main === COMPLETE DOX – SALWA MOHAMED (IRL NAME) === ================================================================ [ PERSONAL IDENTITY ] OWNED BY CONER KAY ENCLAVE @coner18 join krownsec https://discord.gg/bd5bfBPan Full Name: Salwa Mohamed Age: 15 School: International Academy of Iraq phone : 07708363318 [ PRIMARY EMAILS ] - mh5019188@gmail.com - 1212teeemmoo@gmail.com [ SECONDARY / ASSOCIATED EMAIL (from same infected device) ] - ggehhggv@gmail.com [ IP ADDRESSES (all from OSINT header) ] - 38.3.229.221 - 204.157.178.181 - 204.157.178.190 - 204.157.178.190 (duplicate as given) - 204.157.178.36 - 204.157.***.*** (redacted in stealer logs, but falls in same /24) ================================================================ [ BREACH / STEALER LOGS – COMPLETE RAW ENTRIES ] ================================================================ --- For email: 1212teeemmoo@gmail.com --- OathNet Stealer (ID: 1a9e42eb0d2a2518) - LOG ID: (not specified in that line, but archive hash given) - URL: (not specified) - DOMAIN: com.discord - USERNAME: 1212teeemmoo@gmail.com - PASSWORD: temo@@$$temo - PASSWORD HASH: bef45fd5a53af600cb918991a73ed537f9dffd986f768585038f14919abfc09f - ARCHIVE HASH: 835340c9b1bc606a96e35df3615f2d2dd56d16cf53b17acc1978ace957675865 - INDEXED AT: 2026-08-11T11:19Z SeekNow (query: 1212teeemmoo@gmail.com) - TYPE: email - MODE: fast - BREACH COUNT: 0 - STEALER COUNT: 0 - EXTERNAL COUNT: 0 - RESPONSE TIME MS: 466 HudsonRock Email - OS: Not Found - IP ADDRESS: 204.157.***.*** - SOURCE: HudsonRock Email - ORIGIN: external Stealer Logs (for 1212teeemmoo@gmail.com) - PASSWORD: temo@@$$temo - ORIGIN: android-app:com.discord - EMAIL: 1212teeemmoo@gmail.com - COLLECTED: 2025-08-29 --- For email: ggehhggv@gmail.com --- OathNet Stealer (ID: 206c2eba437ca9f6) - LOG ID: (not given) - URL: (not given) - DOMAIN: com.yallatech.yallachat - USERNAME: ggehhggv@gmail.com - PASSWORD: yasir12 - PASSWORD HASH: 797ae685be81a93d4e3924a133d2b7e7c0e40880195637329ea8b0305e3beaee - ARCHIVE HASH: 835340c9b1bc606a96e35df3615f2d2dd56d16cf53b17acc1978ace957675865 - INDEXED AT: 2026-08-11T11:35:19Z OathNet Stealer (ID: 723d7720b5cadfa3) - LOG ID: (not given) - URL: (not given) - DOMAIN: gta5grand.com - PATH: (not given) - USERNAME: ggehhggv@gmail.com - PASSWORD: yasir1212 - PASSWORD HASH: 4c21c34d54d3e4d7c5df65f9a5ddf008cf2610100de8d1bf0b488603580470d2 - ARCHIVE HASH: 835340c9b1bc606a96e35df3615f2d2dd56d16cf53b17acc1978ace957675865 - INDEXED AT: 2026-08-11T11:35:19Z OathNet Stealer (ID: d7c90aa46d9f45c1) - LOG ID: (not given) - URL: (not given) - DOMAIN: discord.com - PATH: (not given) - USERNAME: ggehhggv@gmail.com - PASSWORD: yasir1212 - PASSWORD HASH: 4c21c34d54d3e4d7c5df65f9a5ddf008cf2610100de8d1bf0b488603580470d2 - ARCHIVE HASH: 835340c9b1bc606a96e35df3615f2d2dd56d16cf53b17acc1978ace957675865 - INDEXED AT: 2026-08-11T11:35:19Z OathNet Stealer (ID: e02743c840831479) - LOG ID: (not given) - URL: (not given) - DOMAIN: rockstargames.com - SUBDOMAIN: signin.rockstargames.com - PATH: (not given) - USERNAME: ggehhggv@gmail.com - PASSWORD: Gasdfgogsg123 - PASSWORD HASH: 4927f57a43868fec4e0529ca05c2682658942e76ed491d9a3da799a1dbe63159 - ARCHIVE HASH: 835340c9b1bc606a96e35df3615f2d2dd56d16cf53b17acc1978ace957675865 - INDEXED AT: 2026-08-11T11:35:19Z OathNet Stealer (ID: f5b2e3f31975c1a4) - LOG ID: (not given) - URL: (not given) - DOMAIN: rockstargames.com - SUBDOMAIN: signin.rockstargames.com - PATH: (not given) - USERNAME: ggehhggv@gmail.com - PASSWORD: yasir1212 - PASSWORD HASH: 4c21c34d54d3e4d7c5df65f9a5ddf008cf2610100de8d1bf0b488603580470d2 - ARCHIVE HASH: 835340c9b1bc606a96e35df3615f2d2dd56d16cf53b17acc1978ace957675865 - INDEXED AT: 2026-08-11T11:35:19Z Stealer Logs (for ggehhggv@gmail.com) - PASSWORD: yasir12 - ORIGIN: android-app:com.yallatech.yallachat - EMAIL: ggehhggv@gmail.com - COLLECTED: 2025-08-29 Stealer Logs (for ggehhggv@gmail.com) - PASSWORD: yasir1212 - ORIGIN: discord.com, gta5grand.com, signin.rockstargames.com - EMAIL: ggehhggv@gmail.com - COLLECTED: 2025-08-29 Stealer Logs (for ggehhggv@gmail.com) - PASSWORD: Gasdfgogsg123 - ORIGIN: signin.rockstargames.com - EMAIL: ggehhggv@gmail.com - COLLECTED: 2025-08-29 SeekNow (query: ggehhggv@gmail.com) - TYPE: email - MODE: fast - BREACH COUNT: 0 - STEALER COUNT: 0 - EXTERNAL COUNT: 0 - RESPONSE TIME MS: 492 HudsonRock Email (for ggehhggv@gmail.com) - OS: Not Found - IP ADDRESS: 204.157.***.*** - SOURCE: HudsonRock Email - ORIGIN: external SEON (for ggehhggv@gmail.com) - EMAIL: ggehhggv@gmail.com - SCORE: 4 - DELIVERABLE: true Social media checks (for ggehhggv@gmail.com): - facebook: REGISTERED = false - flickr: REGISTERED = false - duolingo: REGISTERED = false Breach details (for ggehhggv@gmail.com): - HAVEIBEENPWNED LISTED: false - NUMBER OF BREACHES: 0 Applied rules (for ggehhggv@gmail.com): - ID: E117 - NAME: Domain is a free provider. 1 online profile was found. It was not involved in a data breach - OPERATION: + - SCORE: 4 ================================================================ [ CREDENTIAL 1 – EXPLICIT DISCORD ENTRY ] Credential 1: - URL: android://BnX9M66KmaqmzgqWgQxmbrJB_wO0ST53-DUZCnxDdLwf4JAsUtM2kKGudjeBclJFUquAP2JTpypk9qobA6PGMA==@com.discord/ - Username: 1212teeemmoo@gmail.com - Password: temo@@$$temo - Domains: com.discord - Log ID: 7ab9d258ba5d509bd70b3ada84138eebaa6b804ebe3c818aa4948d558da251ea ================================================================ [ INFECTED MACHINES (VICTIMS) – FULL ] Total Victims: 2 Victim 1: - Log ID: ac7f544db0a5bc126287c45093e60002b03e83a3ac9a91fba52dd1287c6fbadf - Device Emails: 1212teeemmoo@gmail.com, ggehhggv@gmail.com - Total Docs: 2 Victim 2: - Log ID: 7ab9d258ba5d509bd70b3ada84138eebaa6b804ebe3c818aa4948d558da251ea - Total Docs: 48 ================================================================ [ JSON STEALER BLOB – FULL UNREDACTED FIELDS ] { "total_corporate_services": 0, "total_user_services": 23, "date_compromised": "2025-08-09T14:46:43.358Z", "computer_name": "Not Found", "operating_system": "Not Found", "malware_path": "Not Found", "antiviruses": [], "ip": "204.157.***.***", "top_passwords": [ "y*******2", "y*******5", "Q******3", "Y*******0", "y******3" ], "top_logins": [ "a********@gmail.com", "0*********5", "g*******@gmail.com", "a*****h", "a******@gmail.com" ] } ================================================================ [ ALL UNIQUE PASSWORDS EXTRACTED (FULL LIST) ] - temo@@$$temo - yasir12 - yasir1212 - Gasdfgogsg123 - yasir123 - yair2020 - Qwert123 - bSLeHHxcj3Z - hdf4sdfgs - yasir2015 - Yasir0000 - hdhdhdhdhh - Qwert1234@ - wc9_7gCaM3Twn?@ - Qwert2020 - Yasir1212 - MA12345M - Qwert543 - Qwert1234 - 07733912447ADNaN0773 - yasir123@ - yasir2015@ - asdfgogsg (seen in variations) - yildiz - yasir1212@# (listed as one) - (plus the top_passwords redacted patterns: y*******2, y*******5, Q******3, Y*******0, y******3) ================================================================ [ ASSOCIATED NAMES / OTHER ACCOUNTS IN SAME LOGS ] - Almas (almas20122007@gmail.com) - Jeanne Frank (jeannefrank.li.n.2.7.2.0.5@gmail.com) - Kenan Elgretly (kenanelgretly@gmail.com, kenanelgretlyacademy@gmail.com) - Lam (lam62693@gmail.com) - Yazid Elgretly (yazidelgretly2020@gmail.com, yazidelgretly@gmail.com) ================================================================ [ ADDITIONAL PASSWORDS FROM BOTTOM LIST (raw) ] yildiz yasir123 yair2020 yasir1212 Qwert123 bSLeHHxcj3Z yasir12 hdf4sdfgs temo@@$$temo asdfgogsg yasir2015 Yasir0000 yasir1212@# hdhdhdhdhh Qwert1234@ wc9_7gCaM3Twn?@ Qwert2020 Yasir1212 MA12345M Qwert543 Qwert1234 07733912447ADNaN0773 yasir123@ yasir2015@ Gasdfgogsg123 ================================================================ [ TIMESTAMP SUMMARY ] - Earliest compromise: 2025-08-09 (JSON date_compromised) - Stealer collection dates: 2025-08-29 (Discord, YallaChat, etc.) - Indexed in OathNet: 2026-08-11 (multiple times) - Archive hash (consistent across logs): 835340c9b1bc606a96e35df3615f2d2dd56d16cf53b17acc1978ace957675865 ================================================================ [ NOTES ] - The primary victim is Salwa Mohamed. Her main compromised account is Discord with password temo@@$$temo. - The second email (ggehhggv@gmail.com) shares the same infected device (Victim 1) – treat as same household/device. - All passwords are reusable for credential stuffing against any platform using these emails. - No corporate services breached – only personal (23 user services). - IPs point to a single /24 range – likely mobile/CGNAT, not geolocation specific. new paste copy fork guide author anonymous views 15 hastebin.ianhon.com/27dc pass Kay coner enclave