Google
Edit File: 1768638195.M913508P1474011.server-619288.prediksijaya.com,S=7121,W=7256:2,a
Return-Path: <JohnBlue@hola.com> Delivered-To: angker+spam@server-619288.prediksijaya.com Received: from server-619288.prediksijaya.com by server-619288.prediksijaya.com with LMTP id oL5MNvNGa2nbfRYAf7/9AQ (envelope-from <JohnBlue@hola.com>) for <angker+spam@server-619288.prediksijaya.com>; Sat, 17 Jan 2026 15:23:15 +0700 Return-path: <JohnBlue@hola.com> Envelope-to: zensho@ponjosonek.com Delivery-date: Sat, 17 Jan 2026 15:23:15 +0700 Received: from [217.25.22.182] (port=53192 helo=[217.25.27.10]) by server-619288.prediksijaya.com with esmtp (Exim 4.99.1) (envelope-from <JohnBlue@hola.com>) id 1vh1aS-00000006BMl-3yMe for zensho@ponjosonek.com; Sat, 17 Jan 2026 15:23:15 +0700 Received: from gikihvv ([12.107.209.244]) by 40409.com with MailEnable ESMTP; Sat, 17 Jan 2026 12:23:10 +0400 Received: (qmail 94766 invoked by uid 947); 17 Jan 2026 12:23:08 +0400 From: John Blue <JohnBlue@hola.com> To: zensho@ponjosonek.com Date: Sat, 17 Jan 2026 12:23:10 +0400 Message-ID: <947660.947660@40409.com> Mime-Version: 1.0 Content-type: text/plain; X-Spam-Status: Yes, score=26.6 X-Spam-Score: 266 X-Spam-Bar: ++++++++++++++++++++++++++ X-Spam-Report: Spam detection software, running on the system "server-619288.prediksijaya.com", has identified this incoming email as possible spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see root\@localhost for details. Content preview: Hi, today I have some sad news for you. Your device was infected with my private malware. Your browser wasn't updated, in this case, it is enough to just visit a website where my iframe is placed to get automatically infected. Content analysis details: (26.6 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 RCVD_IN_DNSWL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to DNSWL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block for more information. [217.25.22.182 listed in list.dnswl.org] 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URI: paybis.com] [URI: cex.io] [URI: nexo.com] [URI: invity.io] [URI: bitpay.com] 0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. [217.25.22.182 listed in bl.score.senderscore.com] 0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. [217.25.22.182 listed in sa-trusted.bondedsender.org] 0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. [217.25.22.182 listed in sa-accredit.habeas.com] 1.5 RCVD_IN_HOSTKARMA_BL RBL: Sender listed in HOSTKARMA-BLACK [217.25.22.182 listed in hostkarma.junkemailfilter.com] 0.0 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2) [217.25.22.182 listed in wl.mailspike.net] 1.5 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) 0.2 KAM_DMARC_NONE DKIM has Failed or SPF has failed on the message and the domain has no DMARC policy 0.0 KAM_DMARC_STATUS Test Rule for DKIM or SPF Failure with Strict Alignment 0.5 SUBJ_ALL_CAPS Subject is all capitals 2.5 GB_HASHBL_BTC Message contains BTC address found on BTCBL [18dgwwhcc7imoa3vdrwyun3ksamgy9n6ec] 8.0 BTC_HASHBL_BLACK Message contains BTC address found on BTC blocklist [18dgwwhcc7imoa3vdrwyun3ksamgy9n6ec] 8.5 KAM_CRIM Extortion Email 2.0 RDNS_NONE Delivered to internal network by a host with no rDNS 0.0 KAM_SHORT Use of a URL Shortener for very short URL 0.5 PDS_BTC_ID FP reduced Bitcoin ID 1.3 BITCOIN_EXTORT_01 Extortion spam, pay via BitCoin X-Spam-Flag: YES Subject: YOU PERVERT! I RECORDED YOU! Hi, today I have some sad news for you. Your device was infected with my private malware. Your browser wasn't updated, in this case, it is enough to just visit a website where my iframe is placed to get automatically infected. If you want to find out more, Google: Drive-by exploit. My malware has given me full access to all your accounts, complete control over your device, and it was also possible to spy on you through your camera. If you think this is some bad joke, no, I know your password: 2k84hbhb#KK I collected all your private data and I RECORDED YOU (through your camera) SATISFYING YOURSELF! After that, I removed my malware to leave no traces, this email was sent from a hacked server. If you still doubt my serious intentions, it only takes a couple of mouse clicks to share the video of you with your friends, relatives, all email contacts, on social networks, the darknet, and to publish all your files. You can stop me, and only I can help you in this situation. The only way to stop me is to pay exactly $800 in Bitcoin (BTC). It's a very good offer compared to all the horrible things that will happen if I publish everything. You can easily buy Bitcoin (BTC) here: https://cex.io/buy-bitcoins https://nexo.com/buy-crypto/bitcoin-btc https://bitpay.com/buy-bitcoin/?crypto=BTC https://paybis.com/ https://invity.io/buy-crypto You can send the Bitcoin (BTC) directly to my wallet, or install the free software: Atomic Wallet or Exodus Wallet, then receive and send to mine. My Bitcoin (BTC) wallet address is: 18dGWwhCC7iMoa3VdRwyUn3ksAmGy9n6ec Yes, that's how the wallet/address looks, copy and paste it, it's (cAsE-sEnSEtiVE). I give you 3 days to pay. Since I have access to this email account, I will know if this email has already been read. After receiving the payment, I will remove everything, and you can live your life in peace like before. Don't worry, I keep my promise! Next time, make sure that your device has the latest security updates.