GO TO DOXBIN.COM FOR THE FULL PASTE: ╔══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗ ║ █████╗ ██████╗ ██████╗ ║ ║ ██╔══██╗██╔════╝ ██╔════╝ ║ ║ ███████║██║ ███╗██║ ███╗ ║ ║ ██╔══██║██║ ██║██║ ██║ ║ ║ ██║ ██║╚██████╔╝╚██████╔╝ ║ ║ ╚═╝ ╚═╝ ╚═════╝ ╚═════╝ ║ ║ BY: STREEX, Halo, swappedfunds (ACC OWNER) ║ ║ Terra nova members, Yall think u have opsec? LOOL ║ ╚═══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════ [ PRIMARY TARGET ] IP Address: 149.19.165.170 Location: Brazil (BR) Platform: 1win.com (Gambling/Betting) Total Accounts Linked: 8 [ CONNECTION MAP ] +-----------------------+ | 149.19.165.170 | | (Target IP) | +-----------+-----------+ | +---------------------------+---------------------------+ | | | v v v +-----------------+ +-----------------+ +-----------------+ | prolory48 | | quinteladamaso | | wandersoncaetano| | @gmail.com | | @hotmail.com | | @gmail.com | | Phone: 75988100593| | Phone: 63981214461| | Phone: 93991456012| | DOB: 2005-01-25 | | DOB: 2005-06-08 | | DOB: 2004-07-17 | | Name: 1win | | Name: 1win | | Name: 1win | +-----------------+ +-----------------+ +-----------------+ | | | v v v +-----------------+ +-----------------+ +-----------------+ | almeidaalana727 | | nadirmatheus778 | | jppaulodamasceno| | @gmail.com | | @gmail.com | | @gmail.com | | Phone: 6692038158| | Phone: 67999404101| | Phone: 94992656429| | DOB: 1990-01-01 | | DOB: 2005-12-20 | | DOB: 2005-01-11 | | Name: Alana | | Name: 1win | | Name: 1win | +-----------------+ +-----------------+ +-----------------+ | | v v +-----------------+ +-----------------+ | luccambastos | | fariasmanoeldavid| | @outlook.com | | @gmail.com | | Phone: 31996659991| | Phone: 97984273746| | DOB: 2005-02-13 | | DOB: 2005-09-14 | | Name: 1win | | Name: ACqVTc | +-----------------+ +-----------------+ [ PATTERNS & CONNECTIONS ] CONNECTION TYPE: SAME IP ----------------------------------------------------- All 8 email accounts are registered to the same IP address: 149.19.165.170. This indicates a shared network origin (home, office, proxy, or VPN). EMAIL PATTERNS ----------------------------------------------------- Domain Distribution: - Gmail: 6 accounts (prolory48, wandersoncaetano773, almeidaalana727, nadirmatheus778, jppaulodamasceno, fariasmanoeldavid) - Hotmail: 1 account (quinteladamaso) - Outlook: 1 account (luccambastos) Username Types: - Random Characters (prolory48, ACqVTc): 2 accounts - Full Name (wandersoncaetano773, quinteladamaso, almeidaalana727, nadirmatheus778, jppaulodamasceno, luccambastos, fariasmanoeldavid): 6 accounts - Name: almeidaalana727 (Alana) PHONE NUMBER PATTERNS ----------------------------------------------------- Area Codes Detected (Brazil): - 75 (Sergipe): 1 phone (75988100593) - 63 (Tocantins): 1 phone (63981214461) - 93 (Para): 1 phone (93991456012) - 66 (Mato Grosso): 1 phone (6692038158) - 67 (Mato Grosso do Sul): 1 phone (67999404101) - 94 (Para): 1 phone (94992656429) - 31 (Minas Gerais): 1 phone (31996659991) - 97 (Amazonas): 1 phone (97984273746) Phone Format Consistency: - All phones follow pattern: +55 + Area Code + 9-digit number - All appear to be valid mobile numbers Anomalies: - No missing area codes or irregular formats detected AGE & DOB PATTERNS ----------------------------------------------------- Group 1 - Born 2005 (Age 20 at breach): - prolory48 (2005-01-25) - quinteladamaso (2005-06-08) - jppaulodamasceno (2005-01-11) - nadirmatheus778 (2005-12-20) - luccambastos (2005-02-13) - fariasmanoeldavid (2005-09-14) - almeidaalana727 (1990-01-01 - outlier) Total: 6 accounts (age 20) Group 2 - Born 2004 (Age 21 at breach): - wandersoncaetano773 (2004-07-17) Total: 1 account (age 21) Group 3 - Born 1990 (Age 36 at breach): - almeidaalana727 (1990-01-01) Note: Uses generic placeholder birth date Total: 1 account NAME PATTERNS ----------------------------------------------------- Valid Full Names Found: - Alana (almeidaalana727) - Name present but incomplete - All other accounts use placeholder "1win" as full name Random/Generated Usernames: - ACqVTc (fariasmanoeldavid) - Appears randomly generated TIMELINE ----------------------------------------------------- Earliest Breach: 2022-07-31 (wandersoncaetano773) Latest Breach: 2024-01-03 (nadirmatheus778) Breach Dates Chronological: - 2022-07-31: wandersoncaetano773 - 2023-01-25: jppaulodamasceno - 2023-02-08: prolory48 - 2023-02-27: luccambastos - 2023-06-22: quinteladamaso - 2023-09-29: fariasmanoeldavid - 2023-12-31: almeidaalana727 - 2024-01-03: nadirmatheus778 Activity Span: Approximately 1 year and 5 months [ CROSS-IP CONNECTIONS (Previous Analysis) ] RELATED IPS IDENTIFIED ----------------------------------------------------- 1. 138.0.64.156 - Previously analyzed (also linked to 1win.com) - Connection: Same platform (1win.com) - Different IP, similar breach patterns 2. 181.174.254.3 - Previously analyzed (also linked to 1win.com) - Connection: Same platform (1win.com) - Similar account creation patterns Multiple IPs with identical breach patterns suggests coordinated activity across different networks. [ PATTERN COMPARISON: IP 149.19.165.170 vs 181.174.254.3 ] SIMILARITIES: ----------------------------------------------------- - Same platform (1win.com) - Same country (Brazil) - Majority of users born 2004-2005 (legal gambling age) - Phone numbers follow Brazilian format (+55 + area code + number) - Presence of placeholder data ("1win" as name) - Presence of outlier with 1990-01-01 birth date DIFFERENCES: ----------------------------------------------------- - 149.19.165.170 has no Hotmail addresses (except quinteladamaso) - 149.19.165.170 has no random username patterns (except ACqVTc) - 149.19.165.170 phone numbers are more geographically diverse