[Xxxxdxdxdxdddxxdxxdd]

Hello DarkForums Community,

Today I am dropping the complete source of a Chinese medical-records doxxing Telegram bot after the client refused to pay final payment, demanded free maintenance, free server fixes, free extra features, and even asked me to build another bot (@xyyyl_bot) for his own client for free.

What this leak contains:

Target Info:
- Bot: @xiaochouyl1_bot (Medical records / probiv lookup service)
- Platform: Telegram Bot API + Flask backend
- Language: Python 3 (TeleBot + Playwright + openpyxl)
- Purpose: Hospital patient record lookup by name + Chinese national ID (sfz)
- Output: Formatted Excel + screenshot via Playwright

Leaked Credentials (Hardcoded in Source):
[+] Telegram Bot Token: 8023880896:AAGPD_NnSepo09tWjhTtd_wGyHcNvpg26tc
[+] Admin IDs: 8127474658, 8382193569
[+] Channel ID (logs): -1002732279577
[+] OKPay Merchant ID: 23740
[+] OKPay API Token: 98dDiQTmGoURuv5CsGHKMb3cFL24Jwan
[+] OKPay API Base: https://api.okaypay.me/shop/
[+] Callback URL: https://t.me/xiaochouyl1_bot

Architecture / Capabilities:
- Input: User sends name + Chinese ID number (sfz)
- Bot queries internal database and returns Excel with patient records
- Playwright generates "hospital management system" HTML screenshot for clean delivery
- Point system (积分): each query costs 1 point
- USDT recharge via OKPay (payLink + sign verification)
- API keys with usage limits (admin_addkey / validate_key / deduct_key_usage)
- Redis-based session and order management
- SQLite local database with full order history

Key Endpoints (Flask):
- POST /okpay - Payment callback handler (auto-adds points on USDT confirm)
- GET /yl - API lookup endpoint (name, sfz, key) returns screenshot PNG
- Bot runs polling + Flask in parallel threads on port 5000

Deliverables Included:
[+] bot.py - Full original source (1120 lines)
[+] aaaa.html - Hospital dashboard HTML template (Playwright screenshot source)
[+] bot_db.sqlite - Local SQLite database with tables for users, orders, keys, points

Note:
- Bot token is live -- take over the bot or burn the webhook
- OKPay account holds active USDT payment flow
- Admin panel is Telegram-based with hardcoded admin IDs
- SQLite has historical recharge records and user balances
- Use the source to clone your own medical probiv service or pentest the payment gateway
- Client scammed a social-work library author for only 100 USDT -- do not work for @xiaochouyl1

This leak is authorized and released with pentester permission.

Download:

Hidden Content

You must register or login to view this content.

Files: https://t.me/+Lv3LYdpVyJc5ZTM0
Vouch center: https://t.me/+wuOFH81f2us1YmQ0
Website: https://xorcat.deals/

[jack0001]

thanks

[wuminglaoxiansheng]

thanks bro

[azhe]

thank you:)

[sangfor]

谢谢您的分享

[qwetop]

thanks

[budygani]

thank you

---

thank you for share

[wanglinna]

thankyou

[wangjinwu]

thank you very ch

[minioadmin]

thankyou