The extortion email arrived even at mailboxes that do not exist. We took it apart

On the afternoon of 14 October an extortion email arrived at the domain of one of our projects. Nothing new in itself. What was unusual was something else: it landed on several addresses at once, including mailboxes that had never existed in that domain. One of them was 123456@, which is not an address but a random number.

We opened the message in its raw form and went through it line by line. What came out is exactly what an email like this needs in order to work, and at the same time everything that gives it away. It doubles as a guide to taking such a message apart yourself, even if you are not a mail administrator.

What the message says

The text is in fluent Slovak, without the usual translation slips, and it says nothing about a webcam or pornography the way earlier waves did. The extortionist claims to have “full control of your entire data package”: name, date of birth, address, national ID number, identity and driving licence, access to every email account and social network, bank accounts and card details including the CVV.

Then he offers two scenarios. Either he sells it on darknet forums, or you buy the archive back for a “symbolic compensation payment of 500 EUR” in bitcoin. And he adds the line that the whole trick rests on:

Do not even try to ignore this message, I know exactly when it was opened. The deadline expires exactly 48 hours after this email is opened.

The sender and the recipient are the same address. That is meant to look like proof that the attacker controls the mailbox. He does not.

Why it arrived at addresses that do not exist

This is the most practical part of the case, and most companies have no idea about it.

Many domains have catch-all delivery enabled. It means that whatever is written before the at sign gets delivered into one mailbox, even if that address was never created. Originally it serves a good purpose: a customer mistypes info as inof and the message does not bounce. In practice, though, it means the domain accepts absolutely everything.

Attackers know this and look nothing up. They take a list of domains, add a dictionary of common names and random strings, and fire it off blindly. A domain without catch-all rejects the vast majority of those attempts during delivery, because the recipient does not exist. A domain with catch-all accepts and stores all of them. That is exactly why you get mail “at everything” and your colleague in another company does not.

So if something arrived at an address you never created, it is not a sign of a breach. It is a sign of how your domain is configured.

What the headers contained

Headers are the part of a message you normally do not see and the sender does not control. That is what makes them interesting.

The message came from Argentina. The first server in the chain is 200.63.171.29, named host.29.171.63.200.gigavia.com.ar, an ordinary Telefónica line in Buenos Aires. It is not a hosting provider or a mail server, just a regular connection. This is what sending from an infected computer in a botnet looks like, which is confirmed by the address being listed in a botnet IP blocklist. The person who wrote the text has nothing to do with Argentina, he merely rented someone else’s computer.

The sender check failed. The SPF record in a domain states who may send mail on its behalf. The result in the header is softfail, followed by a note that the sender is not authorised. The DKIM signature is missing entirely and the DMARC policy is set to p=none, meaning “detect but do nothing”. Taken together, the server recognised the forgery and delivered the message anyway, because the domain itself allowed it.

The diacritics fell apart. The message declares the ISO-8859-3 character set, which covers Maltese and Esperanto. Slovak letters are not in it, so the attacker replaced them with HTML entities. In the subject line some clients cannot handle this and show a jumble of characters instead of readable words. A small detail, but a reliable sign that the message was not written by a human in a normal mail client.

And the filter let it through by a whisker. The provider’s antispam scored the message at 14.01 points, where 15.00 would have meant dropping it. Less than a single point short. It was helped by having no links and no attachments, so it looked like plain text from a colleague.

Proof that the attacker is lying

The entire psychology of this message rests on the line “I know exactly when it was opened”. But tracking an email open is possible in only one way: by embedding something that is downloaded from the internet when the message is displayed. Typically a transparent one-pixel image.

We parsed the body programmatically. The result: zero images, zero links, zero external resources. There is not one element in that message capable of telling anyone that you opened it. The “48 hours from opening” deadline therefore never starts, because there is nothing to measure.

The same goes for the list of data at the top. Not a single concrete detail. No name, no real document number, no sample. Someone who genuinely held your ID number and a scan of your identity card would attach it, because that is precisely what would break a victim. An empty list is the cheapest way to create terror while holding nothing at all.

How much he made

The bitcoin wallet is stated openly in the email and the blockchain is public, so anyone can verify it. We checked the address on the day the campaign went out.

Zero incoming transactions, zero bitcoin. The address had never been used until that day. Nobody paid this particular wave.

It should be read soberly, though. Campaigns are mass mailings sent to tens of thousands of addresses, and each victim may receive a different wallet. With costs close to zero, one single payment is enough to make the whole mailing profitable. That is why it never stops.

What to do about it

As a recipient your job takes half a minute: do not reply, do not pay, do not open anything, mark it as spam and delete it. Both a reply and a payment confirm that the address is live, and the campaigns start arriving more often.

As a company there are three things worth doing today:

Turn off catch-all delivery if you do not need it. Instead, forward only the addresses you actually use. The volume of this kind of mail drops sharply, because the attacker is firing blindly.

Set strict authentication for your domain. SPF with a strict -all, DKIM signing and DMARC with a quarantine or reject policy. We cover it in detail in our article on securing company email with SPF, DKIM and DMARC. In our case the domain had a soft ~all and p=none, which is exactly the state in which a forged message gets through.

Tell your colleagues before it reaches them. The expensive part of these emails is not the ransom, it is the hour of panic in which someone changes passwords in the wrong place or calls a number from the message. When people know the message is circulating and what it looks like, nothing happens.

If you want to verify whether anyone actually got into your mailbox, we described the steps with screenshots in our article on the extortion email that comes from your own address. How to check a suspicious message in general is covered in our guide to verifying an email.

Conclusion

This wave is in Slovak, it talks about documents and cards rather than a webcam, and it asks for 500 euros. It looks impressive only until you open the source of the message. What remains is an email sent from someone else’s computer in Argentina, with a failed sender check, without a single tracking element, and with a wallet nobody sent anything to. The only thing the attacker really has is your email address, and even that he most likely just guessed.

Verification and sources. All data in this article comes from an email delivered on 14 October 2026 and from publicly available sources: the state of the bitcoin address was verified through mempool.space, the origin of the sending IP through public geolocation and reputation databases. Advice from police and security specialists on extortion emails can be found at hoax.sk, which has tracked these campaigns for years.

This article is part of our Cybersecurity overview.