"Exposing Protonmail and Tutanota's Illicit Abuse by Ransomware Gangs - A Compilation of Currently Active Ransomware-Themed Email Addresses - Part Two

October 04, 2021

Dear blog readers,

This is Dancho and I've decided to share a recently obtained portfolio of Protonmail ransomware themed email address accounts with the idea to attempt to take them offline potentially causing financial and related troubles to the individuals involved in these campaigns.

Sample currently active Protonmail ransomware themed email address accounts known to have been involved in related fraudulent and malicious campaigns:

05250lock@protonmail.com
0x1service@protonmail.com
1_kill_yourself_1@protonmail.com
1rest0re@protonmail.com
2020x0@protonmail.com
4lok3r@protonmail.com
AbbsChevis@protonmail.com
AdvancedBackup@protonmail.com
BTCBREWERY@protonmail.com
BackFileHelp@protonmail.com
Bossi_tosi@protonmail.com
Brilliancebk@protonmail.com
Catsexy@protonmail.com
Corpseworm@protonmail.com
CottleAkela@protonmail.com
Cryptmanager@protonmail.com
Datarest0re@protonmail.com
DavidsHelper@protonmail.com
Deccoder431@protonmail.com
DecrypterSupport@protonmail.com
Decryptharma@protonmail.com
Decryptions@protonmail.com
Decryptutility@protonmail.com
DharmaParrack@protonmail.com
DiskDoctor@protonmail.com
Dsupport@protonmail.com
EMAIL@protonmail.com
Encryptedxtredboy@protonmail.com
F-data@protonmail.com
Filedecryptor@protonmail.com
Filegorilla1388@protonmail.com
FilesRecoverEN@Protonmail.com
Folieloi@protonmail.com
FreeWizard9@protonmail.com
GetYourFilesBack@protonmail.com
Hichkasam@protonmail.com
Honeylock@protonmail.com
HydraHelp1@protonmail.com
Jack76Duran@protonmail.com
JeanRenoAParis@protonmail.com
JinMaglaya@protonmail.com
JoniCarter@protonmail.com
Keta990@protonmail.com
Killback@protonmail.com
Kromber@protonmail.com
Leviathan13@protonmail.com
Lizardbkup@protonmail.com
Look1213@protonmail.com
Mammon-decrypt@protonmail.com
MayarChenot@protonmail.com
MerlinStusan@protonmail.com
MerlinVelso@protonmail.com
Mespinoza980@protonmail.com
MilesFlannagan@protonmail.com
Mr.TeslaBrain@protonmail.com
NetGanster@protonmail.com
Oktropys@protonmail.com
Openfileyou@protonmail.com
PabFox@protonmail.com
Panzergen552@protonmail.com
Pentagon11@protonmail.com
PhanthavongsaNeveyah@protonmail.com
Pringls_us@protonmail.com
Quantroei@protonmail.com
RECOVERUNKNOWN@protonmail.com
Recoverybat@protonmail.com
Recoveryhelp2019@protonmail.com
Recuperadados@protonmail.com
RemotePChelper@protonmail.com
RomanchukEyla@protonmail.com
SafeGman@protonmail.com
Santa_helper@protonmail.com
SayanWalsworth96@protonmail.com
SchreiberEleonora@protonmail.com
ScorpionEncryption@protonmail.com
SpadeEncrypt@protonmail.com
Steven77xx@protonmail.com
SupportOdveta@protonmail.com
SuzuMcpherson@protonmail.com
Tbr66@protonmail.com
TentwenUpper1@protonmail.com
TimisoaraHackerTeam@protonmail.com
TimothyCrabtree@protonmail.com
Tizer77234@protonmail.com
Unlock11@protonmail.com
UnlockAlexKingman@protonmail.com
Vitaly.Yermakov@protonmail.com
VoidFiles@protonmail.com
Wecanhelp@protonmail.com
William_Kidd_2019@protonmail.com
X280@protonmail.com
Xtredboy@protonmail.com
aam_sysadmin@protonmail.com
achtung_admin@protonmail.com
admincrypt@protonmail.com
agent.dmr@protonmail.com
aid.keepcalm@protonmail.com
andrey.taranov@protonmail.com
anna.kurtz@protonmail.com
anon4113@protonmail.com
anonymoushacks33@protonmail.com
aperfectday2018@protonmail.com
apoyo2019@protonmail.com
artemy75@protonmail.com
askhelp@protonmail.com
asmodey3301@protonmail.com
aztecdecrypt@protonmail.com
backinfo@protonmail.com
backuppc1@protonmail.com
backuppc@protonmail.com
bakfiles@protonmail.com
barracudahelp@protonmail.com
batary5588@protonmail.com
bbitcrypt@protonmail.com
billwong73@protonmail.com
bit_decrypt@protonmail.com
bitsupportz@protonmail.com
blackheel@protonmail.com
blackroot54@protonmail.com
brian.r.goodwin@protonmail.com
bronmerkberpa1976@protonmail.com
bsprj1020@protonmail.com
btc_bitts@protonmail.com
btcontact@protonmail.com
callmegoat@protonmail.com
cashdashsentme@protonmail.com
castor-troy-restore@protonmail.com
cheet0s_de@protonmail.com
cleverhorse@protonmail.com
com-gloria@protonmail.com
crioso@protonmail.com
cryptgh0st@protonmail.com
crypto_wannacash@protonmail.com
cryptofiles20202020@protonmail.com
cryptomadbusiness@protonmail.com
cryptoplant@protonmail.com
cyber.duskfly@protonmail.com
cynthia-it@protonmail.com
data1992@protonmail.com
databack2@protonmail.com
dawndec001@protonmail.com
dec.service@protonmail.com
decodeodveta@protonmail.com
decoderma@protonmail.com
decphob@protonmail.com
decrypt.russ@protonmail.com
decrypt24@protonmail.com
decrypt4data@protonmail.com
decrypterfile@protonmail.com
decryptmystuff@protonmail.com
decryptxxx@protonmail.com
deltatechit@protonmail.com
devilguy666@protonmail.com
dresdent@protonmail.com
duskeer@protonmail.com
egalytyy@protonmail.com
eladovin1975@protonmail.com
encryptc4@protonmail.com
encryptfile@protonmail.com
fahydremu1981@protonmail.com
fairman0023@protonmail.com
fileb@protonmail.com
filedownload2020@protonmail.com
files2@protonmail.com
filesreturn247@protonmail.com
flapalinta1950@protonmail.com
flopored@protonmail.com
flower.harris@protonmail.com
flowerboard@protonmail.com
fox2278@protonmail.com
freefoams@protonmail.com
friends2019@protonmail.com
g.kulahmet@protonmail.com
gareth.mckie3l@protonmail.com
geneve010@protonmail.com
geneve020@protonmail.com
getscoin2@protonmail.com
getscoin3@protonmail.com
getyourdata@protonmail.com
guaranteedsupport@protonmail.com
haunexuwofwuf@protonmail.com
help.me24@protonmail.com
help73@protonmail.com
helpadmin2@protonmail.com
helpdiamond@protonmail.com
helpnetin@protonmail.com
helpteam38@protonmail.com
helpyourdesk11@protonmail.com
hidebak@protonmail.com
hjelp.main@protonmail.com
honestman0023@protonmail.com
ialpatntedu@protonmail.com
imBoristheBlade@protonmail.com
incognitoman@protonmail.com
incongnitoman@protonmail.com
ivanmalahov@protonmail.com
j0ra@protonmail.com
jackiesmith176@protonmail.com
johnsonwhate@protonmail.com
jokeroo@protonmail.com
jonskuper578@protonmail.com
keepcredit015@protonmail.com
keychild@protonmail.com
khalate@protonmail.com
khfsuca@protonmail.com
kickclakus@protonmail.com
koxic@protonmail.com
lion7872@protonmail.com
loybranunun1975@protonmail.com
lucky_top@protonmail.com
lxhlp@protonmail.com
m4xroothackerteam@protonmail.com
maill_helpme@protonmail.com
mammon0503@protonmail.com
mantiticvi1976@protonmail.com
mattpear@protonmail.com
maxidecrypt@protonmail.com
missdecryptor@protonmail.com
momsbestfriend@protonmail.com
mr.crypteur@protonmail.com
mr.dec@protonmail.com
mrbin775@protonmail.com
nAskHelp@protonmail.com
nDiskDoctor@protonmail.com
nHydraHelp1@protonmail.com
nRecoverybat@protonmail.com
nationalsiense@protonmail.com
newneo1312@protonmail.com
nohopeproject@protonmail.com
nostro19@protonmail.com
oceannew_vb@protonmail.com
omegax0@protonmail.com
onepconebtc@protonmail.com
onimransom@protonmail.com
ooosferaplus@protonmail.com
pacman.support@protonmail.com
painplain98@protonmail.com
panda7499@protonmail.com
patern32@protonmail.com
pentaxyz777@protonmail.com
pentros30@protonmail.com
petersburgrecover@protonmail.com
petrov441@protonmail.com
pizdasobaki@protonmail.com
po2977@protonmail.com
pyyring23@protonmail.com
qkhooks0708@protonmail.com
raingemaximo@protonmail.com
raynorzlol@protonmail.com
rdpconnect@protonmail.com
rebushelp@protonmail.com
recfiles@protonmail.com
recover85@protonmail.com
recover_24_7@protonmail.com
recoverycode@protonmail.com
recoverysql@protonmail.com
rep_stosd@protonmail.com
reservedecryption@protonmail.com
ripntfs@protonmail.com
rusoftfond@protonmail.com
s1an1er111@protonmail.com
sailormorgan@protonmail.com
salutem@protonmail.com
savemyfiles@protonmail.com
securityit123@protonmail.com
servicedeskpay@protonmail.com
shellexec@protonmail.com
siniyzabor@protonmail.com
soft.russian@protonmail.com
softs98@protonmail.com
sp00f3rsupp0rt@protonmail.com
sp02@protonmail.com
spacexhuman@protonmail.com
support4you@protonmail.com
support_blackkingdom2@protonmail.com
supportcrypt2019@protonmail.com
t310ea89b4347@protonmail.com
teamvi@protonmail.com
teamvv@protonmail.com
tellyouthepass@protonmail.com
the.dodger@protonmail.com
tomascry@protonmail.com
trees.jpg.bepabepababy1@protonmail.com
tuhafcoderus@protonmail.com
unibovwood1984@protonmail.com
unlock0101@protonmail.com
unlockme123@protonmail.com
unlockransomware@protonmail.com
upfileme@protonmail.com
use_harrd@protonmail.com
vashmail@protonmail.com
vendetta553@protonmail.com
villiamsscorj_rembly@protonmail.com
vine77725@protonmail.com
virtualhorse1@protonmail.com
vurten_knyert@protonmail.com
wayneevenson@protonmail.com
werichbin@protonmail.com
worldofdonkeys@protonmail.com
xersami@protonmail.com
youneedmail@protonmail.com
zagrec@protonmail.com
zorab28@protonmail.com
zoye596@protonmail.com

Sample currently active Protonmail ransomware themed email address accounts known to have been involved in related fraudulent and malicious campaigns include:

getscoin3@protonmail.com
mstr.hack@protonmail.com
stevemartin777@protonmail.com
Benford333@protonmail.com
nBenford333@protonmail.com
fortihooks@protonmail.com
nfortihooks@protonmail.com
thecurelegion@protonmail.com
support981723721@protonmail.com
sifremicoz@protonmail.com
yourfile2020@protonmail.com
Catsexy@protonmail.com
Recuperadados@protonmail.com
youneedmail@protonmail.com
Decryptutility@protonmail.com
MerlinStusan@protonmail.com
Tizer77234@protonmail.com
recfiles@protonmail.com
mr.dec@protonmail.com
JoniCarter@protonmail.com
servicedeskpay@protonmail.com
castor-troy-restore@protonmail.com
Mammon-decrypt@protonmail.com
wayneevenson@protonmail.com
incongnitoman@protonmail.com
Santa_helper@protonmail.com
F-data@protonmail.com
decryptxxx@protonmail.com
Mespinoza980@protonmail.com
backinfo@protonmail.com
rdpconnect@protonmail.com
tomascry@protonmail.com
loybranunun1975@protonmail.com
securityit123@protonmail.com
ripntfs@protonmail.com
khfsuca@protonmail.com
getscoin2@protonmail.com
zagrec@protonmail.com
teamvv@protonmail.com
databack2@protonmail.com
lxhlp@protonmail.com
teamvi@protonmail.com
onepconebtc@protonmail.com
bit_decrypt@protonmail.com
help.me24@protonmail.com
mr.crypteur@protonmail.com
recoverysql@protonmail.com
anna.kurtz@protonmail.com
agent.dmr@protonmail.com
painplain98@protonmail.com
askhelp@protonmail.com
AstraRansomware@protonmail.com
blackheel@protonmail.com
btcontact@protonmail.com
HydraHelp1@protonmail.com
mammon0503@protonmail.com
PabFox@protonmail.com
Jack76Duran@protonmail.com
RemotePChelper@protonmail.com
Recoverybat@protonmail.com
Brilliancebk@protonmail.com
Deccoder431@protonmail.com
Lizardbkup@protonmail.com
Xtredboy@protonmail.com
TimothyCrabtree@protonmail.com
cheet0s_de@protonmail.com
Pringls_us@protonmail.com
crioso@protonmail.com
GetYourFilesBack@protonmail.com
Kelly.lb@protonmail.com
nRecoverybat@protonmail.com
nAskHelp@protonmail.com
jackiesmith176@protonmail.com
nohopeproject@protonmail.com
salutem@protonmail.com
ivanmalahov@protonmail.com
ooosferaplus@protonmail.com
rusoftfond@protonmail.com
andrey.taranov@protonmail.com
g.kulahmet@protonmail.com
soft.russian@protonmail.com
momsbestfriend@protonmail.com
the.dodger@protonmail.com
j0ra@protonmail.com
sp00f3rsupp0rt@protonmail.com
shellexec@protonmail.com
rep_stosd@protonmail.com
support4you@protonmail.com
devilguy666@protonmail.com
batary5588@protonmail.com
Panzergen552@protonmail.com
vendetta553@protonmail.com
Filegorilla1388@protonmail.com
vine77725@protonmail.com
panda7499@protonmail.com
jonskuper578@protonmail.com
fox2278@protonmail.com
lion7872@protonmail.com
filesreturn247@protonmail.com
s1an1er111@protonmail.com
mrbin775@protonmail.com
decryptmystuff@protonmail.com
oceannew_vb@protonmail.com
decrypt24@protonmail.com
Wecanhelp@protonmail.com
hidebak@protonmail.com
com-gloria@protonmail.com
fileb@protonmail.com
upfileme@protonmail.com
helpteam38@protonmail.com
William_Kidd_2019@protonmail.com
cleverhorse@protonmail.com
Keta990@protonmail.com
supportcrypt2019@protonmail.com
zoye596@protonmail.com
Quantroei@protonmail.com
sailormorgan@protonmail.com
raynorzlol@protonmail.com
friends2019@protonmail.com
worldofdonkeys@protonmail.com
bbitcrypt@protonmail.com
files2@protonmail.com
patern32@protonmail.com
kickclakus@protonmail.com
Admincrypt@protonmail.com
decrypt4data@protonmail.com
lucky_top@protonmail.com
apoyo2019@protonmail.com
werichbin@protonmail.com
cynthia-it@protonmail.com
deltatechit@protonmail.com
2020x0@protonmail.com
decphob@protonmail.com
DavidsHelper@protonmail.com
spacexhuman@protonmail.com
recoverycode@protonmail.com
pyyring23@protonmail.com
virtualhorse1@protonmail.com
use_harrd@protonmail.com
helpyourdesk11@protonmail.com
maxidecrypt@protonmail.com
JeanRenoAParis@protonmail.com
Leviathan13@protonmail.com
brian.r.goodwin@protonmail.com
imBoristheBlade@protonmail.com
johnsonwhate@protonmail.com
1rest0re@protonmail.com
aid.keepcalm@protonmail.com
rebushelp@protonmail.com
cryptgh0st@protonmail.com
backuppc@protonmail.com
backuppc1@protonmail.com
TimisoaraHackerTeam@protonmail.com
m4xroothackerteam@protonmail.com
Vitaly.Yermakov@protonmail.com
UnlockAlexKingman@protonmail.com
barracudahelp@protonmail.com
crypto_wannacash@protonmail.com
help73@protonmail.com
petrov441@protonmail.com
MilesFlannagan@protonmail.com
dec.service@protonmail.com
incognitoman@protonmail.com
siniyzabor@protonmail.com
recover_24_7@protonmail.com
achtung_admin@protonmail.com
aam_sysadmin@protonmail.com
helpadmin2@protonmail.com
CottleAkela@protonmail.com
AbbsChevis@protonmail.com
JinMaglaya@protonmail.com
SuzuMcpherson@protonmail.com
DharmaParrack@protonmail.com
MayarChenot@protonmail.com
PhanthavongsaNeveyah@protonmail.com
RomanchukEyla@protonmail.com
SayanWalsworth96@protonmail.com
SchreiberEleonora@protonmail.com
artemy75@protonmail.com
jokeroo@protonmail.com
tellyouthepass@protonmail.com
BackFileHelp@protonmail.com
RECOVERUNKNOWN@protonmail.com
DecrypterSupport@protonmail.com
unlockme123@protonmail.com
Decryptions@protonmail.com
ScorpionEncryption@protonmail.com
Steven77xx@protonmail.com
Datarest0re@protonmail.com
Recoveryhelp2019@protonmail.com
blackroot54@protonmail.com
Mr.TeslaBrain@protonmail.com
filedownload2020@protonmail.com
Honeylock@protonmail.com
AdvancedBackup@protonmail.com
recover85@protonmail.com
unlock0101@protonmail.com
SupportOdveta@protonmail.com
softs98@protonmail.com
vashmail@protonmail.com
Filedecryptor@protonmail.com
decodeodveta@protonmail.com
t310ea89b4347@protonmail.com
cryptomadbusiness@protonmail.com
FreeWizard9@protonmail.com
omegax0@protonmail.com
flower.harris@protonmail.com
flowerboard@protonmail.com
X280@protonmail.com
decrypt.russ@protonmail.com
petersburgrecover@protonmail.com
dawndec001@protonmail.com
lafoievologjanin123@protonmail.com
mantiticvi1976@protonmail.com
fahydremu1981@protonmail.com
flapalinta1950@protonmail.com
xersami@protonmail.com
cheot0s_de@protonmail.com
puljaipopre1981@protonmail.com
viomukinam1978@protonmail.com
onlinebigbrotheriswatchingyou@protonmail.com
msupport2019@protonmail.com
BruceCohn88@protonmail.com
runlocker@protonmail.com
yesbay@protonmail.com
helpoperator2@protonmail.com
05250lock@protonmail.com
tuhafcoderus@protonmail.com
support_blackkingdom2@protonmail.com
Bossi_tosi@protonmail.com
maill_helpme@protonmail.com
newneo1312@protonmail.com
bitsupportz@protonmail.com
asmodey3301@protonmail.com
btc_bitts@protonmail.com
reservedecryption@protonmail.com
po2977@protonmail.com
Tbr66@protonmail.com
Encryptedxtredboy@protonmail.com
Hichkasam@protonmail.com
helpdiamond@protonmail.com
encryptc4@protonmail.com
decoderma@protonmail.com
missdecryptor@protonmail.com
VoidFiles@protonmail.com
Pentagon11@protonmail.com
guaranteedsupport@protonmail.com
decrypterfile@protonmail.com
encryptfile@protonmail.com
SpadeEncrypt@protonmail.com
Openfileyou@protonmail.com
zorab28@protonmail.com
4lok3r@protonmail.com
keepcredit015@protonmail.com
honestman0023@protonmail.com
fairman0023@protonmail.com
geneve010@protonmail.com
geneve020@protonmail.com
haunexuwofwuf@protonmail.com
cyber.duskfly@protonmail.com
duskeer@protonmail.com
anon4113@protonmail.com
egalytyy@protonmail.com
onimransom@protonmail.com
FilesRecoverEN@Protonmail.com
nationalsiense@protonmail.com
freefoams@protonmail.com
1_kill_yourself_1@protonmail.com
Look1213@protonmail.com
bronmerkberpa1976@protonmail.com
BTCBREWERY@protonmail.com
data1992@protonmail.com
pentros30@protonmail.com
pentaxyz777@protonmail.com
TentwenUpper1@protonmail.com
DiskDoctor@protonmail.com
ialpatntedu@protonmail.com
cryptofiles20202020@protonmail.com
pacman.support@protonmail.com
nDiskDoctor@protonmail.com
vurten_knyert@protonmail.com
Dsupport@protonmail.com
SafeGman@protonmail.com
aztecdecrypt@protonmail.com
pizdasobaki@protonmail.com
cryptoplant@protonmail.com
callmegoat@protonmail.com
NetGanster@protonmail.com
dresdent@protonmail.com
eladovin1975@protonmail.com
cashdashsentme@protonmail.com
Cryptmanager@protonmail.com
Corpseworm@protonmail.com
trees.jpg.bepabepababy1@protonmail.com
MerlinVelso@protonmail.com
0x1service@protonmail.com
Unlock11@protonmail.com
qkhooks0708@protonmail.com
Kromber@protonmail.com
raingemaximo@protonmail.com
gareth.mckie3l@protonmail.com
aperfectday2018@protonmail.com
bakfiles@protonmail.com
frosculandra1975@protonmail.com
trafyralhi1988@protonmail.com
sanctornopul1986@protonmail.com
ringpawslanin1984@protonmail.com
liebupneoplan19@protonmail.com
stivobemun1979@protonmail.com
guifullcharti1970@protonmail.com
phrasitliter1981@protonmail.com
elsleepamlen1988@protonmail.com
southbvilolor1973@protonmail.com
glocadboysun1978@protonmail.com
carbedispgret1983@protonmail.com
listun@protonmail.com
mirtum@protonmail.com
maxgary777@protonmail.com
ranosfinger@protonmail.com
bootsdurslecne1976@protonmail.com
rinmayturly1972@protonmail.com
niggchiphoter1974@protonmail.com
lebssickronne1982@protonmail.com
daybayriki1970@protonmail.com
southbvillor1973@protonmail.com
bottesdurslecne1976@protonmail.com
unlockransomware@protonmail.com
fahidremu1981@protonmail.com
neybvilolor1973@protonmail.com
frasesitliter1981@protonmail.com
getyourdata@protonmail.com
nostro19@protonmail.com
RestoreFile@protonmail.com

Stay tuned!

About the author

Dancho Danchev is the world's leading expert in the field of cybercrime fighting and threat intelligence gathering having actively pioneered his own methodlogy for processing threat intelligence leading to a successful set of hundreas of high-quality anaysis and research articles published at the industry's leading threat intelligence blog - ZDNet's Zero Day, Dancho Danchev's Mind Streams of Information Security Knowledge and Webroot's Threat Blog with his research featured in Techmeme, ZDNet, CNN, PCWorld, SCMagazine, TheRegister, NYTimes, CNET, ComputerWorld, H+Magazine currently producing threat intelligence at the industry's leading threat intelligence blog - Dancho Danchev's - Mind Streams of Information Security Knowledge. With his research featured at RSA Europe, CyberCamp, InfoSec, GCHQ and Interpol the researcher continues to actively produce threat intelligence at the industry's leading threat intelligence blog - Dancho Danchev's - Mind Streams of Information Security Knowledge publishing a diverse set of hundreds of high-quality research analysis detailing the malicious and fraudulent activities at nation-state and malicious actors across the globe.