[upofadown]

I don't understand how this works from the ransom email given. Anyone could send that email. It is because it is the first email? Otherwise why doesn't absolutely everyone send their own bitcoin address to any entity that seems to be having some sort of problem?

[tyingq]

"I will start 1-2 hours attack on your site."

So it's sent prior to the attack.