0 0 0 1Jf3tU7vLY4qByLWPHL1nrDiL9c6jrzJpG 0 0 0 14XEXdPpswkDJc1rh6wHfrryoEgyDCsWy8 0 0 0 1EnYF3atXgBPWx9A62m3hfxfHbkX26iRJU 0 0 0 16PHxvUNQTwJZTMEePYvrFn4ybrXyHaMvM 0 0 0 1LZaf9DhUaGvroAK3jqD9vkYp6sRsp7HHL 0 0 0 1Ef5uN5DbEF2p7y6FPNfDbsE8PTjaT4pr9 0 0 0 1KZdtbjbcf5JCmVucXPwUTTJBuLuxw99G5 0 0 0 1LiReQSRqmqtaguWmkU4LcsEapKUSKGy4h 0 0 0 1LX2jR6nu8e7YKkcTwk4z1tHMunHRV5zyd 0 0 0 19QZjv44WssE69vFyCKXR3umAxaWWcPB8u 0 0 0 15kzeBje51EWtch5Hu1M5ZLFoMf4oZvJjV 0 0 0 124RQppSJuiBPAe7n2agHonbjAEuqCe69T 0 0 0 1GW9mM3hrVU1m9stysHJrYGqq7caqwW2wM 0 0 0 1FjLKPLhek8aDtdWJrn9hSn3DWMK6Fwngm 0 0 0 19XQNCmGgcqHHKGs51dqC8GUq9LSmmZcaG 0 0 0 1DgK4GnmKqZzSKFkkZcP29gkmsw8PdEg1Z 0 0 0 14D3RsnR1ppuNJnSrCq23rLtkGdzEYhxez 0 0 0 1KfS3PMKpTDGLLJQCAfVpLuVsf8xcyQC9M 0 0 0 1CgEnv5xYbT2RSbVD2ZyVbsL7ZysCei2Ky 0 0 0 125GsfiBpxF5QL3Gqfu5MTArHxmP99wdts 0 0 0 1NixVp34BtKZ27hLkcLWzDNigqn6TUFmq7 0 0 0 1KSbudd4H1X8PcTm13rsL63rR5qFttQvUk 0 0 0 1CAETj32aDQkqEeDPWAyvpKbKAttkAgxXh 0 0 0 141pu8PQc1ScZVSSvDD4ADzdkA2vwSzNYm 0 0 0 1KNoXZnugKUgcJffk95skehGh8gJpw2EUF 0 0 0 1HehYt62R75cFyoVKdFohURegJx61WqDwA 0 0 0 1LxrmSjYYFwdJNR9C7gbaaCAzsYnYZARDF 0 0 0 1pTEwxdCQEeDLKgtzFBu2C7pLgCb7ST1m 0 0 0 1Pna4z6VfKbf1fDL2g4WYP7xey3tWWYDC5 0 0 0 1MWujTsc3PjWThFVoBBq3wGYpUFuoKfDKj 0 0 0 1FiEscEjyRnmvEtYVKqeVTZmmTQyATSn7q 0 0 0 17pMi4bR3Qw6KhssBe9tTBmcsw1jxrr1D2 0 0 0 19TXvWnR8FBk4ofmxcpVNY9UiWy4FPdGiE 0 0 0 1AotJujHNuvdJ7f1pUNAY7TWBEKyFHgCe5 0 0 0 16WvDi3PhiY57JC2pAYctrLEnv7GURkBob 0 0 0 1C39b9RhGjt8gx77cBGwbRwS4wivJeaacN 0 0 0 1Evknk66MGUgoeooA4THXqbvohFBRVqqoF 0 0 0 1FumcvpjrNPiRVabxteA1iqr2XgJjHGCM6 0 0 0 1AWEx8FoPwZvfLQaKaTtGYmtNs8k3vibws 0 0 0 1JPYbdt1m9baQuSq8nG2Mnssko1zRMQDXE 0 0 0 1DFkMYatPS6ofQxXAS3XqcjJmbYMKn6P9H 0 0 0 1Cr4fNQmz3f3vhqgnmhydFUGwGwrPKNtwM 0 0 0 1DGUrUa7yurCaHA6NQTvktPF3irZb1k6zo 0 0 0 12898n8HZnoaebLosr7iW7ZgxZXrDmUfaE 0 0 0 113NSceBKeNy1moQ9b6qNX8k9h8BXJeqNG 0 0 0 1HKCDSA8b7a9cX5LuySMPr9tqQ1exsmF7S 0 0 0 1BJXbmqihvMkPkiGuRiDTVXmGRQ2hRKNVt 0 0 0 1Q31qejuny29d58icMXFsVPDpw69cb7xzg 0 0 0 1MhrfTS3hdaS8ycwuta6yo9QSV5fAEdTHu 0 0 0 1Cx4xjZNTfZvW1VeaJzPJwXpsVG45R5a4X 0 0 0 1Hs779R92ZxedtV1SbxdRehyfstNjvzNDc 0 0 0 1Epeme6U7yvhgB6dSejUP9pbKeAnDrDjH4 0 0 0 1AwopL4AiByc3ve4reCmfzXpB98JhQ98rA 0 0 0 1KEZP74iXR85AXXvYWzxXPLNmVmxCeAWoh 0 0 0 16KrDsEoUjoSz8vUQzYdtA6b6aJG9ACRoc 0 0 0 1MDt1VJ7sD7KXhy5x6Ag3mZGuRVgeJDSix 0 0 0 1GsjSFR878viktp5AiGYyKjW9mq4eLsZcL 0 0 0 1HFDiVvgMovjHHKya59T4DQ213jw11pwqH 0 0 0 16NCnoSLBj9WtDVNeap94PBG4a9Tv1LDM8 0 0 0 1AvK6m3xfqCcwNHYuR2T1W2wrF6q4R2sGK 0 0 0 1GA5VPLtQtZ54Hb8z9y7Gp4r9n1yBAa74E 0 0 0 1MhYdwc2GQeSYHT6Sn3q839b6wZHdgq3m5 0 0 0 1AgAoMzpkRygmWefBrGdYaeQxspqnPtyoe 0 0 0 12NkjFVWHdx6c9c1aiHFqbAsPpjxvkd8Ln 0 0 0 1DTdCQiutrqiYF62gFugbmqUs5kuCEufAx 0 0 0 1Aq2yh7a5gvqsbZGU6th5vb2FcPmojx7Y5 0 0 0 1E7GQ4ukx7Urz9z4oDFQwckTPscJPLTXiw 0 0 0 1Cr4X3Ld4vuiikTHcQtfBT7akQZLeXXnjC 0 0 0 1DPoXbX3ynG7qas5KkeUcXPFCcwSAhWSxJ 0 0 0 15zLwrEWpLJHi1ToRb9yLYGEWKR7ZFupk9 0 0 0 1BZEYhTonb1jRJYariiNs8HNxu7w6BtsP3 0 0 0 1JUA6HuVB7bccEjyJTQ35s2U57KqMjzyE6 0 0 0 1MKpddcHyZ4hgkZ7Yjn887e7QymgKNTnkP 0 0 0 169GrVX92e7BBM88HAyer5yHoFVFZeYwdG 0 0 0 1NUPPsBoFVL81ZKJbd5UjTvqRDtf6VrY9y 0 0 0 1M82HHuQynCjKT2GR9nveCCXcYKKeFVGxi 0 0 0 1CDRnd3sD5PuXmoFZ6W4awFFUAZUzivXiL 0 0 0 14ZHfKKR5P7pHDRpVdfPMqxLRh96pmEnir 0 0 0 1Ma1FUFTW4XmaHZft4hZgojcCsXe1Es9az 0 0 0 1KrYdqHWvfZcXXtXyygBJkRuoQhPRgZpE2 0 0 0 1HASiXZRY8JxVht8BfsVrgY1MobRxs8gPZ 0 0 0 1JXzLuYMrJY2KDXE7ZdxmbdaeAfQ8E6ZnU 0 0 0 1MoZPDpNqUXFKKnKL8k8REfjYJFabpqZxU 0 0 0 1DtYVj17ALgvjf2NDYc2MLEUXsm6mmA91H 0 0 0 1GksbiDh2Eihip8NNwQN7CWRDuWkAky1rG 0 0 0 1GfSL8XBKCgfeTS3Yn2sou3x3YgMEjqGeA 0 0 0 1DnUGrUMQo7xtmJS2QTFyFRBLwmNfv8UCW 0 0 0 19nFMiiyeft3fE13dX2utkHyo6gaz2Xnf9 0 0 0 1FqAkPsp9iGoXP37nK7uavVQ8G2NMVLEba 0 0 0 1KBWnCmDBEfs6rnE6tUB6DBaCAJMYvMewM 0 0 0 1MQLuRihPYLa6ZjnFzE8iAYR1eFx35oeWU 0 0 0 1PBR4tQdRDr8mfyLdFqZhM54KKHDQdrqAv 0 0 0 1PDZaAXLLZQnTe7GgUncSbc7VPv9CqzQtn 0 0 0 115XC2BEDaWnS5uoqSjfBKb4VDVd8JtvNm 0 0 0 1GLbGRRPq53s5fhi3ssmL9uoq6HE6dD1AM 0 0 0 1GXj7h2wSBNhH2WdgMLVZ9dACaUF7n2onu 0 0 0 16B6dgKFoNstHnrwYVRxME6TNm6xMyxWQ6 0 0 0 15b75gyEfRfF2N7T825YwpWVGLu5b4JVAk 0 0 0 1HRdX5NZB8CwrijiHBRZh5dezZN9DS2RJi 0 0 0 1445tLtMm4RucxYfWDUopgAFBtFSda1Wao 0 0 0 1P3icWVeN6UZhRXKVrTEMN5RwXStNFkzL4 0 0 0 1J2fWtzksRrPUUeHgGqJcYjTeN62nqJAHP 0 0 0 1PhAzthZMqAaFHBAEDLinbNk6yZBVVfyrr 0 0 0 1KiThshH2ec6jvnQDaPXBjoFB38YgbkiR2 0 0 0 1B4ox92miD4EJbL6CmJLkGFKnJYhs8vi8 0 0 0 1EsNBAVDUh2kh2DktyUYfJRuksMQJjgu6b 0 0 0 15LZALXitpbkK6m2QcbeQp6McqMvgeTnY8 0 0 0 135wjT8a87vS3ZPs4VwHXUgV9h6qWV62gS 0 0 0 13vGEE5kaKs3PJF5BgZuCAXDT1tG6RYB47 0 0 0 1CNfXbh4jrfiR1pHa6kFmv77FxboJiiakP 0 0 0 15LQCmQZ4H3rQ9bKVyoa3iuENp7X22FEaB 0 0 0

See Also:

I KNOW YOUR PASSWORD BITCOIN EXTORTION EMAIL VARIANT– July 13, 2018

BITCOIN PORN BLACKMAIL SCAM MOVED TO POLONIEX WALLET– June 2, 2018

BITCOIN PORN BLACKMAIL SCAM REPORTS SURGE– March 12, 2018

***

Help police and deter future frauds by always reporting scam addresses to BitcoinWhosWho.com. Just lookup the bitcoin address and select “Report Scam”.



All scam reports are accessible by keyword search on our website or from our “Blacklisted Bitcoin Address” API.

The safest place to buy bitcoins is Coinbase.com

Don’t forget to follow us on Twitter and like our page on Facebook.