╔══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════╗
║                                      █████╗  ██████╗  ██████╗                                                                            ║
║                                     ██╔══██╗██╔════╝ ██╔════╝                                                                            ║
║                                     ███████║██║  ███╗██║  ███╗                                                                           ║
║                                     ██╔══██║██║   ██║██║   ██║                                                                           ║
║                                     ██║  ██║╚██████╔╝╚██████╔╝                                                                           ║
║                                     ╚═╝  ╚═╝ ╚═════╝  ╚═════╝                                                                            ║
║                                   BY: STREEX, Halo, swappedfunds (ACC OWNER)                                                             ║
║                                   Terra nova members, Yall think u have opsec? LOOL                                                      ║
╚═══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════


[ PRIMARY TARGET ]
IP Address: 149.19.165.170
Location: Brazil (BR)
Platform: 1win.com (Gambling/Betting)
Total Accounts Linked: 8


[ CONNECTION MAP ]

                             +-----------------------+
                             |    149.19.165.170     |
                             |      (Target IP)      |
                             +-----------+-----------+
                                         |
             +---------------------------+---------------------------+
             |                           |                           |
             v                           v                           v
   +-----------------+         +-----------------+         +-----------------+
   | prolory48       |         | quinteladamaso  |         | wandersoncaetano|
   | @gmail.com      |         | @hotmail.com    |         | @gmail.com      |
   | Phone: 75988100593|        | Phone: 63981214461|        | Phone: 93991456012|
   | DOB: 2005-01-25 |         | DOB: 2005-06-08 |         | DOB: 2004-07-17 |
   | Name: 1win      |         | Name: 1win      |         | Name: 1win      |
   +-----------------+         +-----------------+         +-----------------+
             |                           |                           |
             v                           v                           v
   +-----------------+         +-----------------+         +-----------------+
   | almeidaalana727 |         | nadirmatheus778 |         | jppaulodamasceno|
   | @gmail.com      |         | @gmail.com      |         | @gmail.com      |
   | Phone: 6692038158|         | Phone: 67999404101|        | Phone: 94992656429|
   | DOB: 1990-01-01 |         | DOB: 2005-12-20 |         | DOB: 2005-01-11 |
   | Name: Alana     |         | Name: 1win      |         | Name: 1win      |
   +-----------------+         +-----------------+         +-----------------+
             |                           |
             v                           v
   +-----------------+         +-----------------+
   | luccambastos    |         | fariasmanoeldavid|
   | @outlook.com    |         | @gmail.com       |
   | Phone: 31996659991|        | Phone: 97984273746|
   | DOB: 2005-02-13 |         | DOB: 2005-09-14 |
   | Name: 1win      |         | Name: ACqVTc     |
   +-----------------+         +-----------------+


[ PATTERNS & CONNECTIONS ]

CONNECTION TYPE: SAME IP
-----------------------------------------------------
All 8 email accounts are registered to the same IP address: 149.19.165.170.
This indicates a shared network origin (home, office, proxy, or VPN).


EMAIL PATTERNS
-----------------------------------------------------
Domain Distribution:
  - Gmail: 6 accounts (prolory48, wandersoncaetano773, almeidaalana727, nadirmatheus778, jppaulodamasceno, fariasmanoeldavid)
  - Hotmail: 1 account (quinteladamaso)
  - Outlook: 1 account (luccambastos)

Username Types:
  - Random Characters (prolory48, ACqVTc): 2 accounts
  - Full Name (wandersoncaetano773, quinteladamaso, almeidaalana727, nadirmatheus778, jppaulodamasceno, luccambastos, fariasmanoeldavid): 6 accounts
  - Name: almeidaalana727 (Alana)


PHONE NUMBER PATTERNS
-----------------------------------------------------
Area Codes Detected (Brazil):
  - 75 (Sergipe): 1 phone (75988100593)
  - 63 (Tocantins): 1 phone (63981214461)
  - 93 (Para): 1 phone (93991456012)
  - 66 (Mato Grosso): 1 phone (6692038158)
  - 67 (Mato Grosso do Sul): 1 phone (67999404101)
  - 94 (Para): 1 phone (94992656429)
  - 31 (Minas Gerais): 1 phone (31996659991)
  - 97 (Amazonas): 1 phone (97984273746)

Phone Format Consistency:
  - All phones follow pattern: +55 + Area Code + 9-digit number
  - All appear to be valid mobile numbers

Anomalies:
  - No missing area codes or irregular formats detected


AGE & DOB PATTERNS
-----------------------------------------------------
Group 1 - Born 2005 (Age 20 at breach):
  - prolory48 (2005-01-25)
  - quinteladamaso (2005-06-08)
  - jppaulodamasceno (2005-01-11)
  - nadirmatheus778 (2005-12-20)
  - luccambastos (2005-02-13)
  - fariasmanoeldavid (2005-09-14)
  - almeidaalana727 (1990-01-01 - outlier)
  Total: 6 accounts (age 20)

Group 2 - Born 2004 (Age 21 at breach):
  - wandersoncaetano773 (2004-07-17)
  Total: 1 account (age 21)

Group 3 - Born 1990 (Age 36 at breach):
  - almeidaalana727 (1990-01-01)
  Note: Uses generic placeholder birth date
  Total: 1 account


NAME PATTERNS
-----------------------------------------------------
Valid Full Names Found:
  - Alana (almeidaalana727) - Name present but incomplete
  - All other accounts use placeholder "1win" as full name

Random/Generated Usernames:
  - ACqVTc (fariasmanoeldavid) - Appears randomly generated


TIMELINE
-----------------------------------------------------
Earliest Breach: 2022-07-31 (wandersoncaetano773)
Latest Breach:  2024-01-03 (nadirmatheus778)

Breach Dates Chronological:
  - 2022-07-31: wandersoncaetano773
  - 2023-01-25: jppaulodamasceno
  - 2023-02-08: prolory48
  - 2023-02-27: luccambastos
  - 2023-06-22: quinteladamaso
  - 2023-09-29: fariasmanoeldavid
  - 2023-12-31: almeidaalana727
  - 2024-01-03: nadirmatheus778

Activity Span: Approximately 1 year and 5 months


[ CROSS-IP CONNECTIONS (Previous Analysis) ]

RELATED IPS IDENTIFIED
-----------------------------------------------------
1. 138.0.64.156 - Previously analyzed (also linked to 1win.com)
   - Connection: Same platform (1win.com)
   - Different IP, similar breach patterns

2. 181.174.254.3 - Previously analyzed (also linked to 1win.com)
   - Connection: Same platform (1win.com)
   - Similar account creation patterns

Multiple IPs with identical breach patterns suggests coordinated activity across different networks.


[ PATTERN COMPARISON: IP 149.19.165.170 vs 181.174.254.3 ]

SIMILARITIES:
-----------------------------------------------------
- Same platform (1win.com)
- Same country (Brazil)
- Majority of users born 2004-2005 (legal gambling age)
- Phone numbers follow Brazilian format (+55 + area code + number)
- Presence of placeholder data ("1win" as name)
- Presence of outlier with 1990-01-01 birth date

DIFFERENCES:
-----------------------------------------------------
- 149.19.165.170 has no Hotmail addresses (except quinteladamaso)
- 149.19.165.170 has no random username patterns (except ACqVTc)
- 149.19.165.170 phone numbers are more geographically diverse