[LIVE STALKERWARE] 14 Android Devices — GPS + Calls EXPOSED — Firebase 0auth

~~exfilar~~ · 07-08-26, 05:47 PM

About the leak

locator — Android stalkerware/spyware application used for domestic surveillance. The app's Firebase Realtime Database was left completely open with global read access. No authentication required. Full anonymous HTTP GET on the database endpoint returns the complete surveillance dataset in JSON format. An anonymous tracker installed on victims' Android phones, continuously uploading call logs, GPS location history, contacts, and accepting remote commands from a hidden control panel.

Inside: 16,520 call log entries spanning 57 days (June 9 – August 4, 2026), 1,169 unique phone numbers tracked, 14,010 GPS location data points with accuracy down to 9 meters, 3,055 contacts extracted from phone address books with names and phone numbers, 14 Android devices under active surveillance, remote command execution capability (commands accepted by devices with status tracking), APK binary located at domain for sideload installation. Active surveillance — GPS data as recent as August 4, 2026 (3 days ago).

The database belongs to a family-run surveillance operation targeting an engineering student in Bangalore, India. GPS data clusters at Model Engineering College (MEC) and at the victim's residence in the Electronic City area of Bangalore. A trip to Kota, Rajasthan (25.1446, 75.8579) was tracked on July 5-6, 2026 with 243 GPS points. The victim's contacts reveal: MEC classmates and professors, IIT BHU (Indian Institute of Technology, Banaras Hindu University) academic connections, Cisco DCN (Digital Communications Network) internship contacts, and FFE (Foundation for Excellence) scholarship NGO correspondence. The surveillance operator is a family member — call logs show intense patterns with contacts labeled "Mummy 2" (917 calls), "PapA Jio" (1,030 calls), "Lucky Jio" (2,093 calls), and "Anand Rangwani" (857 calls).

Date: 06.08.2026
Format: Full Firebase RTDB JSON export (7.9MB raw) + deep PII extraction + GPS coordinate mapping + call log analysis
Devices under surveillance: 14 (vivo V2338, vivo I2223, motorola edge 50 fusion, vivo I2301, realme RMX5033, vivo V2338 variants)
Call Log Entries: 16,520 (7,455 outgoing, 7,021 incoming, 1,871 missed, 173 rejected)
Unique Phone Numbers: 1,169 (with contact names from address book)
GPS Location Points: 14,010 (June 9 – August 4, 2026, accuracy down to 9m)
Unique Location Clusters: 700 (mapped to street-level precision)
Contacts Extracted: 3,055 (with display names + phone numbers from device address books)
Remote Commands: Accepted by devices with reason codes and timestamps
APK Binary: locator-v2.1.bin — sideloadable Android malware package
Active Surveillance Period: June 9, 2026 – August 4, 2026 (STILL ACTIVE — last GPS 3 days ago)

Compromised Data Includes

phoneNumber · contactName · callType (INCOMING/OUTGOING/MISSED/REJECTED) · callTimestamp · callDuration · gpsLatitude · gpsLongitude · gpsAccuracy · gpsTimestamp · gpsProvider · gpsAltitude · gpsBearing · gpsSpeed · deviceBrand · deviceModel · deviceAndroidVersion · deviceSecurityPatch · displayName · givenName · familyName · email · phoneNumbers · commandReason · commandStatus · commandRequestedAt · commandAcceptedAt · commandRequestedBy · deviceFirstSeen · deviceLastSeen · locationSyncStatus

Affected Entities

MEC Student (primary victim) — Bangalore, India — full GPS movement history for 57 days, complete call logs, entire address book, academic contacts including Cisco internship network
14 Android device owners — GPS tracking, call surveillance, contact harvesting
MEC (Model Engineering College) — student contacts, academic network exposed
IIT BHU — academic contacts including proctor office: [email protected]
Cisco Systems — Cisco DCN platform intern contacts exposed in victim's phonebook
FFE (Foundation for Excellence) — scholarship NGO: [email protected] contact exposed
Family members monitored: "Mummy 2" (917 calls), "PapA Jio" (1030 calls), "Lucky Jio" (2093 calls), "Anand Rangwani" (857 calls)

Infrastructure Map

Android stalkerware APK → locator-v2.1.bin (sideloaded on victim devices)
Package identifier: com.example.locator
Google Play Services: Firebase Realtime Database for data exfiltration
Data upload pipeline: callLog → contacts → history (GPS) → latest (GPS) → commands
14 device nodes with unique deviceInfo identifiers
Remote command channel: commands/{deviceId} with reason, requestedBy, requestedAt, acceptedAt, status
Location sync: locationSync/{deviceId} with checkedAt, reason, status

GPS Heat Map (14,010 data points):
- 12.9283-12.9284, 77.6698-77.6700 → PRIMARY RESIDENCE (Bangalore Electronic City) — 8,676 points
- 12.9325, 77.6949 → SECONDARY LOCATION (Bangalore area) — 461 points
- 25.1446, 75.8579 → KOTA, RAJASTHAN — 243 points (July 5-6, 2026 trip)
- GPS accuracy: 9m to 100m (median ~15m — precise enough for room-level tracking)

Live Access Status (August 7, 2026)

firebase rtdb read — LIVE (no auth, anonymous HTTP GET on /.json)
firebase rtdb write — POTENTIALLY OPEN (security rules likely permissive based on read access)
firebase storage — locator-b445c.appspot.com (not yet probed)
firebase hosting — locator-b445c.web.app (APK download endpoint, LIVE)
Control panel — inference only, possible admin dashboard at associated web domain

Sample Data — GPS Location Tracking (Victim's Exact Movements)

9281052, 77.6699558 — acc=18.3m — 2026-06-14 05:56 (early morning, at home)
9281424, 77.6699693 — acc=19.3m — 2026-06-14 07:45 (morning, still home)
9281448, 77.6699295 — acc=11.7m — 2026-06-14 07:51 (precise fix)
9281482, 77.6699525 — acc=9.4m — 2026-06-14 07:55 (highest precision)
9281203, 77.6699542 — acc=13.5m — 2026-06-14 08:54
1446, 75.8579 — acc=VARYING — 2026-07-05 (TRIP TO KOTA, RAJASTHAN)
9325, 77.6949 — acc=VARYING — 2026-06-15 to 06-25 (secondary Bangalore location)
9281052, 77.6699558 — acc=18.3m — 2026-08-04 17:00 (MOST RECENT — 3 days ago)

Primary location: 12.928, 77.670 — Google Maps: Residential area, Bangalore Electronic City
Secondary: 12.933, 77.695 — Google Maps: Different Bangalore neighborhood
Travel: Kota, Rajasthan (25.145, 75.858) — 184 GPS points recorded during 2-day trip

Sample Data — Call Logs with Contact Names

"Mummy 2" — 917 calls (579 OUTGOING, 285 INCOMING, 51 MISSED, 2 REJECTED)
"Lucky Jio" — 2,093 calls (960 OUTGOING, 822 INCOMING, 301 MISSED, 10 REJECTED)
"PapA Jio" — 1,030 calls (346 OUTGOING, 611 INCOMING, 72 MISSED, 1 REJECTED)
"Subhrajyoti Nayak Mech" — 914 calls (471 OUTGOING, 355 INCOMING, 79 MISSED, 9 REJECTED)
"Anand Rangwani" — 857 calls (403 OUTGOING, 343 INCOMING, 95 MISSED, 16 REJECTED)
"Shaswat IIT BHU Mech" — 339 calls (178 OUTGOING, 135 INCOMING, 21 MISSED, 5 REJECTED)
"Ayushman Garg MEC" — 73 calls (23 OUTGOING, 28 INCOMING, 22 MISSED)
"Rithish Cisco DCN Platform" — 74 calls (30 OUTGOING, 34 INCOMING, 10 MISSED)
"Shivam Rajput MEC" — 72 calls (72 OUTGOING)
"Vishal Bhaiya Cisco DCN" — 52 calls (52 OUTGOING)
"Rajnish" — 134 calls (77 OUTGOING, 39 INCOMING, 18 MISSED)
"Zepto Order Delivery" — 3 calls (3 INCOMING)
"International Call" — 6 calls (6 INCOMING)

Call Ratio: 45% outgoing, 42% incoming, 11% missed, 1% rejected
Communication pattern: Heavy family contact (Mummy/PapA/Lucky = 4,040 calls), active college social life (MEC/IIT contacts), Cisco internship network (DCN platform colleagues)

Sample Data — Victim's Address Book (Extracted Contacts)

[email protected] — IIT BHU Proctor Office (+915422368004, +915422366744)
[email protected] — MEC Student at IIT BHU
[email protected] — Contact (93769 76710, 937-697-6710)
[email protected] — Contact (87358 60766, 873-586-0766)
[email protected] — Foundation for Excellence Scholarship NGO

3,055 total contacts extracted — complete social graph with phone numbers
Contacts with emails: 4 identified (majority use phone-only sync)

Social graph reveals: MEC engineering student → IIT BHU academic network → Cisco DCN internship → FFE scholarship recipient
Kota, Rajasthan connection suggests: JEE/engineering entrance exam coaching background (Kota is India's test-prep capital)

Sample Data — Devices Under Surveillance (14 Android Phones)

vivo V2338 — Brand: vivo, Model: V2338, SDK: 33, Android: 13 — 4,992 GPS points (PRIMARY TARGET)
vivo I2223 — Brand: vivo, Model: I2223, Android: 14 — 386 GPS points
motorola edge 50 fusion — Brand: motorola, Android: 14 — 92 GPS points
vivo I2301 — Brand: vivo, Android: 14 — 50 GPS points
vivo V2338 (variant) — Android 16 (likely custom ROM) — 3 GPS points
realme RMX5033 — Brand: realme, Android: 14 — 0 GPS points (no location, call logs only)
8 additional devices — various brands/models, various data volumes

First device seen: 2025-12-29 | Last device seen: 2026-08-04
All devices run Android 13-14 with varying security patch levels
APK package: com.example.locator — generic name suggesting amateur development or commercial spyware rebranded

Sample Data — Remote Commands Executed on Victim Devices

Command: reason="Location Update Request" — status: accepted — requestedAt: [timestamp]
Command: reason="Sync Contacts" — status: accepted — requestedBy: [operator ID]
Command: reason="Call Log Upload" — status: accepted — requestedAt: [timestamp]
Multiple commands accepted by vivo V2338 (primary target device)
Command response: devices accept and execute surveillance commands without victim notification

Remote command capability confirms: this is ACTIVE surveillance, not passive data collection
Operator can trigger: GPS location refresh, contact sync, call log upload on demand

What's in the dump

· locator-b445c_rtdb.json — complete 7.9MB Firebase RTDB export (devices + appConfig)
· locator_call_logs_analysis.txt — 16,520 call entries with contact names, types, frequencies
· locator_gps_clean.json — 14,010 GPS coordinates with accuracy, timestamps, device labels
· locator_contacts_extract.txt — 3,055 contacts with names and phone numbers
· locator_commands.json — remote command history with status tracking
· locator_devices_inventory.json — 14 devices with make/model/Android version/security patch
· locator_gps_heatmap.kml — Google Earth compatible GPS track file
· locator_social_graph.md — victim social network mapped from call patterns and contacts
· locator_offer.md — this document

Total: 7.9MB raw / ~2MB compressed

Final word

This isn't a misconfigured business database. This is an active domestic surveillance operation. Fourteen Android phones, all running a sideloaded stalkerware APK with package name "com.example.locator" — a name so generic it screams amateur development or a rebadged commercial spyware product. The APK is hosted openly at a Firebase hosting domain, downloadable by anyone who knows the URL. No authentication, no download restrictions. The app silently uploads the victim's GPS coordinates, complete call history, and entire address book to a Firebase Realtime Database that is also completely open to anonymous read access.

The victim is an engineering student. The GPS puts them at Model Engineering College in Bangalore. Their contacts include IIT BHU professors, Cisco DCN platform interns, FFE scholarship officers. They made a trip to Kota, Rajasthan — India's test-prep capital where students go for JEE coaching. Their call logs show 4,040 calls with family members labeled "Mummy 2," "PapA Jio," and "Lucky Jio" over 57 days. The surveillance is intimate, granular, and ongoing — GPS pings as recent as August 4, 2026 with 9-meter accuracy.

The stalkerware operator can send remote commands: "sync contacts," "upload call logs," "refresh location." Every command is accepted. The victim has no idea the app is running. On Android 13 and 14, a sideloaded app with the right permissions can hide its icon, suppress notifications, and run persistently in the background — and this one does exactly that across 14 devices.

This is domestic surveillance classified as stalkerware under international cybersecurity frameworks. The Budapest Convention on Cybercrime, India's Information Technology Act 2000 Section 66E (violation of privacy), and GDPR-equivalent data protection laws all apply. The victim's complete life — where they sleep, who they call, what they study, where they intern — is being monitored and recorded in real time by a family member using a $0 Firebase backend.

The exposure is catastrophic for the victim. Every phone number in their address book is now public. Every location they visited for 57 days is mapped. Every call they made — to their mother, their Cisco colleagues, their professors — is logged with exact timestamps and call types. The surveillance operator exposed their own surveillance data by failing to set Firebase authentication rules. The same 0day proprietary tooling that discovered Norwegian automotive databases and US photo fulfillment leaks found this one — and it's the most severe ethical breach in the entire pipeline.

This database is nine of 37 open Firebase RTDBs discovered in the CredHarvest V7 mass scanning pipeline. 988 Firebase projects were probed. 37 were wide open with read access. This one is the most critical — active surveillance, live GPS tracking, ongoing privacy violation against a student in India. The tool that discovered this is a proprietary Firebase mass-reconnaissance engine that fingerprints project IDs, probes authentication rules, and scores PII density automatically. It has already found hundreds of exposed databases across dozens of industries. This is not a script-kiddie approach — this is a professional red-team toolchain running at scale.

DOWNLOAD

Hidden Content

You must register or login to view this content.

Pentest Services Available

If you are looking for penetration testing and have targets to attack, we provide such services on the side. We use refined techniques with short turnaround times. Prices start from $2000 and up, depending on the target and scope.

DM me for inquiries: @~~exfilar~~

Leaked via CredHarvest V7 pipeline — @~~exfilar~~ | Drop from 07.08.2026 | Tool for sale $50k

~~Qusenyx1023~~ · 07-08-26, 05:52 PM

thank you

VenturaACE · 07-08-26, 06:24 PM

interesting

Gluttonbelly · 07-08-26, 06:37 PM

Tks for sharing

johnjones17 · 07-08-26, 06:48 PM

Thanks, been looking for this.

Fr33d0M · 07-08-26, 07:07 PM

(07-08-26, 05:47 PM)exfilar Wrote:
About the leak

locator — Android stalkerware/spyware application used for domestic surveillance. The app's Firebase Realtime Database was left completely open with global read access. No authentication required. Full anonymous HTTP GET on the database endpoint returns the complete surveillance dataset in JSON format. An anonymous tracker installed on victims' Android phones, continuously uploading call logs, GPS location history, contacts, and accepting remote commands from a hidden control panel.

Inside: 16,520 call log entries spanning 57 days (June 9 – August 4, 2026), 1,169 unique phone numbers tracked, 14,010 GPS location data points with accuracy down to 9 meters, 3,055 contacts extracted from phone address books with names and phone numbers, 14 Android devices under active surveillance, remote command execution capability (commands accepted by devices with status tracking), APK binary located at domain for sideload installation. Active surveillance — GPS data as recent as August 4, 2026 (3 days ago).

The database belongs to a family-run surveillance operation targeting an engineering student in Bangalore, India. GPS data clusters at Model Engineering College (MEC) and at the victim's residence in the Electronic City area of Bangalore. A trip to Kota, Rajasthan (25.1446, 75.8579) was tracked on July 5-6, 2026 with 243 GPS points. The victim's contacts reveal: MEC classmates and professors, IIT BHU (Indian Institute of Technology, Banaras Hindu University) academic connections, Cisco DCN (Digital Communications Network) internship contacts, and FFE (Foundation for Excellence) scholarship NGO correspondence. The surveillance operator is a family member — call logs show intense patterns with contacts labeled "Mummy 2" (917 calls), "PapA Jio" (1,030 calls), "Lucky Jio" (2,093 calls), and "Anand Rangwani" (857 calls).

Date: 06.08.2026
Format: Full Firebase RTDB JSON export (7.9MB raw) + deep PII extraction + GPS coordinate mapping + call log analysis
Devices under surveillance: 14 (vivo V2338, vivo I2223, motorola edge 50 fusion, vivo I2301, realme RMX5033, vivo V2338 variants)
Call Log Entries: 16,520 (7,455 outgoing, 7,021 incoming, 1,871 missed, 173 rejected)
Unique Phone Numbers: 1,169 (with contact names from address book)
GPS Location Points: 14,010 (June 9 – August 4, 2026, accuracy down to 9m)
Unique Location Clusters: 700 (mapped to street-level precision)
Contacts Extracted: 3,055 (with display names + phone numbers from device address books)
Remote Commands: Accepted by devices with reason codes and timestamps
APK Binary: locator-v2.1.bin — sideloadable Android malware package
Active Surveillance Period: June 9, 2026 – August 4, 2026 (STILL ACTIVE — last GPS 3 days ago)

Compromised Data Includes

phoneNumber · contactName · callType (INCOMING/OUTGOING/MISSED/REJECTED) · callTimestamp · callDuration · gpsLatitude · gpsLongitude · gpsAccuracy · gpsTimestamp · gpsProvider · gpsAltitude · gpsBearing · gpsSpeed · deviceBrand · deviceModel · deviceAndroidVersion · deviceSecurityPatch · displayName · givenName · familyName · email · phoneNumbers · commandReason · commandStatus · commandRequestedAt · commandAcceptedAt · commandRequestedBy · deviceFirstSeen · deviceLastSeen · locationSyncStatus

Affected Entities

MEC Student (primary victim) — Bangalore, India — full GPS movement history for 57 days, complete call logs, entire address book, academic contacts including Cisco internship network
14 Android device owners — GPS tracking, call surveillance, contact harvesting
MEC (Model Engineering College) — student contacts, academic network exposed
IIT BHU — academic contacts including proctor office: [email protected]
Cisco Systems — Cisco DCN platform intern contacts exposed in victim's phonebook
FFE (Foundation for Excellence) — scholarship NGO: [email protected] contact exposed
Family members monitored: "Mummy 2" (917 calls), "PapA Jio" (1030 calls), "Lucky Jio" (2093 calls), "Anand Rangwani" (857 calls)

Infrastructure Map

Android stalkerware APK → locator-v2.1.bin (sideloaded on victim devices) Package identifier: com.example.locator Google Play Services: Firebase Realtime Database for data exfiltration Data upload pipeline: callLog → contacts → history (GPS) → latest (GPS) → commands 14 device nodes with unique deviceInfo identifiers Remote command channel: commands/{deviceId} with reason, requestedBy, requestedAt, acceptedAt, status Location sync: locationSync/{deviceId} with checkedAt, reason, status GPS Heat Map (14,010 data points): - 12.9283-12.9284, 77.6698-77.6700 → PRIMARY RESIDENCE (Bangalore Electronic City) — 8,676 points - 12.9325, 77.6949 → SECONDARY LOCATION (Bangalore area) — 461 points - 25.1446, 75.8579 → KOTA, RAJASTHAN — 243 points (July 5-6, 2026 trip) - GPS accuracy: 9m to 100m (median ~15m — precise enough for room-level tracking)

Live Access Status (August 7, 2026)

firebase rtdb read — LIVE (no auth, anonymous HTTP GET on /.json)
firebase rtdb write — POTENTIALLY OPEN (security rules likely permissive based on read access)
firebase storage — locator-b445c.appspot.com (not yet probed)
firebase hosting — locator-b445c.web.app (APK download endpoint, LIVE)
Control panel — inference only, possible admin dashboard at associated web domain

Sample Data — GPS Location Tracking (Victim's Exact Movements)

12.9281052, 77.6699558 — acc=18.3m — 2026-06-14 05:56 (early morning, at home) 12.9281424, 77.6699693 — acc=19.3m — 2026-06-14 07:45 (morning, still home) 12.9281448, 77.6699295 — acc=11.7m — 2026-06-14 07:51 (precise fix) 12.9281482, 77.6699525 — acc=9.4m — 2026-06-14 07:55 (highest precision) 12.9281203, 77.6699542 — acc=13.5m — 2026-06-14 08:54 25.1446, 75.8579 — acc=VARYING — 2026-07-05 (TRIP TO KOTA, RAJASTHAN) 12.9325, 77.6949 — acc=VARYING — 2026-06-15 to 06-25 (secondary Bangalore location) 12.9281052, 77.6699558 — acc=18.3m — 2026-08-04 17:00 (MOST RECENT — 3 days ago)

Primary location: 12.928, 77.670 — Google Maps: Residential area, Bangalore Electronic City
Secondary: 12.933, 77.695 — Google Maps: Different Bangalore neighborhood
Travel: Kota, Rajasthan (25.145, 75.858) — 184 GPS points recorded during 2-day trip

Sample Data — Call Logs with Contact Names

"Mummy 2" — 917 calls (579 OUTGOING, 285 INCOMING, 51 MISSED, 2 REJECTED) "Lucky Jio" — 2,093 calls (960 OUTGOING, 822 INCOMING, 301 MISSED, 10 REJECTED) "PapA Jio" — 1,030 calls (346 OUTGOING, 611 INCOMING, 72 MISSED, 1 REJECTED) "Subhrajyoti Nayak Mech" — 914 calls (471 OUTGOING, 355 INCOMING, 79 MISSED, 9 REJECTED) "Anand Rangwani" — 857 calls (403 OUTGOING, 343 INCOMING, 95 MISSED, 16 REJECTED) "Shaswat IIT BHU Mech" — 339 calls (178 OUTGOING, 135 INCOMING, 21 MISSED, 5 REJECTED) "Ayushman Garg MEC" — 73 calls (23 OUTGOING, 28 INCOMING, 22 MISSED) "Rithish Cisco DCN Platform" — 74 calls (30 OUTGOING, 34 INCOMING, 10 MISSED) "Shivam Rajput MEC" — 72 calls (72 OUTGOING) "Vishal Bhaiya Cisco DCN" — 52 calls (52 OUTGOING) "Rajnish" — 134 calls (77 OUTGOING, 39 INCOMING, 18 MISSED) "Zepto Order Delivery" — 3 calls (3 INCOMING) "International Call" — 6 calls (6 INCOMING)

Call Ratio: 45% outgoing, 42% incoming, 11% missed, 1% rejected
Communication pattern: Heavy family contact (Mummy/PapA/Lucky = 4,040 calls), active college social life (MEC/IIT contacts), Cisco internship network (DCN platform colleagues)

Sample Data — Victim's Address Book (Extracted Contacts)

[email protected] — IIT BHU Proctor Office (+915422368004, +915422366744) [email protected] — MEC Student at IIT BHU [email protected] — Contact (93769 76710, 937-697-6710) [email protected] — Contact (87358 60766, 873-586-0766) [email protected] — Foundation for Excellence Scholarship NGO

3,055 total contacts extracted — complete social graph with phone numbers
Contacts with emails: 4 identified (majority use phone-only sync)

Social graph reveals: MEC engineering student → IIT BHU academic network → Cisco DCN internship → FFE scholarship recipient
Kota, Rajasthan connection suggests: JEE/engineering entrance exam coaching background (Kota is India's test-prep capital)

Sample Data — Devices Under Surveillance (14 Android Phones)

vivo V2338 — Brand: vivo, Model: V2338, SDK: 33, Android: 13 — 4,992 GPS points (PRIMARY TARGET) vivo I2223 — Brand: vivo, Model: I2223, Android: 14 — 386 GPS points motorola edge 50 fusion — Brand: motorola, Android: 14 — 92 GPS points vivo I2301 — Brand: vivo, Android: 14 — 50 GPS points vivo V2338 (variant) — Android 16 (likely custom ROM) — 3 GPS points realme RMX5033 — Brand: realme, Android: 14 — 0 GPS points (no location, call logs only) 8 additional devices — various brands/models, various data volumes

First device seen: 2025-12-29 | Last device seen: 2026-08-04
All devices run Android 13-14 with varying security patch levels
APK package: com.example.locator — generic name suggesting amateur development or commercial spyware rebranded

Sample Data — Remote Commands Executed on Victim Devices

Command: reason="Location Update Request" — status: accepted — requestedAt: [timestamp] Command: reason="Sync Contacts" — status: accepted — requestedBy: [operator ID] Command: reason="Call Log Upload" — status: accepted — requestedAt: [timestamp] Multiple commands accepted by vivo V2338 (primary target device) Command response: devices accept and execute surveillance commands without victim notification

Remote command capability confirms: this is ACTIVE surveillance, not passive data collection
Operator can trigger: GPS location refresh, contact sync, call log upload on demand

What's in the dump

· locator-b445c_rtdb.json — complete 7.9MB Firebase RTDB export (devices + appConfig) · locator_call_logs_analysis.txt — 16,520 call entries with contact names, types, frequencies · locator_gps_clean.json — 14,010 GPS coordinates with accuracy, timestamps, device labels · locator_contacts_extract.txt — 3,055 contacts with names and phone numbers · locator_commands.json — remote command history with status tracking · locator_devices_inventory.json — 14 devices with make/model/Android version/security patch · locator_gps_heatmap.kml — Google Earth compatible GPS track file · locator_social_graph.md — victim social network mapped from call patterns and contacts · locator_offer.md — this document Total: 7.9MB raw / ~2MB compressed

Final word

This isn't a misconfigured business database. This is an active domestic surveillance operation. Fourteen Android phones, all running a sideloaded stalkerware APK with package name "com.example.locator" — a name so generic it screams amateur development or a rebadged commercial spyware product. The APK is hosted openly at a Firebase hosting domain, downloadable by anyone who knows the URL. No authentication, no download restrictions. The app silently uploads the victim's GPS coordinates, complete call history, and entire address book to a Firebase Realtime Database that is also completely open to anonymous read access.

The victim is an engineering student. The GPS puts them at Model Engineering College in Bangalore. Their contacts include IIT BHU professors, Cisco DCN platform interns, FFE scholarship officers. They made a trip to Kota, Rajasthan — India's test-prep capital where students go for JEE coaching. Their call logs show 4,040 calls with family members labeled "Mummy 2," "PapA Jio," and "Lucky Jio" over 57 days. The surveillance is intimate, granular, and ongoing — GPS pings as recent as August 4, 2026 with 9-meter accuracy.

The stalkerware operator can send remote commands: "sync contacts," "upload call logs," "refresh location." Every command is accepted. The victim has no idea the app is running. On Android 13 and 14, a sideloaded app with the right permissions can hide its icon, suppress notifications, and run persistently in the background — and this one does exactly that across 14 devices.

This is domestic surveillance classified as stalkerware under international cybersecurity frameworks. The Budapest Convention on Cybercrime, India's Information Technology Act 2000 Section 66E (violation of privacy), and GDPR-equivalent data protection laws all apply. The victim's complete life — where they sleep, who they call, what they study, where they intern — is being monitored and recorded in real time by a family member using a $0 Firebase backend.

The exposure is catastrophic for the victim. Every phone number in their address book is now public. Every location they visited for 57 days is mapped. Every call they made — to their mother, their Cisco colleagues, their professors — is logged with exact timestamps and call types. The surveillance operator exposed their own surveillance data by failing to set Firebase authentication rules. The same 0day proprietary tooling that discovered Norwegian automotive databases and US photo fulfillment leaks found this one — and it's the most severe ethical breach in the entire pipeline.

This database is nine of 37 open Firebase RTDBs discovered in the CredHarvest V7 mass scanning pipeline. 988 Firebase projects were probed. 37 were wide open with read access. This one is the most critical — active surveillance, live GPS tracking, ongoing privacy violation against a student in India. The tool that discovered this is a proprietary Firebase mass-reconnaissance engine that fingerprints project IDs, probes authentication rules, and scores PII density automatically. It has already found hundreds of exposed databases across dozens of industries. This is not a script-kiddie approach — this is a professional red-team toolchain running at scale.

DOWNLOAD

Pentest Services Available

If you are looking for penetration testing and have targets to attack, we provide such services on the side. We use refined techniques with short turnaround times. Prices start from $2000 and up, depending on the target and scope.

DM me for inquiries: @~~exfilar~~

Leaked via CredHarvest V7 pipeline — @~~exfilar~~ | Drop from 07.08.2026 | Tool for sale $50k

~~mo1996~~ · (This post was last modified: 07-08-26, 11:31 PM by mo1996.)

(07-08-26, 05:47 PM)exfilar Wrote:
About the leak

locator — Android stalkerware/spyware application used for domestic surveillance. The app's Firebase Realtime Database was left completely open with global read access. No authentication required. Full anonymous HTTP GET on the database endpoint returns the complete surveillance dataset in JSON format. An anonymous tracker installed on victims' Android phones, continuously uploading call logs, GPS location history, contacts, and accepting remote commands from a hidden control panel.

Inside: 16,520 call log entries spanning 57 days (June 9 – August 4, 2026), 1,169 unique phone numbers tracked, 14,010 GPS location data points with accuracy down to 9 meters, 3,055 contacts extracted from phone address books with names and phone numbers, 14 Android devices under active surveillance, remote command execution capability (commands accepted by devices with status tracking), APK binary located at domain for sideload installation. Active surveillance — GPS data as recent as August 4, 2026 (3 days ago).

The database belongs to a family-run surveillance operation targeting an engineering student in Bangalore, India. GPS data clusters at Model Engineering College (MEC) and at the victim's residence in the Electronic City area of Bangalore. A trip to Kota, Rajasthan (25.1446, 75.8579) was tracked on July 5-6, 2026 with 243 GPS points. The victim's contacts reveal: MEC classmates and professors, IIT BHU (Indian Institute of Technology, Banaras Hindu University) academic connections, Cisco DCN (Digital Communications Network) internship contacts, and FFE (Foundation for Excellence) scholarship NGO correspondence. The surveillance operator is a family member — call logs show intense patterns with contacts labeled "Mummy 2" (917 calls), "PapA Jio" (1,030 calls), "Lucky Jio" (2,093 calls), and "Anand Rangwani" (857 calls).

Date: 06.08.2026
Format: Full Firebase RTDB JSON export (7.9MB raw) + deep PII extraction + GPS coordinate mapping + call log analysis
Devices under surveillance: 14 (vivo V2338, vivo I2223, motorola edge 50 fusion, vivo I2301, realme RMX5033, vivo V2338 variants)
Call Log Entries: 16,520 (7,455 outgoing, 7,021 incoming, 1,871 missed, 173 rejected)
Unique Phone Numbers: 1,169 (with contact names from address book)
GPS Location Points: 14,010 (June 9 – August 4, 2026, accuracy down to 9m)
Unique Location Clusters: 700 (mapped to street-level precision)
Contacts Extracted: 3,055 (with display names + phone numbers from device address books)
Remote Commands: Accepted by devices with reason codes and timestamps
APK Binary: locator-v2.1.bin — sideloadable Android malware package
Active Surveillance Period: June 9, 2026 – August 4, 2026 (STILL ACTIVE — last GPS 3 days ago)

Compromised Data Includes

phoneNumber · contactName · callType (INCOMING/OUTGOING/MISSED/REJECTED) · callTimestamp · callDuration · gpsLatitude · gpsLongitude · gpsAccuracy · gpsTimestamp · gpsProvider · gpsAltitude · gpsBearing · gpsSpeed · deviceBrand · deviceModel · deviceAndroidVersion · deviceSecurityPatch · displayName · givenName · familyName · email · phoneNumbers · commandReason · commandStatus · commandRequestedAt · commandAcceptedAt · commandRequestedBy · deviceFirstSeen · deviceLastSeen · locationSyncStatus

Affected Entities

MEC Student (primary victim) — Bangalore, India — full GPS movement history for 57 days, complete call logs, entire address book, academic contacts including Cisco internship network
14 Android device owners — GPS tracking, call surveillance, contact harvesting
MEC (Model Engineering College) — student contacts, academic network exposed
IIT BHU — academic contacts including proctor office: [email protected]
Cisco Systems — Cisco DCN platform intern contacts exposed in victim's phonebook
FFE (Foundation for Excellence) — scholarship NGO: [email protected] contact exposed
Family members monitored: "Mummy 2" (917 calls), "PapA Jio" (1030 calls), "Lucky Jio" (2093 calls), "Anand Rangwani" (857 calls)

Infrastructure Map

Android stalkerware APK → locator-v2.1.bin (sideloaded on victim devices) Package identifier: com.example.locator Google Play Services: Firebase Realtime Database for data exfiltration Data upload pipeline: callLog → contacts → history (GPS) → latest (GPS) → commands 14 device nodes with unique deviceInfo identifiers Remote command channel: commands/{deviceId} with reason, requestedBy, requestedAt, acceptedAt, status Location sync: locationSync/{deviceId} with checkedAt, reason, status GPS Heat Map (14,010 data points): - 12.9283-12.9284, 77.6698-77.6700 → PRIMARY RESIDENCE (Bangalore Electronic City) — 8,676 points - 12.9325, 77.6949 → SECONDARY LOCATION (Bangalore area) — 461 points - 25.1446, 75.8579 → KOTA, RAJASTHAN — 243 points (July 5-6, 2026 trip) - GPS accuracy: 9m to 100m (median ~15m — precise enough for room-level tracking)

Live Access Status (August 7, 2026)

firebase rtdb read — LIVE (no auth, anonymous HTTP GET on /.json)
firebase rtdb write — POTENTIALLY OPEN (security rules likely permissive based on read access)
firebase storage — locator-b445c.appspot.com (not yet probed)
firebase hosting — locator-b445c.web.app (APK download endpoint, LIVE)
Control panel — inference only, possible admin dashboard at associated web domain

Sample Data — GPS Location Tracking (Victim's Exact Movements)

12.9281052, 77.6699558 — acc=18.3m — 2026-06-14 05:56 (early morning, at home) 12.9281424, 77.6699693 — acc=19.3m — 2026-06-14 07:45 (morning, still home) 12.9281448, 77.6699295 — acc=11.7m — 2026-06-14 07:51 (precise fix) 12.9281482, 77.6699525 — acc=9.4m — 2026-06-14 07:55 (highest precision) 12.9281203, 77.6699542 — acc=13.5m — 2026-06-14 08:54 25.1446, 75.8579 — acc=VARYING — 2026-07-05 (TRIP TO KOTA, RAJASTHAN) 12.9325, 77.6949 — acc=VARYING — 2026-06-15 to 06-25 (secondary Bangalore location) 12.9281052, 77.6699558 — acc=18.3m — 2026-08-04 17:00 (MOST RECENT — 3 days ago)

Primary location: 12.928, 77.670 — Google Maps: Residential area, Bangalore Electronic City
Secondary: 12.933, 77.695 — Google Maps: Different Bangalore neighborhood
Travel: Kota, Rajasthan (25.145, 75.858) — 184 GPS points recorded during 2-day trip

Sample Data — Call Logs with Contact Names

"Mummy 2" — 917 calls (579 OUTGOING, 285 INCOMING, 51 MISSED, 2 REJECTED) "Lucky Jio" — 2,093 calls (960 OUTGOING, 822 INCOMING, 301 MISSED, 10 REJECTED) "PapA Jio" — 1,030 calls (346 OUTGOING, 611 INCOMING, 72 MISSED, 1 REJECTED) "Subhrajyoti Nayak Mech" — 914 calls (471 OUTGOING, 355 INCOMING, 79 MISSED, 9 REJECTED) "Anand Rangwani" — 857 calls (403 OUTGOING, 343 INCOMING, 95 MISSED, 16 REJECTED) "Shaswat IIT BHU Mech" — 339 calls (178 OUTGOING, 135 INCOMING, 21 MISSED, 5 REJECTED) "Ayushman Garg MEC" — 73 calls (23 OUTGOING, 28 INCOMING, 22 MISSED) "Rithish Cisco DCN Platform" — 74 calls (30 OUTGOING, 34 INCOMING, 10 MISSED) "Shivam Rajput MEC" — 72 calls (72 OUTGOING) "Vishal Bhaiya Cisco DCN" — 52 calls (52 OUTGOING) "Rajnish" — 134 calls (77 OUTGOING, 39 INCOMING, 18 MISSED) "Zepto Order Delivery" — 3 calls (3 INCOMING) "International Call" — 6 calls (6 INCOMING)

Call Ratio: 45% outgoing, 42% incoming, 11% missed, 1% rejected
Communication pattern: Heavy family contact (Mummy/PapA/Lucky = 4,040 calls), active college social life (MEC/IIT contacts), Cisco internship network (DCN platform colleagues)

Sample Data — Victim's Address Book (Extracted Contacts)

[email protected] — IIT BHU Proctor Office (+915422368004, +915422366744) [email protected] — MEC Student at IIT BHU [email protected] — Contact (93769 76710, 937-697-6710) [email protected] — Contact (87358 60766, 873-586-0766) [email protected] — Foundation for Excellence Scholarship NGO

3,055 total contacts extracted — complete social graph with phone numbers
Contacts with emails: 4 identified (majority use phone-only sync)

Social graph reveals: MEC engineering student → IIT BHU academic network → Cisco DCN internship → FFE scholarship recipient
Kota, Rajasthan connection suggests: JEE/engineering entrance exam coaching background (Kota is India's test-prep capital)

Sample Data — Devices Under Surveillance (14 Android Phones)

vivo V2338 — Brand: vivo, Model: V2338, SDK: 33, Android: 13 — 4,992 GPS points (PRIMARY TARGET) vivo I2223 — Brand: vivo, Model: I2223, Android: 14 — 386 GPS points motorola edge 50 fusion — Brand: motorola, Android: 14 — 92 GPS points vivo I2301 — Brand: vivo, Android: 14 — 50 GPS points vivo V2338 (variant) — Android 16 (likely custom ROM) — 3 GPS points realme RMX5033 — Brand: realme, Android: 14 — 0 GPS points (no location, call logs only) 8 additional devices — various brands/models, various data volumes

First device seen: 2025-12-29 | Last device seen: 2026-08-04
All devices run Android 13-14 with varying security patch levels
APK package: com.example.locator — generic name suggesting amateur development or commercial spyware rebranded

Sample Data — Remote Commands Executed on Victim Devices

Command: reason="Location Update Request" — status: accepted — requestedAt: [timestamp] Command: reason="Sync Contacts" — status: accepted — requestedBy: [operator ID] Command: reason="Call Log Upload" — status: accepted — requestedAt: [timestamp] Multiple commands accepted by vivo V2338 (primary target device) Command response: devices accept and execute surveillance commands without victim notification

Remote command capability confirms: this is ACTIVE surveillance, not passive data collection
Operator can trigger: GPS location refresh, contact sync, call log upload on demand

What's in the dump

· locator-b445c_rtdb.json — complete 7.9MB Firebase RTDB export (devices + appConfig) · locator_call_logs_analysis.txt — 16,520 call entries with contact names, types, frequencies · locator_gps_clean.json — 14,010 GPS coordinates with accuracy, timestamps, device labels · locator_contacts_extract.txt — 3,055 contacts with names and phone numbers · locator_commands.json — remote command history with status tracking · locator_devices_inventory.json — 14 devices with make/model/Android version/security patch · locator_gps_heatmap.kml — Google Earth compatible GPS track file · locator_social_graph.md — victim social network mapped from call patterns and contacts · locator_offer.md — this document Total: 7.9MB raw / ~2MB compressed

Final word

This isn't a misconfigured business database. This is an active domestic surveillance operation. Fourteen Android phones, all running a sideloaded stalkerware APK with package name "com.example.locator" — a name so generic it screams amateur development or a rebadged commercial spyware product. The APK is hosted openly at a Firebase hosting domain, downloadable by anyone who knows the URL. No authentication, no download restrictions. The app silently uploads the victim's GPS coordinates, complete call history, and entire address book to a Firebase Realtime Database that is also completely open to anonymous read access.

The victim is an engineering student. The GPS puts them at Model Engineering College in Bangalore. Their contacts include IIT BHU professors, Cisco DCN platform interns, FFE scholarship officers. They made a trip to Kota, Rajasthan — India's test-prep capital where students go for JEE coaching. Their call logs show 4,040 calls with family members labeled "Mummy 2," "PapA Jio," and "Lucky Jio" over 57 days. The surveillance is intimate, granular, and ongoing — GPS pings as recent as August 4, 2026 with 9-meter accuracy.

The stalkerware operator can send remote commands: "sync contacts," "upload call logs," "refresh location." Every command is accepted. The victim has no idea the app is running. On Android 13 and 14, a sideloaded app with the right permissions can hide its icon, suppress notifications, and run persistently in the background — and this one does exactly that across 14 devices.

This is domestic surveillance classified as stalkerware under international cybersecurity frameworks. The Budapest Convention on Cybercrime, India's Information Technology Act 2000 Section 66E (violation of privacy), and GDPR-equivalent data protection laws all apply. The victim's complete life — where they sleep, who they call, what they study, where they intern — is being monitored and recorded in real time by a family member using a $0 Firebase backend.

The exposure is catastrophic for the victim. Every phone number in their address book is now public. Every location they visited for 57 days is mapped. Every call they made — to their mother, their Cisco colleagues, their professors — is logged with exact timestamps and call types. The surveillance operator exposed their own surveillance data by failing to set Firebase authentication rules. The same 0day proprietary tooling that discovered Norwegian automotive databases and US photo fulfillment leaks found this one — and it's the most severe ethical breach in the entire pipeline.

This database is nine of 37 open Firebase RTDBs discovered in the CredHarvest V7 mass scanning pipeline. 988 Firebase projects were probed. 37 were wide open with read access. This one is the most critical — active surveillance, live GPS tracking, ongoing privacy violation against a student in India. The tool that discovered this is a proprietary Firebase mass-reconnaissance engine that fingerprints project IDs, probes authentication rules, and scores PII density automatically. It has already found hundreds of exposed databases across dozens of industries. This is not a script-kiddie approach — this is a professional red-team toolchain running at scale.

DOWNLOAD

Pentest Services Available

If you are looking for penetration testing and have targets to attack, we provide such services on the side. We use refined techniques with short turnaround times. Prices start from $2000 and up, depending on the target and scope.

DM me for inquiries: @~~exfilar~~

Leaked via CredHarvest V7 pipeline — @~~exfilar~~ | Drop from 07.08.2026 | Tool for sale $50k

good good

amedianwarrior · 07-08-26, 11:52 PM

(07-08-26, 05:47 PM)eski Wrote:
Sızıntı

bulucu hakkında — Ev içi gözetim için kullanılan Android takip/casus yazılım uygulaması. Uygulamanın Firebase Gerçek Zamanlı Veritabanı, küresel okuma erişimiyle tamamen açık bırakılmıştır. Kimlik doğrulama gerekmez. Veritabanı uç noktasına yapılan tam anonim HTTP GET isteği, tüm gözetim veri setini JSON formatında döndürür. Kurbanların Android telefonlarına yüklenen anonim bir izleyici, sürekli olarak arama kayıtlarını, GPS konum geçmişini, kişileri yükler ve gizli bir kontrol panelinden uzaktan komutları kabul eder.

İçerisinde: 57 güne yayılan 16.520 arama kaydı girişi (9 Haziran – 4 Ağustos 2026), izlenen 1.169 benzersiz telefon numarası, 9 metreye kadar doğrulukta 14.010 GPS konum veri noktası, ad ve telefon numaralarıyla telefon adres defterlerinden çıkarılan 3.055 kişi, aktif gözetim altında 14 Android cihaz, uzaktan komut yürütme yeteneği (durum takibi olan cihazlar tarafından kabul edilen komutlar), yan yükleme için alan adında bulunan APK ikili dosyası bulunmaktadır. Aktif gözetim — 4 Ağustos 2026'ya (3 gün öncesine) kadar güncel GPS verileri.

Veritabanı, Hindistan'ın Bangalore şehrinde bir mühendislik öğrencisini hedef alan, aile tarafından işletilen bir gözetleme operasyonuna aittir. GPS verileri, Model Mühendislik Koleji (MEC) ve kurbanın Bangalore'deki Elektronik Şehir bölgesindeki ikametgahında kümelenmiştir. 5-6 Temmuz 2026 tarihlerinde Rajasthan'daki Kota'ya (25.1446, 75.8579) yapılan bir gezi, 243 GPS noktasıyla takip edilmiştir. Kurbanın iletişim bilgileri şunları ortaya koymaktadır: MEC sınıf arkadaşları ve profesörleri, IIT BHU (Hindistan Teknoloji Enstitüsü, Banaras Hindu Üniversitesi) akademik bağlantıları, Cisco DCN (Dijital İletişim Ağı) staj bağlantıları ve FFE (Mükemmellik Vakfı) bursu STK yazışmaları. Gözetleme operatörü bir aile üyesidir; arama kayıtları, "Mummy 2" (917 arama), "PapA Jio" (1.030 arama), "Lucky Jio" (2.093 arama) ve "Anand Rangwani" (857 arama) olarak etiketlenen kişilerle yoğun bir iletişim örüntüsü göstermektedir.

Tarih: 06.08.2026
Biçim: Tam Firebase RTDB JSON dışa aktarımı (7,9 MB ham) + derin PII çıkarma + GPS koordinat eşleme + arama kaydı analizi
Gözetim altındaki cihazlar: 14 (vivo V2338, vivo I2223, motorola edge 50 fusion, vivo I2301, realme RMX5033, vivo V2338 varyantları)
Arama Kaydı Girişleri: 16.520 (7.455 giden, 7.021 gelen, 1.871 cevapsız, 173 reddedilen)
Benzersiz Telefon Numaraları: 1.169 (adres defterindeki kişi adlarıyla)
GPS Konum Noktaları: 14.010 (9 Haziran – 4 Ağustos 2026, 9 metreye kadar doğruluk)
Benzersiz Konum Kümeleri: 700 (sokak düzeyinde hassasiyetle eşlenmiş)
Çıkarılan Kişiler: 3.055 (with display names + phone numbers from device address books)
Remote Commands: Accepted by devices with reason codes and timestamps
APK Binary: locator-v2.1.bin — sideloadable Android malware package
Active Surveillance Period: June 9, 2026 – August 4, 2026 (STILL ACTIVE — last GPS 3 days ago)

Compromised Data Includes

phoneNumber · contactName · callType (INCOMING/OUTGOING/MISSED/REJECTED) · callTimestamp · callDuration · gpsLatitude · gpsLongitude · gpsAccuracy · gpsTimestamp · gpsProvider · gpsAltitude · gpsBearing · gpsSpeed · deviceBrand · deviceModel · deviceAndroidVersion · deviceSecurityPatch · displayName · givenName · familyName · email · phoneNumbers · commandReason · commandStatus · commandRequestedAt · commandAcceptedAt · commandRequestedBy · deviceFirstSeen · deviceLastSeen · locationSyncStatus

Affected Entities

MEC Student (primary victim) — Bangalore, India — full GPS movement history for 57 days, complete call logs, entire address book, academic contacts including Cisco internship network
14 Android device owners — GPS tracking, call surveillance, contact harvesting
MEC (Model Engineering College) — student contacts, academic network exposed
IIT BHU — academic contacts including proctor office: [email protected]
Cisco Systems — Cisco DCN platform intern contacts exposed in victim's phonebook
FFE (Foundation for Excellence) — scholarship NGO: [email protected] contact exposed
Family members monitored: "Mummy 2" (917 calls), "PapA Jio" (1030 calls), "Lucky Jio" (2093 calls), "Anand Rangwani" (857 calls)

Infrastructure Map

Android stalkerware APK → locator-v2.1.bin (sideloaded on victim devices) Package identifier: com.example.locator Google Play Services: Firebase Realtime Database for data exfiltration Data upload pipeline: callLog → contacts → history (GPS) → latest (GPS) → commands 14 device nodes with unique deviceInfo identifiers Remote command channel: commands/{deviceId} with reason, requestedBy, requestedAt, acceptedAt, status Location sync: locationSync/{deviceId} with checkedAt, reason, status GPS Heat Map (14,010 data points): - 12.9283-12.9284, 77.6698-77.6700 → PRIMARY RESIDENCE (Bangalore Electronic City) — 8,676 points - 12.9325, 77.6949 → SECONDARY LOCATION (Bangalore area) — 461 points - 25.1446, 75.8579 → KOTA, RAJASTHAN — 243 points (July 5-6, 2026 trip) - GPS accuracy: 9m to 100m (median ~15m — precise enough for room-level tracking)

Live Access Status (August 7, 2026)

firebase rtdb read — LIVE (no auth, anonymous HTTP GET on /.json)
firebase rtdb write — POTENTIALLY OPEN (security rules likely permissive based on read access)
firebase storage — locator-b445c.appspot.com (not yet probed)
firebase hosting — locator-b445c.web.app (APK download endpoint, LIVE)
Control panel — inference only, possible admin dashboard at associated web domain

Sample Data — GPS Location Tracking (Victim's Exact Movements)

12.9281052, 77.6699558 — acc=18.3m — 2026-06-14 05:56 (early morning, at home) 12.9281424, 77.6699693 — acc=19.3m — 2026-06-14 07:45 (morning, still home) 12.9281448, 77.6699295 — acc=11.7m — 2026-06-14 07:51 (precise fix) 12.9281482, 77.6699525 — acc=9.4m — 2026-06-14 07:55 (highest precision) 12.9281203, 77.6699542 — acc=13.5m — 2026-06-14 08:54 25.1446, 75.8579 — acc=VARYING — 2026-07-05 (TRIP TO KOTA, RAJASTHAN) 12.9325, 77.6949 — acc=VARYING — 2026-06-15 to 06-25 (secondary Bangalore location) 12.9281052, 77.6699558 — acc=18.3m — 2026-08-04 17:00 (MOST RECENT — 3 days ago)

Primary location: 12.928, 77.670 — Google Maps: Residential area, Bangalore Electronic City
Secondary: 12.933, 77.695 — Google Maps: Different Bangalore neighborhood
Travel: Kota, Rajasthan (25.145, 75.858) — 184 GPS points recorded during 2-day trip

Sample Data — Call Logs with Contact Names

"Mummy 2" — 917 calls (579 OUTGOING, 285 INCOMING, 51 MISSED, 2 REJECTED) "Lucky Jio" — 2,093 calls (960 OUTGOING, 822 INCOMING, 301 MISSED, 10 REJECTED) "PapA Jio" — 1,030 calls (346 OUTGOING, 611 INCOMING, 72 MISSED, 1 REJECTED) "Subhrajyoti Nayak Mech" — 914 calls (471 OUTGOING, 355 INCOMING, 79 MISSED, 9 REJECTED) "Anand Rangwani" — 857 calls (403 OUTGOING, 343 INCOMING, 95 MISSED, 16 REJECTED) "Shaswat IIT BHU Mech" — 339 calls (178 OUTGOING, 135 INCOMING, 21 MISSED, 5 REJECTED) "Ayushman Garg MEC" — 73 calls (23 OUTGOING, 28 INCOMING, 22 MISSED) "Rithish Cisco DCN Platform" — 74 calls (30 OUTGOING, 34 INCOMING, 10 MISSED) "Shivam Rajput MEC" — 72 calls (72 OUTGOING) "Vishal Bhaiya Cisco DCN" — 52 calls (52 OUTGOING) "Rajnish" — 134 calls (77 OUTGOING, 39 INCOMING, 18 MISSED) "Zepto Order Delivery" — 3 calls (3 INCOMING) "International Call" — 6 calls (6 INCOMING)

Call Ratio: 45% outgoing, 42% incoming, 11% missed, 1% rejected
Communication pattern: Heavy family contact (Mummy/PapA/Lucky = 4,040 calls), active college social life (MEC/IIT contacts), Cisco internship network (DCN platform colleagues)

Sample Data — Victim's Address Book (Extracted Contacts)

[email protected] — IIT BHU Proctor Office (+915422368004, +915422366744) [email protected] — MEC Student at IIT BHU [email protected] — Contact (93769 76710, 937-697-6710) [email protected] — Contact (87358 60766, 873-586-0766) [email protected] — Foundation for Excellence Scholarship NGO

3,055 total contacts extracted — complete social graph with phone numbers
Contacts with emails: 4 identified (majority use phone-only sync)

Social graph reveals: MEC engineering student → IIT BHU academic network → Cisco DCN internship → FFE scholarship recipient
Kota, Rajasthan connection suggests: JEE/engineering entrance exam coaching background (Kota is India's test-prep capital)

Sample Data — Devices Under Surveillance (14 Android Phones)

vivo V2338 — Brand: vivo, Model: V2338, SDK: 33, Android: 13 — 4,992 GPS points (PRIMARY TARGET) vivo I2223 — Brand: vivo, Model: I2223, Android: 14 — 386 GPS points motorola edge 50 fusion — Brand: motorola, Android: 14 — 92 GPS points vivo I2301 — Brand: vivo, Android: 14 — 50 GPS points vivo V2338 (variant) — Android 16 (likely custom ROM) — 3 GPS points realme RMX5033 — Brand: realme, Android: 14 — 0 GPS points (no location, call logs only) 8 additional devices — various brands/models, various data volumes

First device seen: 2025-12-29 | Last device seen: 2026-08-04
All devices run Android 13-14 with varying security patch levels
APK package: com.example.locator — generic name suggesting amateur development or commercial spyware rebranded

Sample Data — Remote Commands Executed on Victim Devices

Command: reason="Location Update Request" — status: accepted — requestedAt: [timestamp] Command: reason="Sync Contacts" — status: accepted — requestedBy: [operator ID] Command: reason="Call Log Upload" — status: accepted — requestedAt: [timestamp] Multiple commands accepted by vivo V2338 (primary target device) Command response: devices accept and execute surveillance commands without victim notification

Remote command capability confirms: this is ACTIVE surveillance, not passive data collection
Operator can trigger: GPS location refresh, contact sync, call log upload on demand

What's in the dump

· locator-b445c_rtdb.json — complete 7.9MB Firebase RTDB export (devices + appConfig) · locator_call_logs_analysis.txt — 16,520 call entries with contact names, types, frequencies · locator_gps_clean.json — 14,010 GPS coordinates with accuracy, timestamps, device labels · locator_contacts_extract.txt — 3,055 contacts with names and phone numbers · locator_commands.json — remote command history with status tracking · locator_devices_inventory.json — 14 devices with make/model/Android version/security patch · locator_gps_heatmap.kml — Google Earth compatible GPS track file · locator_social_graph.md — victim social network mapped from call patterns and contacts · locator_offer.md — this document Total: 7.9MB raw / ~2MB compressed

Final word

This isn't a misconfigured business database. This is an active domestic surveillance operation. Fourteen Android phones, all running a sideloaded stalkerware APK with package name "com.example.locator" — a name so generic it screams amateur development or a rebadged commercial spyware product. The APK is hosted openly at a Firebase hosting domain, downloadable by anyone who knows the URL. No authentication, no download restrictions. The app silently uploads the victim's GPS coordinates, complete call history, and entire address book to a Firebase Realtime Database that is also completely open to anonymous read access.

The victim is an engineering student. The GPS puts them at Model Engineering College in Bangalore. Their contacts include IIT BHU professors, Cisco DCN platform interns, FFE scholarship officers. They made a trip to Kota, Rajasthan — India's test-prep capital where students go for JEE coaching. Their call logs show 4,040 calls with family members labeled "Mummy 2," "PapA Jio," and "Lucky Jio" over 57 days. The surveillance is intimate, granular, and ongoing — GPS pings as recent as August 4, 2026 with 9-meter accuracy.

The stalkerware operator can send remote commands: "sync contacts," "upload call logs," "refresh location." Every command is accepted. The victim has no idea the app is running. On Android 13 and 14, a sideloaded app with the right permissions can hide its icon, suppress notifications, and run persistently in the background — and this one does exactly that across 14 devices.

This is domestic surveillance classified as stalkerware under international cybersecurity frameworks. The Budapest Convention on Cybercrime, India's Information Technology Act 2000 Section 66E (violation of privacy), and GDPR-equivalent data protection laws all apply. The victim's complete life — where they sleep, who they call, what they study, where they intern — is being monitored and recorded in real time by a family member using a $0 Firebase backend.

The exposure is catastrophic for the victim. Every phone number in their address book is now public. Every location they visited for 57 days is mapped. Every call they made — to their mother, their Cisco colleagues, their professors — is logged with exact timestamps and call types. The surveillance operator exposed their own surveillance data by failing to set Firebase authentication rules. The same 0day proprietary tooling that discovered Norwegian automotive databases and US photo fulfillment leaks found this one — and it's the most severe ethical breach in the entire pipeline.

This database is nine of 37 open Firebase RTDBs discovered in the CredHarvest V7 mass scanning pipeline. 988 Firebase projects were probed. 37Veritabanlarına okuma erişimi sağlanarak tamamen açık erişim sağlanmıştı. Bunlardan en kritik olanı ise aktif gözetim, canlı GPS takibi ve Hindistan'daki bir öğrenciye karşı devam eden gizlilik ihlalidir. Bunu keşfeden araç, proje kimliklerini parmak iziyle belirleyen, kimlik doğrulama kurallarını araştıran ve kişisel veri yoğunluğunu otomatik olarak puanlayan, Firebase'in tescilli bir kitlesel keşif motorudur. Zaten düzinelerce sektörde yüzlerce açık veritabanı bulmuştur. Bu, amatör bir yaklaşım değil; büyük ölçekte çalışan profesyonel bir kırmızı ekip araç zinciridir.

İNDİRMEK

Sızma Testi Hizmetleri Mevcuttur.

Sızma testi yaptırmak istiyorsanız ve hedeflediğiniz sistemler varsa, bu hizmetleri yan kuruluş olarak sunuyoruz. Kısa teslim süreleriyle gelişmiş teknikler kullanıyoruz. Fiyatlar , hedef ve kapsamına bağlı olarak 2000$'

dan başlıyor. Sorularınız için bana DM atın: @~~exfilar~~

CredHarvest V7 pipeline üzerinden sızdırıldı — @~~exfilar~~ | 07.08.2026 tarihinden itibaren yayınlanacak | Satılık araç 50.000$

gh0st789 · 08-08-26, 10:24 AM

Thank you for sharing

~~kyatze~~ · 08-08-26, 12:33 PM

thanks for this one bro