LSI Evidence Generator

Klik tab di bawah untuk melihat bukti, lalu Screenshot (Win+Shift+S)
Gmail
Kotak Masuk 1
Berbintang
Ditunda
Terkirim

URGENT: Suspend Notice - Tagihan Colocation Server Tertunggak Kotak Masuk x

B
Billing Support <billing@indonesia-datacenter-support.com> Rab, 10 Des 2025, 09:00 (2 hari yang lalu)
kepada saya

Yth. Admin Finance PT ADS Cloud,

Sistem penagihan otomatis kami mendeteksi bahwa invoice untuk layanan Rack Colocation Server (Rack A-12) periode November 2025 belum dibayarkan hingga batas waktu (jatuh tempo).

PERINGATAN: Layanan server fisik Anda akan dinonaktifkan (Power Down) secara otomatis dalam waktu 2 jam sejak email ini dikirim jika pembayaran tidak diterima.

Mohon segera unduh detail tagihan dan lakukan pembayaran melalui Virtual Account yang terlampir pada dokumen di bawah ini.

Hormat kami,
Billing Team - Indonesia Data Center
Cyber Building 2, Jakarta Selatan.

1 Lampiran • Dipindai dengan Gmail
PDF
Invoice_Desember_Tagihan.pdf.exe
458 KB
Downloads
This PC > Downloads
Search Downloads
Quick access
Desktop
Downloads
Documents
Pictures
Name Date modified Type Size
Invoice_Desember_Tagihan.pdf.exe 10/12/2025 09:05 Application 458 KB
Laporan_Keuangan_Nov.xlsx 01/12/2025 14:20 Excel Worksheet 24 KB
Wireshark - Network Traffic Capture (Simulated)
No. Time Source Destination Protocol Length Info
1420 09:05:10.124 192.168.1.15 172.217.194.1 TLSv1.3 512 Client Hello (Download Request)
1421 09:10:05.552 192.168.1.15 10.0.0.5 SMB2 1042 Tree Connect Request Tree: \\FILESERVER\DataPelanggan
1455 09:15:02.881 192.168.1.15 185.204.1.5 (RU) HTTP 1460 POST /api/upload_keys [C2 Communication Detected]
1456 09:15:02.990 185.204.1.5 192.168.1.15 HTTP 200 HTTP/1.1 200 OK (Key Received)
Frame 1455: 1460 bytes on wire (11680 bits), 1460 bytes captured (11680 bits)
Ethernet II, Src: Dell_a1:b2:c3 (00:14:22:a1:b2:c3), Dst: Gateway_1 (00:50:56:c0:00:01)
Internet Protocol Version 4, Src: 192.168.1.15, Dst: 185.204.1.5
Transmission Control Protocol, Src Port: 49210, Dst Port: 80, Seq: 1, Ack: 1, Len: 1406
Hypertext Transfer Protocol
    POST /api/upload_keys HTTP/1.1\r\n

All your files are encrypted!

Don't worry, you can return all your files!

All your documents, databases, and other important files have been encrypted with a strong encryption key generated for this computer.

> Identification: PT ADS CLOUD SERVER

> Ransomware: LockBit 3.0

> Time Left: 23:59:12

Send 1.5 BTC to this address to get the decryption key:

bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh