═══════════════════════════════════════════════════════════════════ DOX FILE — TARGET PROFILE ═══════════════════════════════════════════════════════════════════ Compiled: 2026-09-13 Source basis: Discord ID pivot → 10+ breach corpora aggregated Confidence tiers: [H] = high (≥2 independent sources or verified live) [M] = medium (single source, plausible) [L] = low / unverified / suspected fake ═══════════════════════════════════════════════════════════════════ 1. IDENTITY ═══════════════════════════════════════════════════════════════════ Real name (primary hypothesis): Tayfun Toprak [H] - Twitter public metadata (@EA527, since 2010-03-08) - Badoo breach 2013-06 (leak_id 6041) - Badoo breach 2013-06 (leak_id 334, duplicate confirmation) Alt name in leak (unresolved): Eyüp Horuz [L] - leak_id 2935, joined_date 2013-07-21 - Single source; possibly alias, fake registration, or unrelated account sharing the email Sex: Male [H] Nationality: Turkish [H] Country: Türkiye [H] Likely city: Denizli [M] - Landline area code 0258 = Denizli province Birth data: DOB (Badoo): 1985-01-01 (epoch-fake default) [L] DOB (Fling): 1989-09-23 [M] Working assumption: Born ~1989, age ~36 in 2026 ═══════════════════════════════════════════════════════════════════ 2. ONLINE IDENTITY / HANDLES ═══════════════════════════════════════════════════════════════════ Primary email: siirle.cehsu1@gmail.com [H] - Active since ≥2012-03-22 - 176 months old (Gmail account) - Deliverable, valid, not disposable - DMARC enforced, SPF strict - Etymology: siirle = "şiirle" = "with poetry" (Turkish) Alt / one-off emails observed: (none surfaced yet) Google Account: Google ID (permanent): 107791899830342310071 [H] Reachable apps: YouTube, Maps Cover photo: lh3.googleusercontent.com/c5dqxl-2uHZ82ah9p7yxrVF1ZssrJNSV_15Nu0TUZwzCWqmtoLxCUJgEzLGtxsrJ6-v6R6rKU_-FYm881TTiMCJ_ Avatar: lh3.googleusercontent.com/a-/ALV-UjUr3QMRZ2vHApC9yMILymu_OXPWsfQD1BDsvp7RXYTKcnK6Z0yE Google Maps display name: "Geldi Geçti" ("came and went") Reviews URL: https://www.google.com/maps/contrib/107791899830342310071/reviews Discord: Snowflake: 1211215796089528322 [H] Account created: 2024-02-25 07:39:09 UTC Current username: fs6r Global name / display: 6 Discriminator: 0 (post-migration) Avatar hash: 61a9f5131ec48453b516285adc512f93 Avatar URL: https://cdn.discordapp.com/avatars/1211215796089528322/61a9f5131ec48453b516285adc512f93.png?size=1024 Accent / banner color: #000000 (default) Public flags: 0 (no badges) Twitter / X: Handle: @EA527 [H] Created: 2010-03-08 21:18:55 UTC Followers: 275–276 (as of 2022-01 scrape) Display name: Tayfun Toprak URL: https://x.com/EA527 Last.fm: Handle: cehset [H] Joined: 2010-07-26 16:25:16 URL: https://www.last.fm/user/cehset Password hash (MD5): 6aa83fc429d33158d1cb762a54436b00 → cracked = "tedirgin13" GitHub: Handle: awordkelimeoyunu [H] Profile ID: 29779197 Created: 2017-06-29 14:41:00Z Last updated: 2019-12-10 20:04:56Z Public repos: 4 (0 stars total) Followers / following: 0 / 0 Activity: Dormant (0 events last year) Keys: 1 GPG, 0 SSH Reverse-lookup match: Confirmed via commit search URL: https://github.com/awordkelimeoyunu Etymology: kelimeoyunu = "word game" (Turkish) Gravatar: Handle: cepkpss [H] Display name: cepkpss URL: https://gravatar.com/cepkpss Avatar hash: c76e617e6257bdbd7a1055d5fc568ff6aef3f916f8b44e20232ff5f92b8f0450 LinkedIn: Slug: eğitim-hane-37bb478b [H] Display name: "Eğitim Hane" ("Education House") Location: Türkiye URL: https://linkedin.com/in/eğitim-hane-37bb478b Interpretation: Likely his business / tutoring brand or a channel he owns Xat: Handle: yeraltindannotlar [H] Etymology: "Notes from Underground" (Dostoyevsky, Turkish title) Canva: User ID: 99080709 [H] Public ID hash: UADHXgnvLZ8 Personal brand ID: 98534672 / BADHXjPLaHA Display name: siirle.cehsu1 Account created: 2018-10-28 14:45:41 Locale: tr-TR Bcrypt hash: $2a$10$bLUOsiHPeCvCSOI7wjt0POVWVsVxfK7ZTfFMT9QIPvjzDdKIfYyb6 Adobe: Registered: Yes (individual) [H] Status: Active Fling.com: Username: siirle.cehsu106 [H] Registration IP: 88.229.216.220 Registration time: 2009-11-29 16:33:14 Badoo: Username / phone field: 0258569950 [H] Name field: Tayfun Toprak DOB field: 1985-01-01 (fake epoch) Sex: M Password (md5): e4bb355b073d3790497ef9631208ef1c (not yet cracked; feed to hashcat -m 0) Firefox account: Registered [H] Instagram: Registered on landline [H] (via SEON Ignorant hit — handle not yet dereferenced) Confirmed presence on: Twitter / Adobe / Gravatar / Firefox Absent / not confirmed: Dropbox, Patreon, Pinterest (checked, no registration hit) ═══════════════════════════════════════════════════════════════════ 3. STEALER-LOG FOLDER PSEUDOS (his machine was infected) ═══════════════════════════════════════════════════════════════════ Root: 1211215796089528322/* (keyed to his Discord snowflake) /cehset /fsyrz /ohjudas /sagolayqa /sweetdreamspunpun /whiskeu Notes: - IntelByte size 0 / disk id 0 entries → placeholder rows; full archive was pruned or not yet indexed - Each pseudo = a name he actually types (autofill fingerprint) - Full log likely contains: browser cookies, autofill fields (name, phone, address), saved passwords, wallet files, session tokens, Discord token, desktop screenshots, installed program list - Sources to hunt for the full log: HudsonRock Cavalier (free lookup for infection confirmation), Russian Market ($), 2easy ($), Cavalier Free / Redline Cloud / Lumma Logs Telegram channels, BreachForums current mirror - Etymology of sweetdreamspunpun: "sweet dreams" + Oyasumi Punpun (Inio Asano manga) → melancholic literary aesthetic ═══════════════════════════════════════════════════════════════════ 4. NETWORK / DEVICE / GEO ═══════════════════════════════════════════════════════════════════ IP address (historical, Fling 2009): 88.229.216.220 [H] ISP: TTNet (Turkish Telekom retail broadband) Country: Turkey Time: 2009-11-29 16:33:14 Next: Feed through ipinfo.io / MaxMind for exact city, AbuseIPDB for reputation, Shodan for exposed services Landline phone: +90 258 569 95 50 [H] Local format: 0258 569 95 50 E.164: +902585699550 Carrier: TÜRK TELEKOMÜNİKASYON AŞ Type: FIXED_LINE (confirmed by SEON) Country: TR Area code: 0258 → Denizli province Validity: Valid, not disposable SEON risk: 31.95 (low, normal residential line) Linked services: - Instagram registered on this number (SEON Ignorant hit) Actions: - Query Getcontact (+902585699550) → saved-as tags - Query rehber.com.tr → registered subscriber + address - Query 11888.com.tr → alt directory - Google exact-string search: "0258 569 95 50" and variants Mobile phone: Not yet surfaced Likely sources: Yemek Sepeti / Trendyol / Hepsiburada / n11 delivery leaks; stealer-log autofill fields ═══════════════════════════════════════════════════════════════════ 5. CREDENTIALS — PASSWORDS ═══════════════════════════════════════════════════════════════════ Plaintext passwords (recovered from breach dumps): tedirgin13 — Last.fm 2012, comb1, comb2 [H] MD5: 6aa83fc429d33158d1cb762a54436b00 Etymology: tedirgin = "restless / uneasy" 13 = favorite number tedirgin1 — comb1 [H] Variant shark80123 — Fling 2011, antipublic, comb x5 [H] Reused across multiple services Shark80123 — Same, capitalized variant [H] xagiwyja — antipublic, comb, collection-2 [H] Looks machine-generated 131313 — combo lists [H] 0258569950 — combo lists (his own landline as password) [H] Hash-only (uncracked): e4bb355b073d3790497ef9631208ef1c (MD5 — Badoo 2013) Try: hashcat -a 0 -m 0 hash.txt {rockyou, turkish_wordlist} hashcat -a 6 -m 0 hash.txt turkish_words.txt ?d?d?d?d $2a$10$bLUOsiHPeCvCSOI7wjt0POVWVsVxfK7ZTfFMT9QIPvjzDdKIfYyb6 (bcrypt — Canva 2019; expensive to crack) Reuse pattern: - Base word (tedirgin / shark / xagiwyja) + digits - 15+ year reuse without rotation - Own landline as a password → recycles memorable numeric strings ═══════════════════════════════════════════════════════════════════ 6. CONFIRMED DATA BREACHES / DUMPS ═══════════════════════════════════════════════════════════════════ Verified via HIBP + HackCheck + BreachDirectory + IntelVault: 2011-02-01 Fling.com (email + username + IP + pass) 2012-03-22 Last.fm (email + username + pass) 2013-06-01 Badoo (email + phone + name + hash) 2013-10-04 Adobe (email) 2015-11-04 Xat (email + username) 2019-05-24 Canva (email + username + bcrypt) 2020-10-03 Gravatar (email + handle) 2021-01-01 Twitter 200M scrape (email + handle + name) 2021-10-12 CoinMarketCap (email) 2022-01 Twitter scrape (email + handle + name) 2025-04-11 Synthient credential-stuffing threat data ???? XSS.is data breach compilation #2 ???? EU & Russian AntiPublic ???? AntiPublic Combo List (2019) ???? Keywordeye.com (email + username + SHA1) ???? COMB #1 / COMB #2 (email + pass) Total unique breaches: 8 (per SEON) — 12+ counting combos First breach seen: 2012-03-22 Last breach seen: 2025-04-11 Have I Been Pwned: Listed Signal from breach set: - Heavy retail e-commerce user (COMB inclusion) - Crypto holder (CoinMarketCap) - Design/creator interest (Canva) - Long social-media tenure (Twitter 2010, Last.fm 2010) ═══════════════════════════════════════════════════════════════════ 7. SEON — ACCOUNT AGGREGATES (email profile) ═══════════════════════════════════════════════════════════════════ Total registered services detected: 20 Business use: 7 Technology: 5 / 31 Science & education: 1 / 12 Jobs & employment: 1 / 7 Money transfer: 0 / 4 Personal use: 13 Social media: 6 / 17 Entertainment: 2 / 42 E-commerce: 2 / 17 Email service: 1 / 3 Technology: 1 / 6 Health & fitness: 1 / 4 Delivery: 0 / 7 Adult sites: 0 / 6 Dating: 0 / 7 Gaming/betting: 0 / 5 Travel: 0 / 8 Global network risk score: 0.53 (low) Fraud flags: None Associated domain registrations: 0 ═══════════════════════════════════════════════════════════════════ 8. BEHAVIORAL / PSYCH PROFILE ═══════════════════════════════════════════════════════════════════ Cultural signature — literary / melancholic: - yeraltindannotlar → Dostoyevsky (Notes from Underground) - sweetdreamspunpun → Inio Asano (Oyasumi Punpun manga) - siirle → poetry - awordkelimeoyunu → word game - tedirgin → "restless / uneasy" - Geldi Geçti → "came and went" (Turkish elegiac phrase) Life stage: Adult male, born ~1989 (~36 in 2026) Interests: Literature, manga, poetry, crypto, possibly education/tutoring Occupation (suspected): Owner or key figure of "Eğitim Hane" — a tutoring service, education brand, or content channel Technical skill: Consumer-level. GitHub inactive. Not a developer. OPSEC posture: Weak - 15-year password reuse - Own phone as password - Real name on Twitter / Badoo / Adobe - Machine infected by info-stealer - Single email as pivot for 20+ services Timezone fingerprint: Turkey (UTC+3), confirmed by Twitter creation hour, Last.fm scrobble start ═══════════════════════════════════════════════════════════════════ 9. NAME CONFLICT NOTE ═══════════════════════════════════════════════════════════════════ Two candidate names appear in the corpus: Tayfun Toprak — 3 independent sources (Twitter public metadata, Badoo record A, Badoo record B) → HIGH confidence real name Eyüp Horuz — 1 source (leak_id 2935, joined_date 2013-07-21), no context → LOW confidence Likely: fake registration on a Turkish forum or unrelated party sharing the email Working hypothesis: Tayfun Toprak is the real identity. Resolution path: Verify via LinkedIn Eğitim Hane contact, Twitter @EA527 replies, Google Maps review byline. ═══════════════════════════════════════════════════════════════════ 10. NEXT-PIVOT WORKLIST (open leads) ═══════════════════════════════════════════════════════════════════ [ ] Google Maps review cluster on 107791899830342310071 → geo-pin his neighborhood via review density [ ] Twitter @EA527 archive → snscrape --jsonl twitter-user EA527 > ea527.jsonl → grep for city / street / employer [ ] LinkedIn eğitim-hane-37bb478b → resolve "Eğitim Hane" as person vs business → pull contact card, address block [ ] GitHub awordkelimeoyunu commit log → git log --all --format="%an <%ae> %ad" on each of 4 repos → look for private emails / real name / secondary aliases [ ] IP 88.229.216.220 → ipinfo.io / MaxMind → city + district → Shodan → exposed home services → AbuseIPDB → history [ ] Landline: rehber.com.tr / 11888.com.tr on 0258 569 95 50 → registered subscriber name + address [ ] Getcontact app on +902585699550 → saved-as tags → nicknames / employer / family [ ] Instagram derefererence → contact-sync trick: save +902585699550 as contact, wait for IG suggested-people → osintgram / Sync.me / Getcontact for handle → then Instaloader → tagged locations = home / work / gym [ ] Yemek Sepeti / Trendyol / Hepsiburada / n11 / Getir dump query on siirle.cehsu1@gmail.com → delivery addresses [ ] Mernis 2016 (50M Turkish citizen leak) query Input: Tayfun Toprak + Denizli + DOB 1989-09-23 Output: TC Kimlik No, father's name, mother's name, DOB, registered home address Sources: veribankasi.net / turksorgu.pro / TG bots [ ] Turkish sorgu-panel query (aggregated leaks) → cross-reference name+city → all linked phones / addresses [ ] Crack MD5 e4bb355b073d3790497ef9631208ef1c hashcat -a 0 -m 0 hash.txt rockyou.txt hashcat -a 0 -m 0 hash.txt turkish_wordlist.txt hashcat -a 6 -m 0 hash.txt tedirgin.txt ?d?d?d [ ] Discord servers he's in → Discord.id / lookup.guru / DIsForge for public server list → member scrape of any shared server for social graph [ ] HudsonRock Cavalier lookup on email / snowflake → confirm stealer malware family, log filename → follow to full log source [ ] Reverse image search on Google avatar https://lh3.googleusercontent.com/a-/ALV-UjUr3QMRZ2vHApC9yMILymu_OXPWsfQD1BDsvp7RXYTKcnK6Z0yE Yandex / PimEyes / Google Lens / TinEye [ ] Reverse image on Discord avatar https://cdn.discordapp.com/avatars/1211215796089528322/61a9f5131ec48453b516285adc512f93.png?size=1024 [ ] Last.fm scrape (cehset) → 16 years of scrobble data, shoutbox = friends graph → timezone reconfirm via listen-hour histogram ═══════════════════════════════════════════════════════════════════ 11. TL;DR ═══════════════════════════════════════════════════════════════════ Target: Tayfun Toprak, ~36yo Turkish male Location: Denizli province, Turkey (unconfirmed exact address yet — landline + IP + Twitter/Canva locale all point at TR, 0258 area code narrows to Denizli) Pivot email: siirle.cehsu1@gmail.com Pivot phone: +90 258 569 95 50 (landline, home) Pivot handles: @EA527 (Twitter), cehset (Last.fm), fs6r (Discord), awordkelimeoyunu (GitHub), cepkpss (Gravatar), yeraltindannotlar (Xat) Known plain passes: tedirgin13, shark80123, xagiwyja, 0258569950 Total confirmed services: 20+ Machine status: Info-stealer infected (folders under snowflake 1211215796089528322) Immediate next step: rehber.com.tr on the landline; Getcontact on +902585699550; Google Maps reviews of Google ID 107791899830342310071 ═══════════════════════════════════════════════════════════════════ END OF FILE ═══════════════════════════════════════════════════════════════════