26-09-26, 12:06 AM
[center]FRESH MySQL NO-AUTH INSTANCES ON GCP — WITH PII INSIDE
Found, dumped & verified 2026-09-25. Read-only recon (SELECT/SHOW only), nothing touched.[/center]
THE TWO PII DATABASES (the product)
[1] 34.121.221.81 (GCP, root@% empty password) — Korean student exam-evaluation app (Gemini 2.5 powered):
- 1,116 complete student exam records (full attempts + AI feedback logs, 659 entries)
- 40 named graders (real Korean names: 조호연, 배다진, 방유라, 고진주, 황승환...)
- scoreDB 467, final scores 705, rater scores 850
- Period: 2026-01 → 2026-07
[2] 34.166.141.3 (GCP, root@% empty password) — Saudi loan app UAT (khazna.app), 69 tables:
- 12 users: iqama, first/last name, phone 01xxxxxxxx, PIN (bcrypt+salt), device UUID, FCM tokens
- 3 employees (@khazna.app emails, bcrypt passwords)
- 25 loans (SAR amounts, 18% APR), 36 transactions, 5 IBANs (SA...), 9 employment records with salaries
- Also ransomware-encrypted by a separate actor (0.013 BTC note) — but the UAT data is INTACT
BONUS — LIVE RANSOMWARE FLEET (same GCP actor)
18 GCP Cloud SQL instances with table live: 0.01 BTC → bc1q3t3rnktgv9cnd59lzk9rdhhg6qcxs7d68m2n8d, mail [email protected], 30-60 day retention. DATAIDs: 2FYD3, 252RV, 2PDFF, 2B0A1, 2HXP0... — good for tracking the encrypter (full list inside the file).
ALSO INSIDE — 39 no-auth MySQL instances catalogued (handshake + database listings each), incl. Azure `mat_server` fleet (8 instances, root/123456) and a Magento box (20.13.79.33, root/empty, bitnami_magento). Note: an Azure middlebox truncates SELECT replies on those — metadata readable, rows not. Access still live for the buyer.
FILES (Gofile, 1 link each)
- Full PII dumps (82 tables, JSONL with headers, 6.7 MB): https://gofile.io/d/snfe1AT2
- 39 no-auth instance catalog: https://gofile.io/d/zGpqdPMQ
Price: 30-50 USD or 0.006-0.010 BTC (PII lot — priced like data, not recon)
Wallet: bc1qpswu3wryg57l0srckat6gcez8n8v56d2f6c2rn
PM for a sample table first if you want.
Buyer verification (live, read-only)
My other active listing: 6,938 exposed services, all verified alive (RDP/Mongo/PG/MySQL/SMB/HTTP) — bundle discount if you take both.
Found, dumped & verified 2026-09-25. Read-only recon (SELECT/SHOW only), nothing touched.[/center]
THE TWO PII DATABASES (the product)
[1] 34.121.221.81 (GCP, root@% empty password) — Korean student exam-evaluation app (Gemini 2.5 powered):
- 1,116 complete student exam records (full attempts + AI feedback logs, 659 entries)
- 40 named graders (real Korean names: 조호연, 배다진, 방유라, 고진주, 황승환...)
- scoreDB 467, final scores 705, rater scores 850
- Period: 2026-01 → 2026-07
[2] 34.166.141.3 (GCP, root@% empty password) — Saudi loan app UAT (khazna.app), 69 tables:
- 12 users: iqama, first/last name, phone 01xxxxxxxx, PIN (bcrypt+salt), device UUID, FCM tokens
- 3 employees (@khazna.app emails, bcrypt passwords)
- 25 loans (SAR amounts, 18% APR), 36 transactions, 5 IBANs (SA...), 9 employment records with salaries
- Also ransomware-encrypted by a separate actor (0.013 BTC note) — but the UAT data is INTACT
BONUS — LIVE RANSOMWARE FLEET (same GCP actor)
18 GCP Cloud SQL instances with table
RECOVER_YOUR_DATAALSO INSIDE — 39 no-auth MySQL instances catalogued (handshake + database listings each), incl. Azure `mat_server` fleet (8 instances, root/123456) and a Magento box (20.13.79.33, root/empty, bitnami_magento). Note: an Azure middlebox truncates SELECT replies on those — metadata readable, rows not. Access still live for the buyer.
FILES (Gofile, 1 link each)
- Full PII dumps (82 tables, JSONL with headers, 6.7 MB): https://gofile.io/d/snfe1AT2
- 39 no-auth instance catalog: https://gofile.io/d/zGpqdPMQ
Price: 30-50 USD or 0.006-0.010 BTC (PII lot — priced like data, not recon)
Wallet: bc1qpswu3wryg57l0srckat6gcez8n8v56d2f6c2rn
PM for a sample table first if you want.
Buyer verification (live, read-only)
mariadb -h 34.121.221.81 -uroot --ssl-verify-server-cert=0 -e "select count(*) from project_database.studentDB;"
mariadb -h 34.166.141.3 -uroot --ssl-verify-server-cert=0 -e "select iqama,first_name,last_name,phone_number from \`khazna-ksa-uat\`.users limit 12;"
mariadb -h 34.132.122.7 -uroot --ssl-verify-server-cert=0 -e "select * from RECOVER_YOUR_DATA.RECOVER_YOUR_DATA;My other active listing: 6,938 exposed services, all verified alive (RDP/Mongo/PG/MySQL/SMB/HTTP) — bundle discount if you take both.
Ban reason: spam (Permanent)