GO TO DOXBIN.COM FOR THE FULL PASTE: main
=== COMPLETE DOX – SALWA MOHAMED (IRL NAME) ===
================================================================
[ PERSONAL IDENTITY ] OWNED BY CONER KAY ENCLAVE @coner18 join krownsec https://discord.gg/bd5bfBPan
Full Name: Salwa Mohamed
Age: 15
School: International Academy of Iraq
phone : 07708363318
[ PRIMARY EMAILS ]
- mh5019188@gmail.com
- 1212teeemmoo@gmail.com
[ SECONDARY / ASSOCIATED EMAIL (from same infected device) ]
- ggehhggv@gmail.com
[ IP ADDRESSES (all from OSINT header) ]
- 38.3.229.221
- 204.157.178.181
- 204.157.178.190
- 204.157.178.190 (duplicate as given)
- 204.157.178.36
- 204.157.***.*** (redacted in stealer logs, but falls in same /24)
================================================================
[ BREACH / STEALER LOGS – COMPLETE RAW ENTRIES ]
================================================================
--- For email: 1212teeemmoo@gmail.com ---
OathNet Stealer (ID: 1a9e42eb0d2a2518)
- LOG ID: (not specified in that line, but archive hash given)
- URL: (not specified)
- DOMAIN: com.discord
- USERNAME: 1212teeemmoo@gmail.com
- PASSWORD: temo@@$$temo
- PASSWORD HASH: bef45fd5a53af600cb918991a73ed537f9dffd986f768585038f14919abfc09f
- ARCHIVE HASH: 835340c9b1bc606a96e35df3615f2d2dd56d16cf53b17acc1978ace957675865
- INDEXED AT: 2026-08-11T11:19Z
SeekNow (query: 1212teeemmoo@gmail.com)
- TYPE: email
- MODE: fast
- BREACH COUNT: 0
- STEALER COUNT: 0
- EXTERNAL COUNT: 0
- RESPONSE TIME MS: 466
HudsonRock Email
- OS: Not Found
- IP ADDRESS: 204.157.***.***
- SOURCE: HudsonRock Email
- ORIGIN: external
Stealer Logs (for 1212teeemmoo@gmail.com)
- PASSWORD: temo@@$$temo
- ORIGIN: android-app:com.discord
- EMAIL: 1212teeemmoo@gmail.com
- COLLECTED: 2025-08-29
--- For email: ggehhggv@gmail.com ---
OathNet Stealer (ID: 206c2eba437ca9f6)
- LOG ID: (not given)
- URL: (not given)
- DOMAIN: com.yallatech.yallachat
- USERNAME: ggehhggv@gmail.com
- PASSWORD: yasir12
- PASSWORD HASH: 797ae685be81a93d4e3924a133d2b7e7c0e40880195637329ea8b0305e3beaee
- ARCHIVE HASH: 835340c9b1bc606a96e35df3615f2d2dd56d16cf53b17acc1978ace957675865
- INDEXED AT: 2026-08-11T11:35:19Z
OathNet Stealer (ID: 723d7720b5cadfa3)
- LOG ID: (not given)
- URL: (not given)
- DOMAIN: gta5grand.com
- PATH: (not given)
- USERNAME: ggehhggv@gmail.com
- PASSWORD: yasir1212
- PASSWORD HASH: 4c21c34d54d3e4d7c5df65f9a5ddf008cf2610100de8d1bf0b488603580470d2
- ARCHIVE HASH: 835340c9b1bc606a96e35df3615f2d2dd56d16cf53b17acc1978ace957675865
- INDEXED AT: 2026-08-11T11:35:19Z
OathNet Stealer (ID: d7c90aa46d9f45c1)
- LOG ID: (not given)
- URL: (not given)
- DOMAIN: discord.com
- PATH: (not given)
- USERNAME: ggehhggv@gmail.com
- PASSWORD: yasir1212
- PASSWORD HASH: 4c21c34d54d3e4d7c5df65f9a5ddf008cf2610100de8d1bf0b488603580470d2
- ARCHIVE HASH: 835340c9b1bc606a96e35df3615f2d2dd56d16cf53b17acc1978ace957675865
- INDEXED AT: 2026-08-11T11:35:19Z
OathNet Stealer (ID: e02743c840831479)
- LOG ID: (not given)
- URL: (not given)
- DOMAIN: rockstargames.com
- SUBDOMAIN: signin.rockstargames.com
- PATH: (not given)
- USERNAME: ggehhggv@gmail.com
- PASSWORD: Gasdfgogsg123
- PASSWORD HASH: 4927f57a43868fec4e0529ca05c2682658942e76ed491d9a3da799a1dbe63159
- ARCHIVE HASH: 835340c9b1bc606a96e35df3615f2d2dd56d16cf53b17acc1978ace957675865
- INDEXED AT: 2026-08-11T11:35:19Z
OathNet Stealer (ID: f5b2e3f31975c1a4)
- LOG ID: (not given)
- URL: (not given)
- DOMAIN: rockstargames.com
- SUBDOMAIN: signin.rockstargames.com
- PATH: (not given)
- USERNAME: ggehhggv@gmail.com
- PASSWORD: yasir1212
- PASSWORD HASH: 4c21c34d54d3e4d7c5df65f9a5ddf008cf2610100de8d1bf0b488603580470d2
- ARCHIVE HASH: 835340c9b1bc606a96e35df3615f2d2dd56d16cf53b17acc1978ace957675865
- INDEXED AT: 2026-08-11T11:35:19Z
Stealer Logs (for ggehhggv@gmail.com)
- PASSWORD: yasir12
- ORIGIN: android-app:com.yallatech.yallachat
- EMAIL: ggehhggv@gmail.com
- COLLECTED: 2025-08-29
Stealer Logs (for ggehhggv@gmail.com)
- PASSWORD: yasir1212
- ORIGIN: discord.com, gta5grand.com, signin.rockstargames.com
- EMAIL: ggehhggv@gmail.com
- COLLECTED: 2025-08-29
Stealer Logs (for ggehhggv@gmail.com)
- PASSWORD: Gasdfgogsg123
- ORIGIN: signin.rockstargames.com
- EMAIL: ggehhggv@gmail.com
- COLLECTED: 2025-08-29
SeekNow (query: ggehhggv@gmail.com)
- TYPE: email
- MODE: fast
- BREACH COUNT: 0
- STEALER COUNT: 0
- EXTERNAL COUNT: 0
- RESPONSE TIME MS: 492
HudsonRock Email (for ggehhggv@gmail.com)
- OS: Not Found
- IP ADDRESS: 204.157.***.***
- SOURCE: HudsonRock Email
- ORIGIN: external
SEON (for ggehhggv@gmail.com)
- EMAIL: ggehhggv@gmail.com
- SCORE: 4
- DELIVERABLE: true
Social media checks (for ggehhggv@gmail.com):
- facebook: REGISTERED = false
- flickr: REGISTERED = false
- duolingo: REGISTERED = false
Breach details (for ggehhggv@gmail.com):
- HAVEIBEENPWNED LISTED: false
- NUMBER OF BREACHES: 0
Applied rules (for ggehhggv@gmail.com):
- ID: E117
- NAME: Domain is a free provider. 1 online profile was found. It was not involved in a data breach
- OPERATION: +
- SCORE: 4
================================================================
[ CREDENTIAL 1 – EXPLICIT DISCORD ENTRY ]
Credential 1:
- URL: android://BnX9M66KmaqmzgqWgQxmbrJB_wO0ST53-DUZCnxDdLwf4JAsUtM2kKGudjeBclJFUquAP2JTpypk9qobA6PGMA==@com.discord/
- Username: 1212teeemmoo@gmail.com
- Password: temo@@$$temo
- Domains: com.discord
- Log ID: 7ab9d258ba5d509bd70b3ada84138eebaa6b804ebe3c818aa4948d558da251ea
================================================================
[ INFECTED MACHINES (VICTIMS) – FULL ]
Total Victims: 2
Victim 1:
- Log ID: ac7f544db0a5bc126287c45093e60002b03e83a3ac9a91fba52dd1287c6fbadf
- Device Emails: 1212teeemmoo@gmail.com, ggehhggv@gmail.com
- Total Docs: 2
Victim 2:
- Log ID: 7ab9d258ba5d509bd70b3ada84138eebaa6b804ebe3c818aa4948d558da251ea
- Total Docs: 48
================================================================
[ JSON STEALER BLOB – FULL UNREDACTED FIELDS ]
{
"total_corporate_services": 0,
"total_user_services": 23,
"date_compromised": "2025-08-09T14:46:43.358Z",
"computer_name": "Not Found",
"operating_system": "Not Found",
"malware_path": "Not Found",
"antiviruses": [],
"ip": "204.157.***.***",
"top_passwords": [
"y*******2",
"y*******5",
"Q******3",
"Y*******0",
"y******3"
],
"top_logins": [
"a********@gmail.com",
"0*********5",
"g*******@gmail.com",
"a*****h",
"a******@gmail.com"
]
}
================================================================
[ ALL UNIQUE PASSWORDS EXTRACTED (FULL LIST) ]
- temo@@$$temo
- yasir12
- yasir1212
- Gasdfgogsg123
- yasir123
- yair2020
- Qwert123
- bSLeHHxcj3Z
- hdf4sdfgs
- yasir2015
- Yasir0000
- hdhdhdhdhh
- Qwert1234@
- wc9_7gCaM3Twn?@
- Qwert2020
- Yasir1212
- MA12345M
- Qwert543
- Qwert1234
- 07733912447ADNaN0773
- yasir123@
- yasir2015@
- asdfgogsg (seen in variations)
- yildiz
- yasir1212@# (listed as one)
- (plus the top_passwords redacted patterns: y*******2, y*******5, Q******3, Y*******0, y******3)
================================================================
[ ASSOCIATED NAMES / OTHER ACCOUNTS IN SAME LOGS ]
- Almas (almas20122007@gmail.com)
- Jeanne Frank (jeannefrank.li.n.2.7.2.0.5@gmail.com)
- Kenan Elgretly (kenanelgretly@gmail.com, kenanelgretlyacademy@gmail.com)
- Lam (lam62693@gmail.com)
- Yazid Elgretly (yazidelgretly2020@gmail.com, yazidelgretly@gmail.com)
================================================================
[ ADDITIONAL PASSWORDS FROM BOTTOM LIST (raw) ]
yildiz
yasir123
yair2020
yasir1212
Qwert123
bSLeHHxcj3Z
yasir12
hdf4sdfgs
temo@@$$temo
asdfgogsg
yasir2015
Yasir0000
yasir1212@#
hdhdhdhdhh
Qwert1234@
wc9_7gCaM3Twn?@
Qwert2020
Yasir1212
MA12345M
Qwert543
Qwert1234
07733912447ADNaN0773
yasir123@
yasir2015@
Gasdfgogsg123
================================================================
[ TIMESTAMP SUMMARY ]
- Earliest compromise: 2025-08-09 (JSON date_compromised)
- Stealer collection dates: 2025-08-29 (Discord, YallaChat, etc.)
- Indexed in OathNet: 2026-08-11 (multiple times)
- Archive hash (consistent across logs): 835340c9b1bc606a96e35df3615f2d2dd56d16cf53b17acc1978ace957675865
================================================================
[ NOTES ]
- The primary victim is Salwa Mohamed. Her main compromised account is Discord with password temo@@$$temo.
- The second email (ggehhggv@gmail.com) shares the same infected device (Victim 1) – treat as same household/device.
- All passwords are reusable for credential stuffing against any platform using these emails.
- No corporate services breached – only personal (23 user services).
- IPs point to a single /24 range – likely mobile/CGNAT, not geolocation specific.
new paste
copy
fork
guide
author
anonymous
views
15
hastebin.ianhon.com/27dc pass Kay coner enclave