Hacker demands BTC to give me back my database information

A

adaptechdesigns

Guest
Here's the email I received. Sorry if this isn't the right place, but I figured you nerds are like me. This is an obvious phishing scam, and I didnt give a F about the stupid site they mentioned. I've locked everything tight, and I'm not concerned about it at all. I am however curious about ways to find out who it is. I've found the IP information cited in the email, but I'm sure it's a proxy. The email address had me curious though, and I search for the domain whois etc. Pretty generic stuff there. I just want to troll this dude so bad. Anyone want to help?


admin@
18:42 (3 hours ago)
to Administrator

Hello Administrator,

The following is an e-mail sent to you through the administration contact
page on "R5 Forum".

The message was sent from a guest who specified the following contact
information:
Name: Valarie Thornber
E-mail address: [email protected]
IP Address: 194.187.249.182


Message sent to you follows
~~~~~~~~~~~~~~~~~~~~~~~~~~~

PLEASE FORWARD THIS EMAIL TO SOMEONE IN YOUR COMPANY WHO IS ALLOWED TO MAKE
IMPORTANT DECISIONS!

We have hacked your website and extracted your
databases.

How did this happen?
Our team has found a vulnerability within your site that we were able to
exploit. After finding the vulnerability we were able to get your database
credentials and extract your entire database and move the information to an
offshore server.

What does this mean?

We will systematically go through a series of steps of totally damaging
your reputation. First your database will be leaked or sold to the highest
bidder which they will use with whatever their intentions are. Next if
there are e-mails found they will be e-mailed that their information has
been sold or leaked and your site was at fault
thusly damaging your reputation and having angry customers/associates with
whatever angry customers/associates do. Lastly any links that you have
indexed in the search engines will be de-indexed based off of blackhat
techniques that we used in the past to de-index our targets.

How do I stop this?

We are willing to refrain from destroying your site's reputation for a
small fee. The current fee is .33 BTC in bitcoins ($3000 USD).

Send the bitcoin to the following Bitcoin address (Copy and paste as it is
case sensitive):

1HPTGdcnRDcQtfAeE8GPdMQT2NPczHZ6EW

Once you have paid we will automatically get informed that it was your
payment. Please note that you have to make payment within 5 days after
receiving this notice or the database leak, e-mails dispatched, and
de-index of your site WILL start!

How do I get Bitcoins?

You can easily buy bitcoins via several websites or even offline from a
Bitcoin-ATM. We suggest you https://cex.io/ for buying bitcoins.

What if I don’t pay?

If you decide not to pay, we will start the attack at the indicated date
and uphold it until you do, there’s no counter measure to this, you will
only end up wasting more money trying to find a solution. We will
completely destroy your reputation amongst google and your customers.

This is not a hoax, do not reply to this email, don’t try to reason or
negotiate, we will not read any replies. Once you have paid we will stop
what we were doing and you will never hear from us again!

Please note that Bitcoin is anonymous and no one will find out that you
have complied.
 
Last edited by a moderator:
A

adaptechdesigns

Guest
and what is your plan?
Not sure I have a plan. It's just lame that some idiot sends that out to a ton of people. Someone may be stupid enough to fall for it. Some loser in his basement somewhere trying to come up and I figured if anyone had any ideas this forum would. Pretty smart people on here who know way more about this than I do.
 

CyberDeviL

Back to Life 🧬
Trusted Uploader
Aug 10, 2018
2,795
10,823
113
Earth
First of all why didn't you secure your stuffs from the CORE at beginning . .

If you're sure your site is secured 100% then if I were you, then I would simply ignore such email shits .
 

Nookie

New member
Dec 24, 2018
1
0
1
In my case, the vulnerability was in PhpMyAdmin. Try to update or disable PMA and restore the database from the backup.
 

Oworock

Active member
May 11, 2020
135
56
28
Is the site truly hacked?

If yes, is the website on WordPress?

or what script.

What host are you using?

I was once a victim of this, but backup from the host helped me.
 

CyberDeviL

Back to Life 🧬
Trusted Uploader
Aug 10, 2018
2,795
10,823
113
Earth
Damn. I knew someone would say that. No dude. The website was secure. No one has been in it. It was a throw away one which makes it even funnier. I have plenty of sites, and that one is the least important.

Then ignore such shitty warnings :)
 
A

adaptechdesigns

Guest
Is the site truly hacked?

If yes, is the website on WordPress?

or what script.

What host are you using?

I was once a victim of this, but backup from the host helped me.
This site is with namecheap. I talked to tech after I received the email
 

CyberDeviL

Back to Life 🧬
Trusted Uploader
Aug 10, 2018
2,795
10,823
113
Earth
But it doesn't bother you some neck beard is out there just trying to take someone's hard earned BTC? IDK dude, just figure you guys would get it.

Throughout my journey I've seen & dealt with lots of beggars assholes, from the point when I learnt what & which can be reason for such "vulnerabilities" I learnt to ignore such dickheads and such worries . . So it no more bothers .
 
  • Like
Reactions: adaptechdesigns
A

adaptechdesigns

Guest
Throughout my journey I've seen & dealt with lots of beggars assholes, from the point when I learnt what & which can be reason for such "vulnerabilities" I learnt to ignore such dickheads and such worries . . So it no more bothers .
I wish, sincerely I was as enlightened as you. Mean people suck dude. And I'll get over it. I have tons of sites in my life, and I have never had anything like that. Oh well. Thanks for letting me wish for vendetta for a moment.
 
A

adaptechdesigns

Guest
Mine was with NameCheap too, but i was able to get a backup from the support.
Ya. It was never down. I just put a petty ass site up right now to mess with them. But they never did anything.
 

tradesman

Well-known member
Mar 9, 2020
367
225
63
Cold North
We have hacked your website http://www. rrrrr. cloud and extracted your
databases.


NS (Name Server records)
« NS » records define authoritative name servers for « rrrrr33.com ».
  • Name servers: dns22.hichina.com and dns21.hichina.com
I think you should thank them instead and forget about trolling. There's no point in annoying them if you can't even implement an SSL on your website. They even suggested where to buy bitcoins. LOL.

My advice is don't promote your website here, Babiato is the best website for nulled scripts, but not for linking. It will hurt your website's ranking.

Move along.
 
  • Like
Reactions: pitza
A

adaptechdesigns

Guest
NS (Name Server records)
« NS » records define authoritative name servers for « rrrrr33.com ».
  • Name servers: dns22.hichina.com and dns21.hichina.com
I think you should thank them instead and forget about trolling. There's no point in annoying them if you can't even implement an SSL on your website. They even suggested where to buy bitcoins. LOL.

My advice is don't promote your website here, Babiato is the best website for nulled scripts, but not for linking. It will hurt your website's ranking.

Move along.
Oh wow, word? That's what you thought I was doing. Have you seen the site? Did you see it without an SSL? Damn, dude. You went in on me thinking I give one f about linking on this site, But cool. Thanks for reminding me about the SSL.
I removed all links, excluding the one you quoted
 

IamJAX

Active member
Oct 24, 2019
93
180
43
This looks like a common spam message. Just ignore it like all other spam.

Have a great day :)


You are using phpbb forum. The spammer visited /forum/memberlist.php?mode=contactadmin and messaged you from there with his template message.

Just disable admin contact in phpbb at ACP (Admin control panel) > Contact page settings > Enable contact page > Disabled
 
  • Like
Reactions: adaptechdesigns

biscuit

Well-known member
May 30, 2018
417
240
63
I used to get blackmailed a lot. One thing I learned: never allow the sucker to contact you. If he can't do that he will move one. If you have a webmail send some weird response that the email was not delivered. On webforms instead of "thank you, your message was delivered" put a php error.
 
A

adaptechdesigns

Guest
I used to get blackmailed a lot. One thing I learned: never allow the sucker to contact you. If he can't do that he will move one. If you have a webmail send some weird response that the email was not delivered. On webforms instead of "thank you, your message was delivered" put a php error.
It's just a forwarding email anyway. I think I should thank them like king neck beard said. It gave me a few minutes of agitation, but I had a glaring hole there according to the experts who never visited my site. Learned my lesson about actually having a conversation in general discussion. That will stick.
 

tradesman

Well-known member
Mar 9, 2020
367
225
63
Cold North
Oh wow, word? That's what you thought I was doing. Have you seen the site? Did you see it without an SSL? Damn, dude. You went in on me thinking I give one f about linking on this site, But cool. Thanks for reminding me about the SSL.
I removed all links, excluding the one you quoted


I Checked your website, including the one in you profile and signature, I even added your Twitter, Facebook, and Instagram to the package. You're into people with mental disabilities, plus size ladies, and crypto trading.
Yes, drama queens annoy me.

Have a great day...
 

Forum statistics

Threads
69,229
Messages
908,458
Members
237,125
Latest member
b4lance10

About us

  • Our community has been around for many years and pride ourselves on offering unbiased, critical discussion among people of all different backgrounds. We are working every day to make sure our community is one of the best.

Quick Navigation

User Menu