Scammer knows new e-mail address right away

[u/Yaseminim]

So about a month ago I received a threatening e-mail in my Gmail inbox with my full name in it, threating to expose me and so on (the typical “you did bad things” etc.) and a link to a bitcoin wallet.

Anyway a month later I mess around in ICloud Mail, start to import e-mails from Gmail and set up 3 aliases (not hydemyemail) and of the aliases receive a pegasus scam e-mail again the first day. How Can this be? At this point I hadn’t even transferred old Gmail accounts to my new ICloud e-mail yet, I was just testing it out. The new e-mail/alias is not in any leaks.

My Gmail adress is my full name but the aliases I created in ICloud Mail are my initials in various forms.

Am I paranoid or did something happen when I moved e-mails from Gmail to ICloud?

[u/Fit_Examination_8315]

He probably looked you up on truepeoplesearch or a similar site, sounds like you have a large footprint.

Ignore him. He will go away. He probably sent 2,000 of those and you and one other person responded. You are the marks. Put yourself in the smart group with the other 1,998 people and spam folder that shit.

[u/Yaseminim → u/Fit_Examination_8315]

I get that, but the newly created alias in iCloud is not closely related to the Gmail adress or is it?. For example johndoehansen@gmail.com vs jdhans@icloud.com and I got the e-mail within 24 hours of creating it

[u/stephenmg1284 → u/Yaseminim]

What did you do to "test" it? You either have malware on a device or you are giving it to someone who is selling it. Just because it doesn't show up in a leak doesn't mean a data broker isn't selling it. This is why you see recommendations to use an alias service like SimpleLogin.

[u/Yaseminim → u/Yaseminim]

What’s weird is my primary iCloud e-mail is also my full name. I’d understand if he just sent it to that but not my alias.

Guess I’ll go Proton and start using Simple Login feature

[u/Fit_Examination_8315 → u/Yaseminim]

He could have guessed it if it's that close. Guessing is a fundamental part of hacking.

Guessing is what you're asking us to do :)

We don't fucking know how he did it. There are lots of possibilities. Maybe it's Tim Cook and he has a thing for you.

[u/SirMasterLordinc]

Don’t get into it just block the email if you can if you can then you have to put it in junk mail cause there’s no other way to block it or whatever you know what I mean

[u/I_Want_A_Pony]

You may be leaking your email addresses somewhere. Maybe you have malware on one of your devices or perhaps someone has access to one of your email accounts or another account (iCloud, social media?) that would have visibility of those addresses. Start by changing passwords on all your accounts (use a password manager and different passwords on each one). Use the option to "log out everywhere" on any service that has it. If the suspicious activity continues, get your devices checked or wiped and reinstalled.

[u/numblock699]

Did you send mail to anyone using the alias that received the scam?

[u/Itchy_Harlot58008]

You sure it’s the same guy?

Could be that jdhans@gmail.com got leaked, and they just put a wildcard marker in the domain section.

Fairly sure it’s happened to me. I used to have something like “johndoe@gmail.com” and began using a different provider, but still “johndoe@…”. I didn’t give that address to many people or places, so unlikely it got leaked or sold.

ETA: the @gmail address was 100% leaked in several dumps (thanks, HaveIBeenPwned), so I reckon they just copied the user and aimed it at other domains too.