0

got this email on gmail spam folder was wondering if this is legit or not ..enter image description here

0

1 Answer 1

2

Almost certainly (~98% confidence) it's a scam. 99.9% confidence if "pfax8fg0gq" isn't actually one of your passwords, but even if you have used that password, it's still more likely to be a message from somebody with access to the password database of the site you used it on trying to scare you, rather than truthfully having compromised your machine.

A handful of clues in no particular order:

  • Gmail recognizing it as malicious / junk
  • This is a very common scam format (which is why Gmail recognizes it), practically a form letter and the modern equivalent of the "Nigerian Prince" 419 scam. I've gotten it multiple times myself (with minor variation in wording), only occasionally with an actual password from my past, and never paid or gotten "embarrassed" by the consequences of not paying
  • Sender name and email address don't match
  • Awkward, poorly-written English indicative of the author not being fluent or at least not a native speaker
  • An actual blackmail attempt would have no reason not to provide evidence (such as a screenshot from the supposedly-captured video, and/or one of the harvested email addresses); the lack of any is strong evidence against it being legitimate.
  • The terminology is vague enough ("the adult videos website" rather than any specific site, "video you were viewing" without any details, "to have fun"/"it is u" without any specific reference to what you were doing that might depend on what body parts you have or how you watch porn, etc.) to be plausibly true for a large number of people when, again, an actual blackmailer could and usually would be more specific.
3
  • hello thanks for replying , regarding the password i searched for it on hveibeenpawned and found out that i had 5 breaches on this email address , the password itself is not found in haveibeenpawned . i further researched using scatteredsecrets site and found out that this password was the password i used at dlh.net during 2014-2015 period and the site was compromised in 2016.So i guess the used some software to dehash the password the got from the dump ?
    – yhbv555
    Commented Mar 16, 2021 at 5:43
  • Yeah, that's a good guess. (You can't actually "dehash" a hash but you can brute-force it for short enough inputs, like passwords.) I checked pwned-passwords myself (and would have mentioned it if was present, as evidence against the email being legit) but Troy doesn't have every cracked password out there. Somebody breaching the site and gaining access to their auth DB is the most likely case, especially if you know the site was breached. As a side note, that's an unusually good password but still a bit short; I recommend using a password manager that auto-generates (and stores) longer ones.
    – CBHacking
    Commented Mar 16, 2021 at 5:55
  • 1
    scatteredsecrets is a password cracking website , they basically crack passwords from the dump and i found out this ibb.co/vQ4ntfz , and i will follow your advice i will indeed use a password manager from now on ...
    – yhbv555
    Commented Mar 16, 2021 at 6:01

Not the answer you're looking for? Browse other questions tagged .