Casascius phishers demanding a ransom

[casascius]

Open response to the e-mail below:

Dear anonymous John Smith,

Thank you for the interest you have shown in the coins I've been producing.

While it's disappointing that you're interested in attacking my service, I find it to be a highly novel application that Bitcoin can be used for anonymous extortion.  You and I are both aware that I can pay you, and can never identify you, nor can I ever know whether the next person to demand a fee from me is the same you.  For the technology's sake, I will be highly amused if one day in the future I hear in the news that a ship is being held ransom and the demand is in Bitcoins.  If it happens, you could call yourself a pioneer.

While you clearly have the genius to see this novel application for Bitcoin, I also think you may misunderstand my purpose in creating and offering physical Bitcoins for sale.

My purpose in promoting physical Bitcoins is to promote the concept of Bitcoin and other ways it can be used by the public, without needing a software program that's only useful for geeks and which puts them at risk for theft from hackers.  If you try to disrupt my physical Bitcoin sales with attacks, you will probably succeed.  I probably will not go to much effort to try and counter a serious effort to attack it.  I am not persuaded that paying the fee you have asked will serve to stop the attacks.

I should qualify how you might succeed.  You might succeed in shutting my site down or diverting people to a phishing site, but you won't succeed in stealing any of the value on physical Bitcoins, or my bitcoins which I keep on paper wallets virtually full time.  You will probably agree, offline private keys are immune to pretty much all online attacks.

Further, you should know there is a limit to how many coins I can produce right now - I really can't sustain a very large volume in sales, so it is very possible I may be "DDoSed" in the near future simply by the legitimate business interest that is probably an indirect result of your scam site.  Either way, I have clearly succeeded in evangelizing the idea of physical cryptocurrency (with all due respect to BitBills), and I hope the community takes the idea a step further and does a better job than me at some point.

I don't believe that these attacks are damaging my personal reputation.  I do believe, however, they damage the reputation of Bitcoin and make it unattractive to those not involved with technology.  That's unfortunate, but that's one of its features - anonymous really means anonymous.  I would prefer not to have another round of media coverage telling the world yet again another reason why using Bitcoin is risky.  But that's under your control.  Since you've clearly taken the time to understand how Bitcoin works, I assume and hope you would prefer that Bitcoin grow and succeed, than to attack its public perception.

I would be happy to send you two or three of my coins free of charge to any physical address you choose at my own expense, just for having taken an interest.  Perhaps you can find a way to attack the physical coins, I'll be interested to hear if you manage to succeed.  Give me the address of a trusted stranger or acquaintance who will safely forward them to you with the same "txt" method you have used below, and I will oblige.

Respectfully,

Mike Caldwell

From: John Smith [mailto:1n5e5oqy7jplcgcqwnjafwxf27cb33z4dq@webmail.co.za]
Sent: Wednesday, October 26, 2011 12:24 PM
To: casascius@mc2cs.com
Subject: do not relax

do not relax, we just started playing.

i will be happy to start real work with you untill i will not tired.
there are so many interesting things waiting for you.

but you can pay me to avoid of all this shit. my price today is 300 bitcoins and this is much less than the quality ddos protection and reputation losing during scam. price will grow.

as soon i receive payment i drop off all my scam domains that affected you and will never interfere with your business.

pay here: 1N5E5oqY7JpLCgcqWNjafWXF27Cb33Z4Dq

verify me by TXT record of net domain.

check for example here www.whatsmyip.us/txt <- casascius dot net

I advise you to pay in 3 days.

Headers:

<local stuff snipped>
Received: from mailgate.wmint.net (mailgate.wmint.net [80.247.237.19])   by
 mail98c0.megamailservers.com (8.13.6/8.13.1) with ESMTP id p9QIOQw9018419   for
 <casascius@mc2cs.com>; Wed, 26 Oct 2011 14:24:28 -0400
Received: from www.webmail.co.za (iweb4.wmint.net [192.168.100.6])   by
 mailgate.wmint.net (Postfix) with ESMTP id 53618380001A3   for
 <casascius@mc2cs.com>; Wed, 26 Oct 2011 20:24:25 +0200 (SAST)
X-Mailer: Hastymail2 1.0
Received: from unknown ([201.35.4.203]) authenticated user
        1n5e5oqy7jplcgcqwnjafwxf27cb33z4dq@webmail.co.za by www.webmail.co.za
 with        HTTP; Wed, 26 Oct 2011 20:24:25 +0200
To: <casascius@mc2cs.com>
From: John Smith <1n5e5oqy7jplcgcqwnjafwxf27cb33z4dq@webmail.co.za>
Subject: do not relax
Date: Wed, 26 Oct 2011 20:24:25 +0200
Content-Type: text/plain; charset="UTF-8"; format=fixed
MIME-Version: 1.0
Message-ID: <df1a51b4de2c7cab24c8ab4d463aa1c9@www.webmail.co.za>
Content-Transfer-Encoding: 8bit
X-MMR: 0
X-CSC: 0
X-CHA: v=1.1 cv=aPPZer4WAhGcx+vP3fBwqKtPsjyFzNUAiOP+sulbenA= c=1 sm=1
      a=BLceEmwcHowA:10 a=IkcTkHD0fZMA:10 a=d0tj6I8CGchA31JZUvxdow==:17
      a=gGsXarMTAAAA:8 a=irAyJklUAAAA:8 a=8ByQLoDwAAAA:8 a=qkRcwGf7Vyti2Gyff24A:9
      a=QEXdDO2ut3YA:10 a=d0tj6I8CGchA31JZUvxdow==:117
Return-Path: 1n5e5oqy7jplcgcqwnjafwxf27cb33z4dq@webmail.co.za
X-OriginalArrivalTime: 26 Oct 2011 18:24:14.0125 (UTC) FILETIME=[76D76DD0:01CC940C]
X-MS-Exchange-Organization-SCL: 5

[genjix]

Such a shame. What a loser.

[cbeast]

Just change the website name to something else and grab all the variations. Not enough people really know about them yet, do they?

[genjix]

Yeah, I never liked the name Casascius anyway. It's too much of a tongue twister.

[DeathAndTaxes]

Just change the website name to something else and grab all the variations. Not enough people really know about them yet, do they?

This.  I would continue to sell your existing coins but if/when you decide to go for round 2 come up with a completely different name and this time spend the $80 or so to bulk register alternate versions.

[RodeoX]

Call me vindictive, but if I got an extortion letter it would inspire me to go on the offensive. Instead of sending him 300BTC, I would pay 600BTC to a very bad man willing to get vengeance for me.
Getting even is one area that I split from logical cost/benefit analysis.   

[Bitcoin Oz]

They would have fun trying to ddos google appspot fwiw.

If youre manufacturing the coins and they are sold on numerous websites wtf can they do about it ?

[evoorhees]

Mike - I liked your response to him. Well-written and pretty clever =)

[wallet.dat]

do not relax, we just started playing.

i will be happy to start real work with you untill i will not tired.
there are so many interesting things waiting for you.

but you can pay me to avoid of all this shit. my price today is 300 bitcoins and this is much less than the quality ddos protection and reputation losing during scam. price will grow.

as soon i receive payment i drop off all my scam domains that affected you and will never interfere with your business.

pay here: 1N5E5oqY7JpLCgcqWNjafWXF27Cb33Z4Dq

verify me by TXT record of net domain.

check for example here www.whatsmyip.us/txt <- casascius dot net

I advise you to pay in 3 days.

ROFL WTF, do all these stalkers get their material from the same fill-in-the-blanks template or something?

[casascius]

What I don't get... I've posted significant bounties for development things I'd like to see happen in Bitcoin.

Someone with lots of skills and no idea what to do with them ought to consider implementing some features I think will help bitcoin, like sweepprivkey (as described in Wiki).

[BitcoinPorn]

Well someone is hitting at the right time.  Look Mike, you are on CNET!

http://news.cnet.com/8301-17938_105-20125470-1/are-physical-bitcoins-legal/

Edit: Yesterdays news it seems, just caught it in my news feed though.  You should contact CNET and let them know of your issues regarding this.  See if they want to spin a story on Bitcoin and anonymous attackers.

[deepceleron]

Sounds like it's time to do an ICANN domain dispute or an ACPA expedited domain name dispute, they were hosting your copyrighted material, committing fraud, and now extortion.

In determining whether the domain name registrant has a bad faith intent to profit a court may consider many factors including nine that are outlined in the statute:

-whether the domain name contains the registrant’s legal or common name;
-the registrant’s prior use of the domain name in connection with the bona fide offering of goods or services;
-the registrant’s bona fide noncommercial or fair use of the mark in a site accessible by the domain name;
-the registrant’s intent to divert customers from the mark owner’s online location that could harm the goodwill represented by the mark, for commercial gain or with the intent to tarnish or disparage the mark;
-the registrant’s offer to transfer, sell, or otherwise assign the domain name to the mark owner or a third party for financial gain, without having used the mark in a legitimate site;
-the registrant’s providing misleading false contact information when applying for registration of the domain name;
-the registrant’s registration or acquisition of multiple domain names that are identical or confusingly similar to marks of others; and
the extent to which the mark in the domain is distinctive or famous.[11]

The scammers have now met every requirement. Plus you get to find out their registration info so fellow Russian bitcoiners can go kick them in the nuts.

[mizerydearia]

For reference, this phishing issue first documented here

Well someone is hitting at the right time.  Look Mike, you are on CNET!

http://news.cnet.com/8301-17938_105-20125470-1/are-physical-bitcoins-legal/

Edit: Yesterdays news it seems, just caught it in my news feed though.  You should contact CNET and let them know of your issues regarding this.  See if they want to spin a story on Bitcoin and anonymous attackers.

Do it!

Sounds like it's time to do an ICANN domain dispute or an ACPA expedited domain name dispute, they were hosting your copyrighted material, committing fraud, and now extortion.

In determining whether the domain name registrant has a bad faith intent to profit a court may consider many factors including nine that are outlined in the statute:

-whether the domain name contains the registrant’s legal or common name;
-the registrant’s prior use of the domain name in connection with the bona fide offering of goods or services;
-the registrant’s bona fide noncommercial or fair use of the mark in a site accessible by the domain name;
-the registrant’s intent to divert customers from the mark owner’s online location that could harm the goodwill represented by the mark, for commercial gain or with the intent to tarnish or disparage the mark;
-the registrant’s offer to transfer, sell, or otherwise assign the domain name to the mark owner or a third party for financial gain, without having used the mark in a legitimate site;
-the registrant’s providing misleading false contact information when applying for registration of the domain name;
-the registrant’s registration or acquisition of multiple domain names that are identical or confusingly similar to marks of others; and
the extent to which the mark in the domain is distinctive or famous.[11]

The scammers have now met every requirement. Plus you get to find out their registration info so fellow Russian bitcoiners can go kick them in the nuts.

Do it!

[BitcoinPorn]

casascius, there is definitely some interesting options here.  That CNET idea sounds better the more I think about it.  As you could easily contact a few news sources regarding this.  All the news reports of the big hacking incidents with Bitcoin after the fact, Gox, Mybitcoin, whatever.   This time the news can possibly take care of some of the investigating.   Might expose some flaws in Bitcoin we aren't seeing without that outside perspective being more hands on with what is going on, as they always do seem to report well after things are done, and usually misreported.

[sadpandatech]

For reference, this phishing issue first documented here

Well someone is hitting at the right time.  Look Mike, you are on CNET!

http://news.cnet.com/8301-17938_105-20125470-1/are-physical-bitcoins-legal/

Edit: Yesterdays news it seems, just caught it in my news feed though.  You should contact CNET and let them know of your issues regarding this.  See if they want to spin a story on Bitcoin and anonymous attackers.

Do it!

Sounds like it's time to do an ICANN domain dispute or an ACPA expedited domain name dispute, they were hosting your copyrighted material, committing fraud, and now extortion.

In determining whether the domain name registrant has a bad faith intent to profit a court may consider many factors including nine that are outlined in the statute:

-whether the domain name contains the registrant’s legal or common name;
-the registrant’s prior use of the domain name in connection with the bona fide offering of goods or services;
-the registrant’s bona fide noncommercial or fair use of the mark in a site accessible by the domain name;
-the registrant’s intent to divert customers from the mark owner’s online location that could harm the goodwill represented by the mark, for commercial gain or with the intent to tarnish or disparage the mark;
-the registrant’s offer to transfer, sell, or otherwise assign the domain name to the mark owner or a third party for financial gain, without having used the mark in a legitimate site;
-the registrant’s providing misleading false contact information when applying for registration of the domain name;
-the registrant’s registration or acquisition of multiple domain names that are identical or confusingly similar to marks of others; and
the extent to which the mark in the domain is distinctive or famous.[11]

The scammers have now met every requirement. Plus you get to find out their registration info so fellow Russian bitcoiners can go kick them in the nuts.

Do it!

  +1 +1. But I kinda liked RodeoX's idea as well. ;p

[oOoOo]

do not relax, we just started playing.

i will be happy to start real work with you untill i will not tired.
there are so many interesting things waiting for you.

but you can pay me to avoid of all this shit. my price today is 300 bitcoins and this is much less than the quality ddos protection and reputation losing during scam. price will grow.

(...)

I advise you to pay in 3 days.

It's a bluff. That guy is not able to do anything. Ignore.
.

[tvbcof]

Call me vindictive, but if I got an extortion letter it would inspire me to go on the offensive. Instead of sending him 300BTC, I would pay 600BTC to a very bad man willing to get vengeance for me.
Getting even is one area that I split from logical cost/benefit analysis.   

Revenge does not strike me as illogical from a cost/benefit analysis given that the same scam could happen again and again and end up costing a lot.  But it is something of a slippery slope which could easily land a person in one (or more) of several pools of hot liquid.  Probably best avoided unless one is quite savvy with such things.

A friend of mine who knew a lot about big cats once explained what to me was a mystery about why leopard would risk life and limb to 'get even' with a park ranger who poked him with a stick.  He says that with overlapping ranges, competing animals (hyenas, leopards, etc) will run across the same individual numerous times.  So there is a distinct net benefit to having it be known that a specific individual is not to be fucked with.  I could see such a thing happening in the Bitcoin Serengeti at these early times.

[Bitcoin Oz]

Phishing site shows up hosted at a Russian hosting company, someone starts demanding extortion fees, and all the sudden BitcoinExpress shows up. I may have been born in the day but it wasn't yesterday.

 

[repentance]

do not relax, we just started playing.

i will be happy to start real work with you untill i will not tired.
there are so many interesting things waiting for you.

but you can pay me to avoid of all this shit. my price today is 300 bitcoins and this is much less than the quality ddos protection and reputation losing during scam. price will grow.

(...)

I advise you to pay in 3 days.

It's a bluff. That guy is not able to do anything. Ignore.
.

I'm a bit inclined to agree.  If they had something real up their sleeve and wanted to give you an incentive to pay then they should have given you a demonstration of their ability to attack you directly.  Instead they set up a fake website to scam people - something which requires very little technical ability.

[CA Coins]

Good luck casascius!

This John Smith character is a loser.