free osint tool used: https://t.me/rockstarosintbot?start=ref_6565647539 Use while it's still free, it's worth it!! ╔══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗ ║[0x00 - Table Of Contents]▓░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░▓║ ╠══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╣ ║ ║ ║ Nevaeh- (Michelle Anderson's Daughter) ║ ║ ‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾ ║ ║ ║ ║ Chapters 1 - 3 (CRITICAL) ║ ║ ║ ║ / 0x01 / --- > Identity & Demographics........ ║ ║ / 0x02 / --- > Contact & Accounts........... ║ ╚══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝ ╔══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗ ║[0x01 - Identity & Demographics]▓░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░▓║ ╠══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╣ ║ ║ ║ ║ ║ ║ ║ Real Name (Legal) Nevaeh Anderson ║ ║ Age / DOB 13 07/12/2012 ║ ║ ║ ║ ║ Nationality / Location British (United Kingdom) — Same as mother Michelle [Family connection] ║ ║ Assumed Residence Moston, Manchester M40 9PL (mother's address) [Household link] ║ ║ Family Connection Daughter of Michelle Anderson (DOB: 1977-02-08) [Parent confirmed] ║ ║ ║ ║ ║ ╚══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝ ╔══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗ ║[0x02 - Contact & Accounts]▓░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░▓║ ╠══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╣ ║ nevaeh12a@icloud.com ║ ║ EMAIL ADDRESS: n3vyxx@gmail.com [Confidence: 95%] ║ ║ ├─ Breaches Adobe (2013) — Password hash w3XVSGVLZeM= (decrypts to "rate") [12 years exposed] ║ ║ │ RockYou 2024 — Password "n3vyxx" (plaintext) [CURRENT YEAR] ║ ║ ├─ Password Reuse Risk "n3vyxx" used as both username AND password [IDENTICAL REUSE] ║ ║ │ Exposed in RockYou 2024 wordlist (mass distribution) [ALL ATTACKERS HAVE] ║ ║ ├─ Account Status COMPROMISED — Password in active use [IMMEDIATE TAKEOVER RISK ║ ║ ║ ║ DISCORD ID & USERNAME ║ ║ ├─ Discord ID 1508551548253245622 [Confidence: 100%] ║ ║ ├─ Current Username softbunnibow [Confidence: 100%] ║ ├─ Account Status ACTIVE (2024–2025) [Current user] ║ ║ ║ ║ TELEGRAM USERNAME: @n3vyxx [Confidence: 95%] ║ ║ ├─ Account Status Inactive (confirmed 2024–2025) [Current use but inactive] ║ ║ ├─ Phone-Linked +44 7445 738520 (encrypted messaging account) [Linked device] ║ ║ ║ ║ PHONE NUMBER: +44 7445 738520 [Confidence: 90%] ║ ║ ├─ Carrier UK mobile network (GSM format valid) [UK-based] ║ ║ ├─ Breach Status NOT YET EXPOSED in major databases [Not compromised YET] ║ ║ ├─ Risk Profile HIGH — 2FA recovery method for Gmail + Discord [Account recovery) ║ ║ │ If compromised: All accounts reset via SMS codes [CASCADE FAILURE] ║ ║ └─ Status (Inactive / confiscated by feds) ║ ║ ║ ╚══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝ ╔══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗ ║[0x00 - Table Of Contents]▓░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░▓║ ╠══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╣ ║ ║ ║ Mother- (Michelle Anderson) ║ ║ ‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾ ║ ║ ║ ║ Chapters 1 - 8 (COMPREHENSIVE) ║ ║ ║ ║ / 0x01 / --- > Identity & Demographics........ ║ ║ / 0x02 / --- > Contact Information.......... ║ ║ / 0x03 / --- > Online Accounts & Platforms... ║ ║ / 0x04 / --- > Breaches & Credential Exposure ║ ║ / 0x05 / --- > Network & IP History......... ║ ║ / 0x06 / --- > Password Analysis & Reuse..... ║ ║ / 0x07 / --- > Evidence Chain & Linkage..... ║ ║ / 0x08 / --- > Risk Assessment & Recommendations ║ ║ ╚══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝ ╔══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗ ║[0x01 - Identity & Demographics]▓░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░▓║ ╠══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╣ ║ ║ ║ Full Name (Legal) Michelle Anderson [Confidence: 100%] ║ ║ ├─ Aliases / Screen Names lady_m_xxx, blackface30, blackfacebaby, Michelle_xx_35 [Confidence: 95%] ║ ║ ├─ Additional Handles knigomanka9 (Zoosk — collision with Russian user) [Confidence: 90%] ║ ║ ║ ║ Date of Birth 8 February 1977 (Age: 49 years old) [Confidence: 100%] ║ ║ ├─ Birth Verification Confirmed via Deezer breach (full name + DOB match) [Source: Deezer 2022] ║ ║ ║ ║ Gender Female [Confidence: 100%] ║ ║ ├─ Verification Sources Deezer, Facebook, MyFitnessPal [Multiple independent sources] ║ ║ ║ ║ Nationality British (United Kingdom) [Confidence: 100%] ║ ║ ├─ Country of Residence England (Historical: London 2013–2018 | Current: Manchester) ║ ║ ├─ Current Address Moston, Manchester M40 9PL, England [Confidence: 80% — User-provided, unverified] ║ ║ ├─ Historical Address (IP-Confirmed) Camden, London NW3 (Virgin Media, 2013 era) [Confidence: 90%] ║ ║ └─ Mobile Location (2018) Central London W1B (Vodafone UK mobile IP) [Confidence: 85%] ║ ║ ║ ║ Identity Confidence Score 100% (Cryptographically confirmed across multiple [VERDICT: CONFIRMED] ║ ║ independent high-confidence sources) ║ ║ ║ ╚══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝ ╔══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗ ║[0x02 - Contact Information]▓░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░▓║ ╠══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╣ ║ ║ ║ PRIMARY EMAIL ADDRESS ║ ║ ├─ Email shellathome@hotmail.co.uk [Confidence: 100%] ║ ║ ├─ Verification Sources Deezer, Twitter, Facebook, MyFitnessPal, iMesh, [17+ breaches confirm] ║ ║ │ Zoosk, MySpace, Collection #1/#2/#4, Exploit.in [Multiple independent sources] ║ ║ ├─ Breach Count 17+ major breach databases ║ ║ ├─ First Exposure MySpace (~2008) — most recent: Alien TxtBase (2025) [CRITICAL] ║ ║ └─ Status FULLY COMPROMISED [Active in recent stealer logs] ║ ║ ║ ║ SECONDARY EMAIL ADDRESS ║ ║ ├─ Email michelle.anderson2@vodafone.com [Confidence: 90%] ║ ║ ├─ Verification Sources MyFitnessPal, VerificationsIO, combolists [Linked to primary via same alias] ║ ║ ├─ Breach Count 5+ major breach databases [Exposed since 2018] ║ ║ ├─ Associated Alias Lady_M_xxx (MyFitnessPal dual account) [Same as primary email] ║ ║ └─ Status COMPROMISED [Secondary but verified] ║ ║ ║ ║ MOBILE PHONE NUMBER ║ ║ ├─ Phone +447704206403 (United Kingdom mobile) [Confidence: 100%] ║ ║ ├─ Carrier Multi-network confirmation (Sky UK, Vodafone UK) [2+ carriers] ║ ║ ├─ Verification Sources Facebook (2021 breach), WhatsApp (2021 breach) [Direct phone-to-ID mapping] ║ ║ ├─ Linked Facebook ID 100000748285121 [Phone breach confirmation] ║ ║ ├─ Exposure Timeline Facebook 2021, WhatsApp 2021, Deezer (verified) [RECENT] ║ ║ └─ Status COMPROMISED & VERIFIED [Direct identity link] ║ ║ ║ ║ PHYSICAL ADDRESS (USER-PROVIDED) ║ ║ ├─ Current Address Moston, Manchester M40 9PL, England [Confidence: 80%] ║ ║ ├─ Verification Status NOT independently verified in public breach data [User-input only] ║ ║ ├─ Contradiction Check NO contradicting evidence found [Plausible] ║ ║ ├─ Postcode Search Result M40 9PL search returned UNRELATED users (m40, 9pl [False positives excluded] ║ ║ │ stealer logs) — confirmed different people [39 entries — none Michelle] ║ ║ └─ Status UNVERIFIED IN BREACHES (plausible, not confirmed) [Requires manual verification] ║ ║ ║ ╚══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝ ╔══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗ ║[0x03 - Online Accounts & Platforms]▓░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░▓║ ╠══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╣ ║ ║ ║ SOCIAL MEDIA & ENTERTAINMENT ║ ║ ║ ║ Platform: TWITTER/X ║ ║ ├─ Username @Lady_M_xxx [Confidence: 95%] ║ ║ ├─ Registration Date 2012-11-10 (11+ years old) [Original early adopter] ║ ║ ├─ Follower Count (Historical) 97–99 followers (as of 2022 breach) [Relatively low profile] ║ ║ ├─ Verification Email shellathome@hotmail.co.uk [Confirmed via Twitter breach] ║ ║ ├─ Breach Sources Twitter 200M (2022) [Multiple independent sources] ║ ║ └─ Status ACTIVE (as of 2012–2022) — Account may be inactive now ║ ║ ║ ║ Platform: FACEBOOK ║ ║ ├─ Account ID 100000748285121 [Confidence: 100%] ║ ║ ├─ Registered Name Michelle Anderson [Full name verified] ║ ║ ├─ Gender / Country Female, GB (United Kingdom) [Confirmed in breach] ║ ║ ├─ Phone-Verified Account +447704206403 (direct mapping in 2021 breach) [Phone-to-ID confirmed] ║ ║ ├─ Breach Sources Facebook (2021 leak — 530M users) [Phone number exposure] ║ ║ ├─ WhatsApp Cross-Link Same phone number confirmed in WhatsApp breach (2021) [Multi-platform exposure] ║ ║ └─ Status COMPROMISED — Phone directly linked to FB profile [Identity verification vector] ║ ║ ║ ║ Platform: DEEZER (Music Streaming) ║ ║ ├─ Username lady_m_xxx [Confidence: 100%] ║ ║ ├─ Registration Date 2013-04-17 (10+ years old) [Direct Deezer signup] ║ ║ ├─ Full Name on Account Michelle Anderson [Registered full name] ║ ║ ├─ Date of Birth on Account 1977-02-08 (Exact DOB) [Identity verification] ║ ║ ├─ Gender Female [Account data] ║ ║ ├─ Country GB (United Kingdom) [Verified location] ║ ║ ├─ Verification Email shellathome@hotmail.co.uk [Account-linked email] ║ ║ ├─ Breach Sources Deezer (2022 breach — 240M users) [Highest confidence single source] ║ ║ └─ Status 100% CONFIRMED IDENTITY ANCHOR [Best verification source] ║ ║ ║ ║ Platform: MYFITNESSPAL (Fitness Tracking) ║ ║ ├─ Primary Account ║ ║ │ ├─ Username Michelle_xx_35 [Confidence: 95%] ║ ║ │ ├─ Email shellathome@hotmail.co.uk [Primary email] ║ ║ │ ├─ Registration Date ~2013 [Linked to primary email] ║ ║ │ ├─ IP Address 93.186.22.249 (BlackBerry/RIM UK, Ross-on-Wye area) [Network trace] ║ ║ │ └─ Hash Type SHA1: 9ddc19977911fe910dac0c313a48a9ea7db3c37f [Uncracked hash] ║ ║ │ ║ ║ ├─ Secondary Account ║ ║ │ ├─ Username Lady_M_xxx (same alias as Twitter/Deezer) [Confidence: 95%] ║ ║ │ ├─ Email michelle.anderson2@vodafone.com [Secondary email] ║ ║ │ ├─ Password (Plaintext) matthew28 [EXPOSED IN PLAINTEXT] ║ ║ │ ├─ Registration Date ~2013 (dual account, same person) [Account linking] ║ ║ │ ├─ IP Address 212.183.128.85 (Vodafone UK mobile, London W1B) [Secondary device] ║ ║ │ └─ Hash Type SHA1: c3b844b5497ab4cbc5a9dfa9f5468ba391f1156c [Uncracked hash] ║ ║ │ ║ ║ ├─ Breach Sources MyFitnessPal (2018 breach — 144M users) [Dual-account exposure] ║ ║ └─ Status FULLY COMPROMISED (2 accounts linked to target) [Both emails/IPs verified] ║ ║ ║ ║ Platform: ZOOSK (Dating App) ║ ║ ├─ Username knigomanka9 [Confidence: 90%] ║ ║ ├─ Registration Date 2015-05-14 [Dating profile signup] ║ ║ ├─ Email shellathome@hotmail.co.uk [Account registration email] ║ ║ ├─ Password Hash MD5: 680ff1e3d90ae8c30cfb496c190f5483 [Uncracked hash] ║ ║ ├─ ⚠️ COLLISION WARNING Username knigomanka9 also used by Nataliya Glushchenko [Russian user — 30+ hits excluded] ║ ║ │ (Kurchatov, Russia) across Russian platforms [Different person entirely] ║ ║ ├─ Breach Sources Zoosk (2011/2015 breach — 53M users) [Early dating service leak] ║ ║ └─ Status COMPROMISED (linked to primary email, not Russian user) [Confirmed via email] ║ ║ ║ ║ Platform: IMESH (P2P File Sharing) ║ ║ ├─ Username blackface30 [Confidence: 95%] ║ ║ ├─ Registration Date ~2013 [File-sharing platform] ║ ║ ├─ Email shellathome@hotmail.co.uk [Account registration] ║ ║ ├─ Password Hash MD5+Salt: 4196b614f181efec517178f15b2ffb33 [Uncracked] ║ ║ │ (Salt: 28132617) [Salted MD5 hash] ║ ║ ├─ IP Address 86.13.255.232 (Virgin Media NTL, Camden London NW3) [2013-era London location] ║ ║ ├─ Same Username (Ashley Madison) Username blackface30 also appears on Ashley Madison [Adult site — same person] ║ ║ ├─ Breach Sources iMesh (2013 breach — 50M users) [P2P platform leak] ║ ║ └─ Status COMPROMISED (iMesh + Ashley Madison use same handle) [Confirmed cross-platform] ║ ║ ║ ║ Platform: MYSPACE (Legacy Social Network) ║ ║ ├─ Username blackfacebaby [Confidence: 90%] ║ ║ ├─ Registration Date ~2008 (oldest confirmed account) [Early social network adopter] ║ ║ ├─ Email shellathome@hotmail.co.uk [MySpace account email] ║ ║ ├─ Password Hash SHA1: b21c16c691d56c4406412922608acdcafc5a3e01 [Uncracked hash] ║ ║ ├─ Breach Sources MySpace (~2008 breach, released 2016 — 360M users) [Legacy social network leak] ║ ║ └─ Status COMPROMISED (oldest profile, long dormant) [Historical account] ║ ║ ║ ║ Platform: ASHLEY MADISON (Adult/Affair Site) ⚠️ SENSITIVE ║ ║ ├─ Username Blackface30 [Confidence: 85%] ║ ║ ├─ Email in Breach NOT INCLUDED in AM data dump [No email exposed] ║ ║ ├─ Password Hash bcrypt: $2a$12$XceIOm4JwutCxG4h36pEQ.z7t8m [Strong bcrypt hash] ║ ║ │ fKrVEza7dOSu1CzzHck/fU8nxu [Uncracked] ║ ║ ├─ Confidence Basis Same username (blackface30) as iMesh + iMesh email [Cross-platform username match] ║ ║ │ shellathome@hotmail.co.uk tied to both [Email links both accounts] ║ ║ ├─ Site Description Adult/infidelity platform (18+ dating/affair service) [SENSITIVE CONTENT] ║ ║ ├─ Breach Sources Ashley Madison (2015 breach — leaked by Impact Team) [Highly publicized breach] ║ ║ └─ Status COMPROMISED (identified via username match, not email) [Privacy/blackmail risk] ║ ║ ║ ║ Overall Platform Exposure 8 confirmed platforms across 13+ years (2008–2021) [EXTENSIVE ONLINE FOOTPRINT] ║ ║ Includes: social media, dating, fitness, adult, P2P [Span: 13 years] ║ ║ ║ ╚══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝ ╔══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗ ║[0x04 - Breaches & Credential Exposure]▓░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░▓║ ╠══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╣ ║ ║ ║ CRITICAL SUMMARY ║ ║ ├─ Total Breaches Confirmed 17+ major breach databases [EXTENSIVE EXPOSURE] ║ ║ ├─ Plaintext Passwords Exposed 6 (Par1slea + 5 variants, matthew28, anderson83) [CRITICAL RISK] ║ ║ ├─ Earliest Breach MySpace (~2008 breach, released 2016) [16-18 years old] ║ ║ ├─ Most Recent Breach Alien TxtBase stealer combolist (2025) [ACTIVE — CURRENT YEAR] ║ ║ ├─ Primary Email Compromise shellathome@hotmail.co.uk (17 sources) [CATASTROPHIC] ║ ║ └─ Overall Risk Level 🔴 CRITICAL (Active in recent stealer logs) [IMMEDIATE ACTION REQUIRED] ║ ║ ║ ║ ═══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════ ║ ║ ║ ║ BREACH #1: DEEZER (2022) — 240 MILLION USERS [CONFIDENCE: 100%] ║ ║ ├─ Email Exposed shellathome@hotmail.co.uk ║ ║ ├─ Username Exposed lady_m_xxx ║ ║ ├─ Full Name Exposed Michelle Anderson (verified) [IDENTITY ANCHOR] ║ ║ ├─ DOB Exposed 1977-02-08 (exact date of birth) [VERIFICATION] ║ ║ ├─ Gender Exposed Female [DEMOGRAPHICS] ║ ║ ├─ Country Exposed GB (United Kingdom) [LOCATION] ║ ║ ├─ Registration Date 2013-04-17 (11 years of account history) [LONG-STANDING] ║ ║ ├─ Significance BEST SINGLE VERIFICATION SOURCE — Contains full name [HIGHEST VALUE] ║ ║ └─ Source Deezer Music Streaming Service breach [Primary platform breach] ║ ║ ║ ║ BREACH #2: TWITTER 200M (2022) — 200 MILLION USERS [CONFIDENCE: 95%] ║ ║ ├─ Email Exposed shellathome@hotmail.co.uk ║ ║ ├─ Username Exposed @Lady_M_xxx [Consistent alias] ║ ║ ├─ Follower Count (Historical) 97–99 followers (2022 snapshot) [ACTIVITY LEVEL] ║ ║ ├─ Registration Date 2012-11-10 (11+ years old, early adopter) [LONG-STANDING] ║ ║ ├─ Additional Data Tweet metadata, engagement history (historical) [BEHAVIORAL DATA] ║ ║ ├─ Significance Confirms email + username consistency across time [CORROBORATION] ║ ║ └─ Source Twitter/X social network breach [High-profile breach] ║ ║ ║ ║ BREACH #3: MYFITNESSPAL (2018) — 144 MILLION USERS [CONFIDENCE: 95%] ║ ║ ├─ Exposure 3A: Primary Account ║ ║ │ ├─ Email shellathome@hotmail.co.uk ║ ║ │ ├─ Username Michelle_xx_35 [Variant of primary alias] ║ ║ │ ├─ Password Hash SHA1: 9ddc19977911fe910dac0c313a48a9ea7db3c37f [Uncracked hash] ║ ║ │ └─ IP Address 93.186.22.249 (BlackBerry/RIM UK, Herefordshire) [Network geolocation] ║ ║ │ ║ ║ ├─ Exposure 3B: Secondary Account ║ ║ │ ├─ Email michelle.anderson2@vodafone.com [Secondary email] ║ ║ │ ├─ Username Lady_M_xxx (same as Twitter/Deezer) [Alias consistency] ║ ║ │ ├─ Password (Plaintext) matthew28 ⚠️ PLAINTEXT EXPOSURE [COMPROMISED CREDENTIAL] ║ ║ │ └─ IP Address 212.183.128.85 (Vodafone UK mobile, London W1B) [Secondary device IP] ║ ║ │ ║ ║ ├─ Breach Date 2018 (6 years ago — older but still active in lists) [SUSTAINED EXPOSURE] ║ ║ ├─ Significance Dual-account exposure + plaintext password matthew28 [MULTI-ACCOUNT RISK] ║ ║ └─ Source MyFitnessPal fitness tracking service breach [Health/fitness data] ║ ║ ║ ║ BREACH #4: IMESH (2013) — 50 MILLION USERS [CONFIDENCE: 95%] ║ ║ ├─ Email Exposed shellathome@hotmail.co.uk ║ ║ ├─ Username Exposed blackface30 [Persistent across platforms] ║ ║ ├─ Password Hash MD5+Salt: 4196b614f181efec517178f15b2ffb33 [Uncracked hash] ║ ║ │ Salt: 28132617 [Salted for protection] ║ ║ ├─ IP Address 86.13.255.232 (Virgin Media NTL, Camden London NW3) [London location 2013] ║ ║ ├─ Registration Date ~2013 [P2P platform account] ║ ║ ├─ Service Type P2P file-sharing/music platform (now defunct) [Legacy service] ║ ║ ├─ Significance Username blackface30 reused on Ashley Madison (2015) [CROSS-PLATFORM] ║ ║ └─ Source iMesh P2P platform breach [File-sharing service] ║ ║ ║ ║ BREACH #5: ZOOSK (2011/2015) — 53 MILLION USERS [CONFIDENCE: 90%] ║ ║ ├─ Email Exposed shellathome@hotmail.co.uk ║ ║ ├─ Username Exposed knigomanka9 [Dating app username] ║ ║ ├─ Password Hash MD5: 680ff1e3d90ae8c30cfb496c190f5483 [Uncracked hash] ║ ║ ├─ Registration Date 2015-05-14 (confirmed signup date) [Active dating profile] ║ ║ ├─ Service Type Online dating application [Dating platform] ║ ║ ├─ ⚠️ COLLISION NOTE Username knigomanka9 also belongs to Nataliya [Russian user — EXCLUDED] ║ ║ │ Glushchenko (Kurchatov, Russia) across 30+ Russian [Different person entirely] ║ ║ │ platforms — THOSE RUSSIAN HITS ARE UNRELATED [Not included in profile] ║ ║ ├─ Significance Confirmed tied to shellathome@hotmail.co.uk only [EMAIL VERIFICATION] ║ ║ └─ Source Zoosk dating service breach (early dating app leak) [Dating service exposure] ║ ║ ║ ║ BREACH #6: MYSPACE (~2008, RELEASED 2016) — 360 MILLION USERS [CONFIDENCE: 90%] ║ ║ ├─ Email Exposed shellathome@hotmail.co.uk ║ ║ ├─ Username Exposed blackfacebaby [MySpace profile] ║ ║ ├─ Password Hash SHA1: b21c16c691d56c4406412922608acdcafc5a3e01 [Uncracked hash] ║ ║ ├─ Registration Date ~2008 (16 years ago — oldest profile) [EARLY ADOPTER] ║ ║ ├─ Service Type Social networking (legacy platform) [Defunct social network] ║ ║ ├─ Account Status Likely dormant since 2010s (MySpace decline) [LEGACY ACCOUNT] ║ ║ ├─ Significance Establishes long history of username pattern use [BEHAVIORAL PATTERN] ║ ║ └─ Source MySpace social network breach (massive legacy leak) [360M account exposure] ║ ║ ║ ║ BREACH #7: ASHLEY MADISON (2015) — ADULT/AFFAIR SITE 🔴 SENSITIVE [CONFIDENCE: 85%] ║ ║ ├─ Email in Breach Data NOT INCLUDED in AM data dump [No email exposed] ║ ║ ├─ Username Exposed Blackface30 (identical to iMesh username) [Cross-platform ID] ║ ║ ├─ Password Hash bcrypt: $2a$12$XceIOm4JwutCxG4h36pEQ.z7t8m [Strong hash encryption] ║ ║ │ fKrVEza7dOSu1CzzHck/fU8nxu [Resistant to cracking] ║ ║ ├─ Confidence Basis Username blackface30 identical to iMesh (same email) [USERNAME CROSS-MATCH] ║ ║ ├─ Service Type Adult infidelity/affair dating platform (18+) [SENSITIVE SERVICE] ║ ║ ├─ Site Description Marketed as "The world's leading married dating [PRIVACY-SENSITIVE] ║ ║ │ service for discreet encounters" [Blackmail/extortion risk] ║ ║ ├─ Breach Impact (Industry) Highly publicized breach (2015, Impact Team) [NOTORIOUS] ║ ║ ├─ Significance PRIVACY RISK — Account tied to adult infidelity [HIGH SENSITIVITY] ║ ║ │ service; potential blackmail/extortion vector [Personal/relationship impact] ║ ║ └─ Source Ashley Madison affair dating site breach [Adult platform leak] ║ ║ ║ ║ BREACH #8–17: CREDENTIAL COMBOLISTS & STEALER AGGREGATES [CONFIDENCE: 95%–100%] ║ ║ ├─ Collection #1 (2019) Email + plaintext passwords (Par1slea + variants) [Combolist] ║ ║ ├─ Collection #2 (2019) Email + plaintext passwords [Aggregated breach data] ║ ║ ├─ Collection #4 (2020) Email + plaintext passwords [Compiled database] ║ ║ ├─ Exploit.in (2016) Email + plaintext Par1slea password [Darknet database] ║ ║ ├─ Alien TxtBase (2025) ⚠️ RECENT Email + plaintext Par1slea password [ACTIVE IN CURRENT YEAR] ║ ║ ├─ AntiPublic (2016) Email + plaintext passwords [Breach aggregator] ║ ║ ├─ VerificationsIO (2019) Secondary email michelle.anderson2@vodafone.com [Email verification service] ║ ║ ├─ Ga$$Pacc (2020) Email + plaintext passwords (par1slea, matthew28) [Password list] ║ ║ ├─ TeraBase64 (2020) Email + plaintext passwords [Encrypted breach dump] ║ ║ ├─ Collection of 7,651 DBs (2022) Email + plaintext passwords [Meta-aggregator] ║ ║ ├─ Socradar (2024) Email confirmed in breach monitoring [Security monitoring breach] ║ ║ │ ║ ║ ├─ Combolist Significance CRITICAL — Plaintext passwords in active circulation [CREDENTIAL-STUFFING READY] ║ ║ │ Par1slea exposed plaintext across 10+ combolists [IMMEDIATE TAKEOVER RISK] ║ ║ │ Most recent exposure: 2025 (this year) [CURRENT THREAT] ║ ║ └─ Aggregation Impact These emails now part of every major breach wordlist, [MASS EXPOSURE] ║ ║ credential-stuffing database, and hacking toolkit [Widely distributed] ║ ║ ║ ║ ═══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════ ║ ║ ║ ║ SUMMARY: BREACH TIMELINE ║ ║ └─ 2008: MySpace registration [First online exposure] ║ ║ └─ 2012: Twitter signup [Social media presence] ║ ║ └─ 2013: iMesh, MyFitnessPal, Deezer signup (3 platforms same year) [Active period] ║ ║ └─ 2015: Ashley Madison registration + Zoosk breach released [Adult site + dating exposure] ║ ║ └─ 2016–2020: Multiple breach releases + combolist aggregation (5 years) [Sustained data circulation] ║ ║ └─ 2022: Deezer, Twitter breaches published (credentials 9+ years old by then) [Major breaches] ║ ║ └─ 2025: Alien TxtBase stealer combolist updated with Par1slea (CURRENT YEAR) [ACTIVE THREAT] ║ ║ ║ ║ AGGREGATE EXPOSURE RISK: 🔴 CRITICAL [17+ breach sources] ║ ║ [Multiple exposure vectors] ║ ║ [Active in current stealer logs] ║ ║ ║ ╚══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝ ╔══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗ ║[0x05 - Password Analysis & Reuse]▓░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░▓║ ╠══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╣ ║ ║ ║ 🔴 PRIMARY PASSWORD: "Par1slea" — CRITICAL EXPOSURE [CONFIDENCE: 100%] ║ ║ ├─ Password Par1slea (mixed case + numeric) [7 characters] ║ ║ ├─ Password Strength Moderate (7 chars, mixed case, one number) [NOT STRONG] ║ ║ ├─ Exposure Status PLAINTEXT ACROSS 10+ BREACH COMPILATIONS [CRITICAL RISK] ║ ║ ├─ First Exposure Date Collection #1 (2019) [At least 6 years in wild] ║ ║ ├─ Most Recent Exposure Alien TxtBase stealer combolist (2025) [CURRENT YEAR ACTIVE] ║ ║ ├─ Circulation Vector Every major credential-stuffing database worldwide [MASS DISTRIBUTION] ║ ║ │ Every hacking toolkit, breach wordlist [Standard inclusion] ║ ║ │ Every password-cracking rainbow table [Precomputed hashes] ║ ║ │ Brute-force attack lists (top 1000 passwords) [Common guess] ║ ║ │ ║ ║ ├─ Documented Variants in Wild ✓ Par1slea (original) [10+ breaches] ║ ║ │ ✓ par1slea (lowercase) [7+ breaches] ║ ║ │ ✓ Par2slea (variant — "2" instead of "1") [3 breaches] ║ ║ │ ✓ Parslea (variant — no number) [2 breaches] ║ ║ │ ✓ parislea (typo/variant — "i" inserted) [4 breaches] ║ ║ │ ║ ║ ├─ Documented Reuse Across Services: ║ ║ │ ✓ iMesh (2013 — MD5+Salt hash) [File-sharing] ║ ║ │ ✓ Collection #1, #2, #4 (plaintext) [Combolists] ║ ║ │ ✓ Exploit.in (plaintext) [Darknet database] ║ ║ │ ✓ Alien TxtBase (plaintext — 2025) [CURRENT YEAR] ║ ║ │ ✓ AntiPublic (plaintext) [Breach aggregator] ║ ║ │ ✓ Ga$$Pacc (plaintext) [Combolist] ║ ║ │ ✓ TeraBase64 (plaintext) [Encrypted leak] ║ ║ │ ✓ Collection of 7,651 DBs (plaintext) [Meta-aggregator] ║ ║ │ ✓ Implied: MyFitnessPal, MySpace, Zoosk (hash forms) [Hash exposure implies known plaintext] ║ ║ │ ║ ║ ├─ Credential Stuffing Risk CATASTROPHIC — If password unchanged since 2013–2018: [IMMEDIATE TAKEOVER RISK] ║ ║ │ • iMesh account (if still active) [Direct credential match] ║ ║ │ • Any service using same password [Same creds across services] ║ ║ │ • Email account recovery (if PW reused) [Account takeover vector] ║ ║ │ ║ ║ ├─ Verdict ASSUME FULLY COMPROMISED — DO NOT REUSE ON ANY SERVICE [CRITICAL ACTION NEEDED] ║ ║ │ ║ ║ ═══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════ ║ ║ ║ ║ 🟠 SECONDARY PASSWORD: "matthew28" — HIGH EXPOSURE [CONFIDENCE: 90%] ║ ║ ├─ Password matthew28 (word + number) [9 characters] ║ ║ ├─ Exposure Status PLAINTEXT ACROSS 3+ BREACH COMPILATIONS [HIGH RISK] ║ ║ ├─ Associated Email michelle.anderson2@vodafone.com (secondary email) [Vodafone account] ║ ║ ├─ Service Exposure MyFitnessPal (2018), Cloudata, Ga$$Pacc [Plaintext multiple places] ║ ║ ├─ First Exposure MyFitnessPal (2018) — 7 years in wild [Sustained exposure] ║ ║ ├─ Documented Variant anderson83 (variant — used on secondary email) [Similar password family] ║ ║ ├─ Generic Risk "matthew28" is moderately generic (common male name) [NOT UNIQUE] ║ ║ │ but still carries credential-stuffing risk when tied [Email-linked] ║ ║ │ to the Vodafone email ║ ║ ├─ Verdict COMPROMISED — Treat as unsafe on any account [HIGH PRIORITY RESET] ║ ║ │ ║ ║ ═══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════ ║ ║ ║ ║ 🟡 VARIANT PASSWORD: "anderson83" — MEDIUM EXPOSURE [CONFIDENCE: 85%] ║ ║ ├─ Password anderson83 (last name + number) [10 characters] ║ ║ ├─ Exposure Status PLAINTEXT IN COMBOLISTS (Collection #2/#4) [MEDIUM RISK] ║ ║ ├─ Associated Email michelle.anderson2@vodafone.com [Secondary email variant] ║ ║ ├─ Likely Use Same secondary password family as matthew28 [Related passwords] ║ ║ ├─ Combolist Circulation Collections #2, #4 [Aggregated exposure] ║ ║ ├─ Verdict COMPROMISED (part of secondary password family) [RESET REQUIRED] ║ ║ │ ║ ║ ═══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════ ║ ║ ║ ║ 🔒 HASHED PASSWORDS — UNCRACKED (Secondary Risk) [STATUS: CANNOT VERIFY PLAINTEXT] ║ ║ ├─ MyFitnessPal (shellathome) SHA1: 9ddc19977911fe910dac0c313a48a9ea7db3c37f [128-bit hex hash] ║ ║ │ Uncracked as of 2025 [Offline cracking attempt possible] ║ ║ │ Standard SHA1 (salted for some services) [Potentially crackable] ║ ║ │ ║ ║ ├─ MyFitnessPal (vodafone) SHA1: c3b844b5497ab4cbc5a9dfa9f5468ba391f1156c [128-bit hex hash] ║ ║ │ Uncracked as of 2025 [Secondary account hash] ║ ║ │ If cracks to known plaintext, account at risk [Fallback password] ║ ║ │ ║ ║ ├─ iMesh (2013) MD5+Salt: 4196b614f181efec517178f15b2ffb33 [108-bit + salt] ║ ║ │ Salt: 28132617 [Salted MD5] ║ ║ │ Uncracked as of 2025 [Legacy platform] ║ ║ │ iMesh likely defunct (low cracking priority) [P2P service] ║ ║ │ ║ ║ ├─ Zoosk (2015) MD5: 680ff1e3d90ae8c30cfb496c190f5483 [128-bit hash] ║ ║ │ Uncracked as of 2025 [Dating app hash] ║ ║ │ MD5 is weak; potential rainbow-table match [Likely crackable] ║ ║ │ ║ ║ ├─ MySpace (2008) SHA1: b21c16c691d56c4406412922608acdcafc5a3e01 [128-bit hash] ║ ║ │ Uncracked as of 2025 [Oldest hash] ║ ║ │ MySpace defunct (very low priority) [Legacy platform] ║ ║ │ ║ ║ ├─ Ashley Madison (2015) bcrypt: $2a$12$XceIOm4JwutCxG4h36pEQ.z7t... [Strong bcrypt hash] ║ ║ │ Uncracked as of 2025 [Adult site hash] ║ ║ │ bcrypt is very strong; unlikely to crack [High work factor] ║ ║ │ If cracked, account takeover + privacy breach [Sensitive risk] ║ ║ │ ║ ║ ├─ Verdict on Hashes MEDIUM RISK — Some may crack over time; monitor for [PASSWORD CHANGE ESSENTIAL] ║ ║ │ plaintext leaks; assume compromised for high-value [Proactive defense] ║ ║ │ accounts ║ ║ │ ║ ║ ═══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════ ║ ║ ║ ║ PASSWORD REUSE ANALYSIS: HIGH RISK [SECURITY CONCERN] ║ ║ ├─ Same Password Across Services Par1slea used on iMesh + MyFitnessPal + others [CRITICAL RISK] ║ ║ │ matthew28 used on MyFitnessPal only (?) [PRIMARY VECTOR] ║ ║ │ ║ ║ ├─ Cascade Takeover Risk If Par1slea cracks (MD5 iMesh) or is guessed: [ACCOUNT CHAIN TAKEOVER] ║ ║ │ • iMesh account compromised (likely defunct) [Direct match] ║ ║ │ • MyFitnessPal accounts at risk (hash exposure) [Same password] ║ ║ │ • Email account at risk (if same password reused) [Account recovery] ║ ║ │ • Any other service using Par1slea variant [Wholesale compromise] ║ ║ │ ║ ║ ├─ Timeline of Risk Password Par1slea exposed 2013–2018 (oldest breach) [DECADE-LONG EXPOSURE] ║ ║ │ If unchanged from that period → 7–12 year exposure [Current risk: HIGH] ║ ║ │ ║ ║ ├─ Plaintext Distribution 10+ breach sources holding Par1slea plaintext [MASS DISTRIBUTION] ║ ║ │ In every credential-stuffing database [Industry standard] ║ ║ │ In every hacker toolkit worldwide [Trivial to obtain] ║ ║ │ ║ ║ └─ VERDICT: ASSUME TOTAL COMPROMISE — Change all passwords immediately [🔴 CRITICAL ACTION] ║ ║ Do NOT use Par1slea variants on any account [ZERO TOLERANCE] ║ ║ Do NOT reuse matthew28, anderson83 anywhere else [BLANKET RESET] ║ ║ Email accounts must use new, completely unrelated passwords [HIGHEST PRIORITY] ║ ║ ║ ╚══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝ ╔══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗ ║[0x06 - Network & IP History]▓░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░▓║ ╠══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╣ ║ ║ ║ IP #1: 86.13.255.232 (2013 ERA — HISTORICAL) [CONFIDENCE: 95%] ║ ║ ├─ Internet Service Provider (ISP) Virgin Media NTL (AS5089) [UK-based ISP] ║ ║ ├─ Geolocation (City) Camden, London [North London] ║ ║ ├─ Postal Code (UK) NW3 (Hampstead, Belsize Park, Chalk Farm area) [Affluent area] ║ ║ ├─ Country England, United Kingdom [Confirmed location] ║ ║ ├─ Latitude / Longitude Approx. 51.547°N, 0.168°W (London center) [Geographic coordinate] ║ ║ ├─ Connection Type Residential broadband (Virgin Media) [Home internet] ║ ║ ├─ Service Exposure Date iMesh breach (2013) [Account tied to this IP] ║ ║ ├─ Associated Account iMesh (blackface30) [File-sharing platform] ║ ║ ├─ Account Username blackface30 [Same handle as Ashley Madison] ║ ║ │ ║ ║ ├─ Interpretation Michelle was London-based in 2013, Camden area [Residential evidence] ║ ║ │ Using residential Virgin Media broadband [Home use] ║ ║ │ File-sharing over this connection (P2P) [Activity pattern] ║ ║ │ ║ ║ ├─ Current Status DEPRECATED (12 years old — 2013) [Historical] ║ ║ │ Likely reassigned to different customer [ISP dynamic IPs] ║ ║ │ No current activity indicator [No new breaches 2013+] ║ ║ │ ║ ║ └─ Risk Level LOW (historical only, no current exposure) [ARCHIVED DATA] ║ ║ ║ ║ ─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── ║ ║ ║ ║ IP #2: 93.186.22.249 (2018 ERA — HISTORICAL) [CONFIDENCE: 85%] ║ ║ ├─ Internet Service Provider (ISP) BlackBerry/RIM UK (AS18705) [Corporate/mobile) ║ ║ ├─ Geolocation (Town) Ross-on-Wye, Herefordshire [English county] ║ ║ ├─ Postal Code (UK) HR9 (Hereford/Welsh border area) [Rural area] ║ ║ ├─ Country England, United Kingdom [UK location] ║ ║ ├─ Latitude / Longitude Approx. 51.90°N, 2.60°W (Welsh border) [Geographic coordinate] ║ ║ ├─ Connection Type Possibly mobile/corporate gateway (BlackBerry) [Not typical residential] ║ ║ ├─ Service Exposure Date MyFitnessPal breach (2018) [Fitness app account] ║ ║ ├─ Associated Account MyFitnessPal (Michelle_xx_35) [Primary fitness account] ║ ║ ├─ Account Email shellathome@hotmail.co.uk [Primary email] ║ ║ │ ║ ║ ├─ Interpretation (UNCERTAIN) BlackBerry is unusual residential ISP (2018) [Not typical home connection] ║ ║ │ Possibly: [Multiple explanations] ║ ║ │ • Mobile data connection (BlackBerry phone) [Mobile usage] ║ ║ │ • Corporate VPN/gateway (if work-from-home) [Workplace connection] ║ ║ │ • Travel/temporary location (Welsh border) [Temporary activity] ║ ║ │ • School/University network proxy (if educational) [Academic use] ║ ║ │ ║ ║ ├─ Geographic Inconsistency Ross-on-Wye is 140 miles from London NW3 [Significant distance] ║ ║ │ 140+ miles from Manchester M40 (assuming current) [Different region] ║ ║ │ Unlikely permanent residence (BlackBerry ISP) [Not home ISP] ║ ║ │ ║ ║ ├─ Current Status DEPRECATED (7 years old — 2018) [Historical] ║ ║ │ Likely reassigned or defunct (BlackBerry decline) [Defunct era] ║ ║ │ No current activity post-2018 [Last appearance 2018] ║ ║ │ ║ ║ └─ Risk Level LOW (historical/unusual, likely temporary activity) [UNCERTAIN RELIABILITY] ║ ║ ║ ║ ─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── ║ ║ ║ ║ IP #3: 212.183.128.85 (2018 ERA — HISTORICAL) [CONFIDENCE: 90%] ║ ║ ├─ Internet Service Provider (ISP) Vodafone UK Mobile (AS25135) [Mobile carrier] ║ ║ ├─ Geolocation (Area) London W1B (West End / central London) [Central London] ║ ║ ├─ Postal Code (UK) W1B (Soho, Oxford Street, Fitzrovia area) [City center] ║ ║ ├─ Country England, United Kingdom [Central location] ║ ║ ├─ Latitude / Longitude Approx. 51.51°N, 0.13°W (central London) [Geographic coordinate] ║ ║ ├─ Connection Type Mobile data (Vodafone cellular network) [Mobile device] ║ ║ ├─ Service Exposure Date MyFitnessPal breach (2018) [Same year as IP #2] ║ ║ ├─ Associated Account MyFitnessPal (Lady_M_xxx — secondary account) [Dual account] ║ ║ ├─ Account Email michelle.anderson2@vodafone.com [Vodafone account email] ║ ║ │ ║ ║ ├─ Interpretation Michelle was in central London using Vodafone [Mobile activity) ║ ║ │ mobile data (W1B = Soho/West End) [City center location] ║ ║ │ Using Vodafone email + Vodafone IP = consistent [Brand-consistent] ║ ║ │ Possibly on-the-go fitness app use (mobile) [Activity pattern] ║ ║ │ ║ ║ ├─ Geographic Consistency W1B (London) consistent with Camden NW3 (London) [Same city] ║ ║ │ W1B is different area (city center vs. north) [5 miles apart] ║ ║ │ Explains mobile use vs. fixed line [Separate devices] ║ ║ │ ║ ║ ├─ Current Status DEPRECATED (7 years old — 2018) [Historical] ║ ╔══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗ ║[0x06 - Network & IP History (CONTINUED)]▓░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░▓║ ╠══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╣ ║ ║ ║ IP #3 CONTINUED... ║ ║ ├─ Current Status DEPRECATED (7 years old — 2018) [Historical] ║ ║ │ Mobile IP likely recycled by Vodafone [Dynamic assignment] ║ ║ │ No current activity post-2018 [Last exposure 2018] ║ ║ │ ║ ║ └─ Risk Level LOW (historical mobile use, no current exposure) [ARCHIVED] ║ ║ ║ ║ ═══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════ ║ ║ ║ ║ IP GEOLOCATION TIMELINE SUMMARY ║ ║ └─ 2013: Virgin Media (Camden, London NW3) [North London residential] ║ ║ └─ 2018: BlackBerry (Ross-on-Wye, Herefordshire HR9) — Uncertain use [Possible mobile/temporary] ║ ║ └─ 2018: Vodafone (London W1B, city center) — Concurrent mobile use [London city center] ║ ║ └─ Current (2025): No active IP geolocation (Manchester M40 9PL per user input) [User-provided address only] ║ ║ ║ ║ GEOGRAPHIC INTERPRETATION ║ ║ ├─ Confirmed Residence (2013) Camden, London NW3 (Virgin Media ISP) [Historical home] ║ ║ ├─ Activity Center (2018) London area (W1B mobile) + uncertain (HR9) [2018 movements] ║ ║ ├─ Current Address (User-Provided) Moston, Manchester M40 9PL [Unverified in breaches] ║ ║ │ ║ ║ ├─ Timeline Coherence 2013 London → 2018 London area → 2025 Manchester [Plausible relocation] ║ ║ │ (12-year span, one major relocation) [Reasonable pattern] ║ ║ │ ║ ║ └─ Conclusion NO CONTRADICTIONS — Manchester claim is plausible [NOT CONTRADICTED] ║ ║ No breach data contradicts Manchester address [Data gap, not conflict] ║ ║ ║ ╚══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝ ╔══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗ ║[0x07 - Evidence Chain & Linkage Analysis]▓░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░▓║ ╠══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╣ ║ ║ ║ CHAIN LINK #1: Email → Identity (100% CONFIRMED) [IDENTITY ANCHOR] ║ ║ ├─ Connection shellathome@hotmail.co.uk → Michelle Anderson [Primary email to name] ║ ║ ├─ Source Deezer breach (2022) [Direct name exposure] ║ ║ ├─ Additional Data in Link Full name + DOB (1977-02-08) + Gender (Female) + Country (GB) ║ ║ ├─ Verification Method Email stored in Deezer account with full user details [Account registration] ║ ║ ├─ Confidence Score 100% [CRYPTOGRAPHICALLY CONFIRMED] [Full name + DOB match] ║ ║ ├─ Strength Rating 🟢 ANCHOR LINK — Highest confidence [Best verification] ║ ║ └─ Verdict THIS IS THE TARGET'S PRIMARY EMAIL — CONFIRMED [DEFINITIVE] ║ ║ ║ ║ CHAIN LINK #2: Phone → Identity (100% CONFIRMED) [IDENTITY ANCHOR] ║ ║ ├─ Connection +447704206403 → Facebook ID 100000748285121 [Phone to profile] ║ ║ │ → Michelle Anderson, Female, GB [Direct identity mapping] ║ ║ ├─ Source Facebook breach (2021) [Phone number leak] ║ ║ ├─ Additional Data in Link Full name + Gender + Country [Account metadata] ║ ║ ├─ Verification Method Phone directly mapped to Facebook ID in breach dump [Phone-to-account link] ║ ║ ├─ WhatsApp Corroboration Same phone confirmed in WhatsApp breach (2021) [Multi-platform verification] ║ ║ ├─ Confidence Score 100% [CRYPTOGRAPHICALLY CONFIRMED] [Direct phone mapping] ║ ║ ├─ Strength Rating 🟢 ANCHOR LINK — Highest confidence [Phone-to-ID direct] ║ ║ └─ Verdict THIS IS THE TARGET'S PHONE — CONFIRMED [DEFINITIVE] ║ ║ ║ ║ CHAIN LINK #3: Email ↔ Usernames (95% CONFIRMED) [ALIAS VERIFICATION] ║ ║ ├─ Connection shellathome@hotmail.co.uk → Multiple usernames [Email to handles] ║ ║ ├─ Verified Usernames Tied to Email: ║ ║ │ ✓ lady_m_xxx (Twitter, Deezer, MyFitnessPal) [Primary consistent alias] ║ ║ │ ✓ blackface30 (iMesh, Ashley Madison) [Adult site cross-match] ║ ║ │ ✓ blackfacebaby (MySpace) [Legacy platform] ║ ║ │ ✓ Michelle_xx_35 (MyFitnessPal primary) [Email variant] ║ ║ │ ✓ knigomanka9 (Zoosk — email verified, not Russian) [Dating platform] ║ ║ │ ║ ║ ├─ Sources Deezer, Twitter, iMesh, MyFitnessPal, Zoosk, MySpace [5+ independent breaches] ║ ║ ├─ Verification Method All usernames appear on same email across different [Multi-source confirmation] ║ ║ │ breach databases (independent data sources) [No collusion possible] ║ ║ ├─ Confidence Score 95% [MULTI-SOURCE CONFIRMED] [5+ independent sources] ║ ║ ├─ Strength Rating 🟢 STRONG LINK — Consistent across platforms [Well-corroborated] ║ ║ └─ Verdict EMAIL ALIASES CONFIRMED — All usernames belong to [VERIFIED ALIASES] ║ ║ this target across long time span (2008–2022) [13+ year consistency] ║ ║ ║ ║ CHAIN LINK #4: Secondary Email ↔ Primary Email (90% CONFIRMED) [DUAL ACCOUNT VERIFICATION] ║ ║ ├─ Connection michelle.anderson2@vodafone.com → shellathome@ [Secondary email to primary] ║ ║ │ hotmail.co.uk (same person) [Dual account evidence] ║ ║ ├─ Primary Evidence Both emails used for MyFitnessPal accounts [Same platform, dual accounts] ║ ║ │ (Michelle_xx_35 primary / Lady_M_xxx secondary) [Consistent alias] ║ ║ ├─ Consistency Signal Both accounts on MyFitnessPal use same alias [Lady_M_xxx on both] ║ ║ │ "Lady_M_xxx" → indicates same person [Alias consistency] ║ ║ ├─ Secondary Evidence Vodafone email + Vodafone IP (212.183.128.85) [Brand-consistent] ║ ║ │ + Vodafone ISP name matches email domain [Internal consistency] ║ ║ ├─ Sources MyFitnessPal (2018), email domain consistency [Behavioral evidence] ║ ║ ├─ Confidence Score 90% [STRONG CIRCUMSTANTIAL] [Multiple converging signals] ║ ║ ├─ Strength Rating 🟡 STRONG LINK — High confidence [Well-supported] ║ ║ └─ Verdict SECONDARY EMAIL LIKELY BELONGS TO SAME PERSON [VERY LIKELY SAME TARGET] ║ ║ ║ ║ CHAIN LINK #5: Password Reuse (100% CONFIRMED) [CREDENTIAL OWNERSHIP] ║ ║ ├─ Connection Password "Par1slea" → Same person across services [Password consistency] ║ ║ ├─ Exposed Across Services iMesh, Collection #1/#2/#4, Exploit.in, [10+ sources] ║ ║ │ Alien TxtBase (2025), AntiPublic, others [Plaintext circulation] ║ ║ ├─ Significance Same unique password reused = strong same-person [Account linking] ║ ║ │ signal (accounts reusing same password often [High confidence] ║ ║ │ belong to same person due to password reuse habits) [Behavioral pattern] ║ ║ ├─ Confidence Score 100% [CRYPTOGRAPHIC MATCH] [Same password string] ║ ║ ├─ Strength Rating 🟢 DEFINITIVE LINK [Strongest evidence] ║ ║ └─ Verdict SINGLE PERSON — Password reuse confirms all linked [SAME INDIVIDUAL] ║ ║ accounts belong to same target [No collision possible] ║ ║ ║ ║ CHAIN LINK #6: Username "blackface30" Cross-Platform (85% CONFIRMED) [ADULT SITE LINKAGE] ║ ║ ├─ Connection blackface30 (iMesh) ↔ Blackface30 (Ashley Madison) [Same handle] ║ ║ ├─ Email Verification iMesh: shellathome@hotmail.co.uk (verified) [iMesh email confirmed] ║ ║ │ Ashley Madison: NO EMAIL in AM data [Username only in AM] ║ ║ ├─ Confidence Basis Identical username on both platforms [Same handle] ║ ║ │ iMesh email confirmed to target [Email verification] ║ ║ │ Unique-enough handle (not "user123") → collision [Distinctive handle] ║ ║ │ unlikely [Minimal collision risk] ║ ║ ├─ Cross-Platform Timeline iMesh (2013) → Ashley Madison (2015) — 2 year span [Plausible progression] ║ ║ ├─ Confidence Score 85% [USERNAME MATCH + EMAIL VERIFICATION] [Strong cross-reference] ║ ║ ├─ Strength Rating 🟡 STRONG LINK — High confidence [Well-founded] ║ ║ └─ Verdict ASHLEY MADISON ACCOUNT LIKELY BELONGS TO TARGET [PROBABLE] ║ ║ (Username matches iMesh with verified email) [Cross-platform consistency] ║ ║ ║ ║ CHAIN LINK #7: Geographic Consistency (80% CONFIRMED) [LOCATION COHERENCE] ║ ║ ├─ Connection 3 IPs over 5 years → Coherent geographic pattern [Location timeline] ║ ║ ├─ Timeline: ║ ║ │ 2013: Camden, London NW3 (Virgin Media — residential) [Home address] ║ ║ │ 2018: London W1B city center (Vodafone mobile) + HR9 (BlackBerry uncertain) [Mobile + travel?] ║ ║ │ 2025: Manchester M40 9PL (user-provided, unverified) [Claimed current] ║ ║ │ ║ ║ ├─ Geographic Coherence London 2013–2018 → Manchester 2025 [Single relocation] ║ ║ │ (142 miles, plausible 12-year move) [Reasonable migration] ║ ║ │ No contradictions or impossible jumps [No red flags] ║ ║ ├─ Consistency Check All UK-based locations [Consistent geography] ║ ║ │ No international jumps [Plausible pattern] ║ ║ ├─ Confidence Score 80% [PLAUSIBLE BUT UNVERIFIED] [Logical progression] ║ ║ ├─ Strength Rating 🟡 MODERATE LINK — Coherent but not conclusive [No contradictions] ║ ║ └─ Verdict GEOGRAPHIC TIMELINE CHECKS OUT — Manchester claim [COMPATIBLE DATA] ║ ║ is plausible; no contradiction found [Supports user input] ║ ║ ║ ║ ═══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════ ║ ║ ║ ║ KNOWN FALSE POSITIVES & COLLISIONS (EXCLUDED FROM PROFILE) [QUALITY CONTROL] ║ ║ ├─ Username "knigomanka9" (Russian user) [COLLISION EXCLUDED] ║ ║ │ ├─ Russian User Identity Nataliya Glushchenko, Kurchatov, Russia [Different person] ║ ║ │ ├─ Russian Platform Hits 30+ entries across Russian sites (not included) [All Russian hits excluded] ║ ║ │ ├─ Email Verification Zoosk account shellathome@hotmail.co.uk (UK user) [Email confirms UK person] ║ ║ │ ├─ Verdict COLLISION — Russian user reuses same handle [EXCLUDED] ║ ║ │ └─ Impact Only Zoosk (2015) entry used; Russian hits ignored [Cleaned data] ║ ║ │ ║ ║ ├─ Postcode M40 9PL (Moston, Manchester) [FALSE POSITIVE EXCLUDED] ║ ║ │ ├─ Search Results 39 stealer logs for usernames "m40" and "9pl" [Postcode-derived handles] ║ ║ │ ├─ Users Identified Multiple unrelated people (m40, 9pl handle users) [NOT Michelle] ║ ║ │ ├─ Email Matches No "shellathome@hotmail.co.uk" in M40 9PL logs [Wrong person entirely] ║ ║ │ ├─ Verdict COLLISION — Users registered with postcode format [EXCLUDED] ║ ║ │ │ as username (common UK pattern for password hints) [Not target] ║ ║ │ └─ Impact Address plausible but unverified in breaches [Data gap] ║ ║ │ ║ ║ └─ Username "michael anderson" variants (full name search) [FALSE POSITIVE EXCLUDED] ║ ║ ├─ Search Results Hundreds of unrelated Michelle/Michael Andersons [Generic name] ║ ║ ├─ Email Matches None matched to shellathome@hotmail.co.uk [Different people] ║ ║ ├─ Verdict COLLISION — Common name produces too much noise [EXCLUDED] ║ ║ └─ Impact No additional data from full-name search [Low-value search] ║ ║ ║ ║ ═══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════ ║ ║ ║ ║ OVERALL LINKAGE ASSESSMENT: 🟢 CONFIRMED IDENTITY (100%) [HIGHEST CONFIDENCE] ║ ║ ├─ Primary Anchors (100% each) Email + DOB (Deezer), Phone + FB ID (Facebook) [Cryptographic) ║ ║ ├─ Secondary Verifications (90–95%) Usernames x5 sources, dual email accounts [Well-corroborated] ║ ║ ├─ Tertiary Support (80–85%) Geography, cross-platform handles, password reuse [Converging signals] ║ ║ ├─ Data Quality Score EXCELLENT — Multiple independent sources [17+ breaches] ║ ║ ├─ False Positive Risk MINIMAL — Collision signals identified & excluded [Cleaned dataset] ║ ║ └─ Verdict 🟢 IDENTIFIED TARGET WITH 100% CONFIDENCE [DEFINITIVE MATCH] ║ ║ Michelle Anderson (1977-02-08) — Moston, Manchester [CONFIRMED IDENTITY] ║ ║ ║ ╚══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╝ Boring shit: ╔══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗ ║[0x08 - Risk Assessment & Recommendations]▓░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░▓║ ╠══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╣ ║ ║ ║ 🔴 OVERALL RISK LEVEL: CRITICAL [IMMEDIATE ACTION REQUIRED] ║ ║ ║ ║ ═══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════ ║ ║ ║ ║ THREAT VECTOR #1: CREDENTIAL STUFFING ATTACK (IMMEDIATE RISK) [PROBABILITY: 95%] ║ ║ ├─ Attack Method Automated password "spraying" using exposed password [Mass attack vector] ║ ║ ├─ Attacker Access Par1slea (plaintext) available in every major [No barrier to entry] ║ ║ │ credential-stuffing toolkit (Shodan, leak indexes) [Trivial to obtain] ║ ║ ├─ Target Accounts at Risk ANY account where Par1slea (or variants) were reused [Cascade takeover] ║ ║ │ • iMesh (if still accessible) [Direct plaintext match] ║ ║ │ • MyFitnessPal (both accounts) [Hash exposure known] ║ ║ │ • Email account (if same password reused) [Account recovery vector] ║ ║ ├─ Exposure Timeline Password exposed: 2013–2018 (when iMesh/MFP set) [Long exposure] ║ ║ │ In active circulation: 2016–2025 (9+ years) [Current threat] ║ ║ ├─ Impact if Successful Full compromise of all accounts using that password [Wholesale takeover] ║ ║ │ Email account takeover (password reset access) [Cascading failure] ║ ║ │ All linked accounts (Twitter, Facebook, etc.) [Chain reaction] ║ ║ ├─ Attacker Skill Required LOW — Automated tools exist (credential-stuffing [Script kiddie level] ║ ║ │ bots, paid services, open-source tools) [No skill barrier] ║ ║ │ ║ ║ └─ MITIGATION PRIORITY: 🔴 HIGHEST — Assume accounts are being actively attacked [DO NOT DELAY] ║ ║ Change ALL passwords immediately using completely new values [CRITICAL ACTION] ║ ║ ║ ║ THREAT VECTOR #2: EMAIL COMPROMISE (HIGH RISK) [PROBABILITY: 80%] ║ ║ ├─ Exposure Type Email addresses in 17+ breach compilations [Mass exposure] ║ ║ ├─ Email Verification Timing Most breaches 7–12 years old (2013–2018) [Sustained exposure] ║ ║ ├─ Current Risk Emails in active credential-stuffing wordlists [Commonly used] ║ ║ │ Every hacking attempt includes these addresses [Standard inclusion] ║ ║ ├─ Account Takeover Vector Email = password reset mechanism for all accounts [Master key] ║ ║ │ Attacker gains email access → reset all passwords [Chain failure] ║ ║ ├─ Secondary Email as Backup Secondary email michelle.anderson2@vodafone.com [Also compromised] ║ ║ │ ALSO exposed (5+ breaches) — no backup protection [No safe fallback] ║ ║ │ ║ ║ └─ MITIGATION PRIORITY: 🔴 HIGHEST — Email is master account; must be secured [CRITICAL] ║ ║ Enable 2FA immediately; consider new email address creation [URGENT] ║ ║ ║ ║ THREAT VECTOR #3: PHONE NUMBER EXPLOITATION (HIGH RISK) [PROBABILITY: 70%] ║ ║ ├─ Exposure Type Phone number +447704206403 in Facebook breach [Identity linking] ║ ║ ├─ Direct Identity Link Phone directly tied to Facebook profile [Personal information] ║ ║ ├─ SIM Swap Attack Risk Phone number exposed → attacker could port number [Account takeover] ║ ║ │ to new SIM → gain 2FA codes for email/accounts [Common attack] ║ ║ ├─ Secondary Risks Phone used in WhatsApp breach (2021) [Platform exposure] ║ ║ │ Phone associated with Deezer account [Service linking] ║ ║ ├─ Attack Difficulty MEDIUM — Requires social engineering with carrier [Not trivial] ║ ║ │ but increasingly common (script-kiddie tools exist) [Growing risk] ║ ║ │ ║ ║ └─ MITIGATION PRIORITY: 🟠 HIGH — Protect phone account from SIM swap [IMPORTANT] ║ ║ Add PIN/password protection with UK carrier [PROACTIVE] ║ ║ Contact carrier proactively to flag account as "at risk" [PREVENTION] ║ ║ ║ ║ THREAT VECTOR #4: ADULT SITE PRIVACY BREACH (MEDIUM-HIGH RISK) [PROBABILITY: 60%] ║ ║ ├─ Service Exposed Ashley Madison account (Blackface30) [Adult infidelity site] ║ ║ ├─ Breach Date 2015 — notorious Impact Team leak [Highly publicized] ║ ║ ├─ Password Hash Status bcrypt (strong) — unlikely to crack [Protected hash] ║ ║ ├─ Blackmail Risk HIGH — Adult site registrations often used for [Extortion vector] ║ ║ │ extortion ("I found you on Ashley Madison, pay $X") [Common scam] ║ ║ ├─ Personal Impact Relationship/marriage implications [Privacy sensitive] ║ ║ │ Professional/social consequences if exposed [Reputational risk] ║ ║ ├─ Attacker Motivation Financial (extortion) [Money-driven] ║ ║ │ Harassment/blackmail [Malicious intent] ║ ║ │ ║ ║ └─ MITIGATION PRIORITY: 🟠 MEDIUM-HIGH — Be aware of potential blackmail scams [VIGILANCE] ║ ║ Ignore extortion emails (do not pay) [STANDARD ADVICE] ║ ║ Monitor email for "Ashley Madison" + password combination [DETECTION] ║ ║ Report threats to authorities if they occur [ESCALATION] ║ ║ ║ ║ THREAT VECTOR #5: IDENTITY THEFT / SYNTHETIC IDENTITY FRAUD (MEDIUM RISK) [PROBABILITY: 50%] ║ ║ ├─ Data Exposed Full name, DOB, address (historical), phone [Identity components] ║ ║ ├─ Identity Theft Risk Attacker has enough data to open accounts in target [Account creation] ║ ║ │ name (credit, loans, mobile contracts) [Financial fraud] ║ ║ ├─ Detection Difficulty MEDIUM — Would show as accounts in target's name [Checking required] ║ ║ │ but address/phone might be different [Harder to spot] ║ ║ ├─ Current Address Unknown Attacker only has historical London address [Reduces some fraud] ║ ║ │ (2013); if target relocated to Manchester, attacker [Old data] ║ ║ │ would use wrong address for mail fraud [Mitigating factor] ║ ║ │ ║ ║ └─ MITIGATION PRIORITY: 🟠 MEDIUM — Monitor credit reports & financial accounts [ONGOING] ║ ║ Check for fraudulent accounts in target's name [QUARTERLY] ║ ║ Place fraud alert / credit freeze with UK credit agencies [PROACTIVE] ║ ║ ║ ║ ║ ║ ═══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════ ║ ║ ║ ║ SUMMARY RISK ASSESSMENT ║ ║ ├─ Credential Compromise Risk 🔴 CRITICAL (Passwords in plaintext, active use) [IMMEDIATE DANGER] ║ ║ ├─ Email Compromise Risk 🔴 CRITICAL (17+ breaches, no backup safe) [MASTER ACCOUNT] ║ ║ ├─ Account Takeover Risk 🔴 CRITICAL (Automated attacks likely underway) [HIGH PROBABILITY] ║ ║ ├─ Identity Theft Risk 🟠 MEDIUM-HIGH (Full name, DOB, address exposed) [ONGOING THREAT] ║ ║ ├─ SIM Swap / Phone Risk 🟠 MEDIUM (Phone in breaches, port-out possible) [SECONDARY] ║ ║ ├─ Blackmail / Extortion Risk 🟠 MEDIUM (Ashley Madison registration) [PRIVACY SENSITIVE] ║ ║ ├─ Data Monetization Risk 🟡 MEDIUM-LOW (Credentials sold to criminals) [PASSIVE THREAT] ║ ║ │