What to Do If You Received Sextortion Email: Is It Real?

Sextortion emails have become one of the most prevalent forms of online fraud. If you received one of these threatening messages, your first question is likely whether it’s legitimate or just an elaborate scam. The truth is that the vast majority of these emails are bluffs—criminals relying on fear rather than actual evidence. However, understanding how to verify these claims and protect yourself is essential for any developer or power user.

Understanding Sextortion Email Scams

A typical sextortion email claims that hackers have compromised your device, recorded you visiting adult websites, and threaten to expose your activities unless you pay a ransom—usually in cryptocurrency. These messages often include specific details to appear credible, such as referencing a password you actually use or claiming to have accessed your contact list.

Here’s what a typical sextortion email looks like:

Subject: Your device has been compromised

I know your password is: YourSecretPass123

I infected your operating system with malware through a website you visited.
I have access to your camera and microphone. I recorded you watching adult content.

You have 48 hours to send $2000 in Bitcoin to:
bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh

If you don't pay, I will send this video to all your contacts.

The psychological pressure these emails create is intentional. However, understanding the technical reality behind these claims helps you assess the actual threat level.

Technical Analysis: Why Most Sextortion Emails Are Fake

Passwords Are Often From Data Breaches

When a sextortion email includes one of your passwords, it typically comes from a data breach—not from malware on your device. Services like Have I Been Pwned maintain databases of exposed credentials. Attackers obtain these lists from breached databases and use them to add credibility to their threats.

You can verify if your email has been exposed in breaches:

# Using curl to check Have I Been Pwned API
curl -s "https://haveibeenpwned.com/api/v3/breachedaccount/your@email.com" | jq

If the password matches a breach, it doesn’t mean your device is compromised—it means that service’s database was stolen.

Email Headers Reveal the Truth

Analyzing email headers exposes the actual origin of these messages. Most sextortion emails are sent through compromised email servers, botnets, or legitimate email services that have been abused.

# Extract headers from an email file
grep -E "^(From|To|Subject|Return-Path|Received):" email.txt

Genuine threats will show consistent routing. Scam emails often have mismatched headers, indicatingspoofing. The Return-Path should match the claimed sender’s domain. If it doesn’t, you’re dealing with a forgery.

Checking Domain Reputation

Developers can use command-line tools to analyze the sender’s domain:

# Check domain age and registration details
whois malicious-domain.com

# Check if the IP is on any blocklists
curl -s "https://api.abuseipdb.com/api/v2/check?ipAddress=192.168.1.1" \
 -H "Key: YOUR_API_KEY" -H "Accept: application/json"

Newly registered domains (within days of receiving the email) are strong indicators of scam operations. Legitimate extortion requires time to build credibility—not the opposite.

Verifying Email Authenticity

DKIM, SPF, and DMARC

Legitimate emails include proper authentication headers. Sextortion scammers frequently fail to configure these correctly:

Authentication-Results: mx.google.com;
 dkim=fail header.i=@sender.com header.s=selector1 header.b=ABC123;
 spf=softfail (google.com: domain of threat@malicious.com does not designate 192.0.2.1 as permitted sender) smtp.mailfrom=threat@malicious.com;
 dmarc=fail (p=REJECT sp=REJECT dis=NONE) header.from=sender.com

The dkim=fail and spf=softfail indicate the email likely didn’t originate from the claimed sender. This is a strong technical indicator that the threat is fabricated.

Analyzing Embedded Links

Sextortion emails often include links that appear to lead to evidence but actually direct you to the attacker’s infrastructure or phishing pages:

# Extract and analyze all URLs from an email
grep -oP 'http[s]?://[^"]+' email.txt | while read url; do
 echo "URL: $url"
 curl -sI "$url" | grep -E "^(HTTP|Location)"
 echo "---"
done

Never click these links. Instead, analyze them in a sandboxed environment or use URL analysis services like VirusTotal:

# Check URL with VirusTotal API (requires API key)
curl -s "https://www.virustotal.com/api/v3/urls" \
 -X POST -H "x-apikey: YOUR_VT_API_KEY" \
 -d "url=https://suspicious-link.com"

What To Do If You Receive a Sextortion Email

Immediate Actions

Do not respond or pay: Paying encourages further attacks and marks you as a willing victim.
Document everything: Save the email (including headers), take screenshots, and note the time received.
Check if your credentials were exposed: Use services like Have I Been Pwned to see if your password appears in known breaches. If it does, change that password immediately—preferably using a password manager.
Run a security scan: Use your preferred antivirus or malware scanner to verify your system hasn’t been compromised. For Linux users:

# Basic malware check using rkhunter
sudo rkhunter --check

# Check for suspicious processes
ps aux | grep -vE "^(\+|root|daemon)"

Reporting the Email

Reporting helps authorities track these operations:

FBI IC3: File a complaint at ic3.gov
Local law enforcement: Provide the email and headers
Email provider: Use built-in reporting features in Gmail, Outlook, or your provider’s abuse portal

Prevention Strategies for Developers and Power Users

Email Filtering

Configure spam filtering. For developers using Postfix:

# In /etc/postfix/main.cf - enable advanced filtering
smtpd_client_restrictions = permit_mynetworks, reject_rbl_client zen.spamhaus.org
header_checks = regexp:/etc/postfix/header_checks

Password Hygiene

Use unique passwords for every service. A password manager eliminates the risk of credential reuse:

# Generate a strong password using gpg or openssl
openssl rand -base64 20

Enable two-factor authentication everywhere possible. Even if your password is exposed, 2FA prevents account takeover.

Monitoring Your Digital Footprint

Set up alerts for your email:

# Create a simple monitoring script with Have I Been Pwned
#!/bin/bash
EMAIL="your@email.com"
RESULT=$(curl -s "https://haveibeenpwned.com/api/v3/breachedaccount/$EMAIL")
if [ "$RESULT" != "[]" ]; then
 echo "Breach detected!"
 echo "$RESULT" | jq
fi

Schedule this to run weekly via cron.

Built by theluckystrike — More at zovo.one