MOON
Server: Apache
System: Linux s5.yayogua.com.py 6.12.0-124.55.3.el10_1.x86_64 #1 SMP PREEMPT_DYNAMIC Thu May 7 16:54:02 EDT 2026 x86_64
User: w3com (1005)
PHP: 8.2.32
Disabled: NONE
Upload Files
File: /home/w3com/mail/.victor_segovia@w3_com_py/new/1775732964.H267381P6846.s3.yayogua.com.py,S=8511
Return-path: <enlinea@registrocivil.gob.ec>
Envelope-to: info@w3.com.py
Delivery-date: Thu, 09 Apr 2026 07:09:24 -0400
Received: from spf4.registrocivil.gob.ec ([186.46.222.113]:10400)
	by s3.yayogua.com.py with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
	(Exim 4.87)
	(envelope-from <enlinea@registrocivil.gob.ec>)
	id 1wAnGF-0001lX-Dh
	for info@w3.com.py; Thu, 09 Apr 2026 07:09:24 -0400
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
	d=registrocivil.gob.ec; s=registrocivilgobec; h=Content-Transfer-Encoding:
	Content-Type:MIME-Version:Date:Subject:To:From:Reply-To:Message-ID:Sender:Cc:
	Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender:
	Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id:
	List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive;
	bh=ncGY52jAyjW91HUsYEF5vp+VGfMdpodvHxXwUu768I0=; b=LAK8JTTd00QC+vuGmIT49PS5bY
	+gVebKA3nZwHwUpym3tQ+Go0GDy4uMCXwbDmOqIa452ZcIzJCqdBWQSlglOtYSo7Xgci442uqHaY8
	szDPFO5HzwnBlUxSC3rkj3gazaOH/fOZaKcqUBpKMvY9EYoJt/2uEC5UhAS9QK2/LQlE=;
Received: from master1.registrocivil.gob.ec ([172.24.42.139])
	by spf4.registrocivil.gob.ec with esmtps  (TLS1.3) tls TLS_AES_256_GCM_SHA384
	(Exim 4.96.2)
	(envelope-from <enlinea@registrocivil.gob.ec>)
	id 1wAn5o-00DwDQ-0X;
	Thu, 09 Apr 2026 06:07:03 -0500
Received: from mailinspector.registrocivil.gob.ec ([172.24.42.137] helo=sendmail.alphaside.com)
	by master1.registrocivil.gob.ec with esmtps  (TLS1.3) tls TLS_AES_256_GCM_SHA384
	(Exim 4.96.2)
	(envelope-from <enlinea@registrocivil.gob.ec>)
	id 1wAn5H-00Dvx8-08;
	Thu, 09 Apr 2026 06:07:03 -0500
Received: from localhost (minspector.compose_net [192.168.250.2])
	by sendmail.alphaside.com (8.15.2/8.15.2) with ESMTP id 639B5AxO1289258;
	Thu, 9 Apr 2026 06:05:10 -0500
X-Quarantine-ID: <lZGA1zDIzC2Y>
X-Virus-Scanned: minspectord-new at localhost.localdomain
Received: from smpt-entrante.alphaside.com ([192.168.250.4])
	by localhost (localhost.localdomain [192.168.250.2]) (minspectord-new, port 10026)
	with ESMTP id lZGA1zDIzC2Y; Thu,  9 Apr 2026 06:05:10 -0500 (-05)
Received: from [172.24.16.181] (helo=mail.registrocivil.gob.ec)
	by smpt-entrante.alphaside.com with esmtp (Exim 4.96.2)
	(envelope-from <enlinea@registrocivil.gob.ec>)
	id 1wAnC9-00CVA8-30;
	Thu, 09 Apr 2026 06:05:09 -0500
Received: from localhost (localhost [127.0.0.1])
	by mail.registrocivil.gob.ec (Postfix) with ESMTP id 9B277440322;
	Thu,  9 Apr 2026 06:05:59 -0500 (-05)
Received: from mail.registrocivil.gob.ec ([127.0.0.1])
 by localhost (mail.registrocivil.gob.ec [127.0.0.1]) (amavis, port 10032)
 with ESMTP id wF05_O5BBChz; Thu,  9 Apr 2026 06:05:58 -0500 (-05)
Received: from localhost (localhost [127.0.0.1])
	by mail.registrocivil.gob.ec (Postfix) with ESMTP id 88AAC44035F;
	Thu,  9 Apr 2026 06:05:58 -0500 (-05)
DKIM-Filter: OpenDKIM Filter v2.10.3 mail.registrocivil.gob.ec 88AAC44035F
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
	d=registrocivil.gob.ec; s=77D47768-8559-11EE-8858-C9DCB5D1AA56;
	t=1775732758; bh=ncGY52jAyjW91HUsYEF5vp+VGfMdpodvHxXwUu768I0=;
	h=Message-ID:From:To:Date:MIME-Version;
	b=sMkDfdGVo+nBwzR92EDcyEPTLzeJGp0BA2B0Hv4pf37GtS32DYSVwS1O8qxMu1Ph2
	 J4U7ITogkwzBUfw9O80HPJKb47b8ts40sDobtkHCtyTL/L6elS7zo0aXlKvliuvsW9
	 T4WjtZlzHYNSyQ/DKdxMapDiZ4Wtt9PYpix9oT2uKsSGkv/2lOMFtVPb3ZW5zbx9lx
	 X0aURpLGzoAhxO/mkBlzsxUMk5zRNGQv+KajXcIaYUu2SNsYSx20FNSITasfayBWpx
	 /PNNiq9czo1rQLvCtVMFGV5CNppvqTjf2hJH8QbRiimv/g48mq/Xu7mZBQObu9Rldx
	 O17nsSsi5tZ7w==
X-Virus-Scanned: amavis at registrocivil.gob.ec
Received: from mail.registrocivil.gob.ec ([127.0.0.1])
 by localhost (mail.registrocivil.gob.ec [127.0.0.1]) (amavis, port 10026)
 with ESMTP id hhNgqyVrxaJV; Thu,  9 Apr 2026 06:05:58 -0500 (-05)
Received: from fgewmlm (unknown [45.82.110.150])
	by mail.registrocivil.gob.ec (Postfix) with ESMTPSA id 490664402E3;
	Thu,  9 Apr 2026 06:05:18 -0500 (-05)
Message-ID: <6D97AF03F0230C403686BE0A895A2AC2FBB9@registrocivil.gob.ec>
Reply-To: Paul Van <enlinea@registrocivil.gob.ec>
From: Paul Van <enlinea@registrocivil.gob.ec>
To: Milena <aegiybvk@hotmail.com>
Subject: Casino 1win full database for sale
Date: Thu, 9 Apr 2026 13:05:15 +0200
MIME-Version: 1.0
Content-Type: text/plain;
	format=flowed;
	charset="utf-8";
	reply-type=original
Content-Transfer-Encoding: quoted-printable
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Windows Live Mail 15.4.3538.513
X-MimeOLE: Produced By Microsoft MimeOLE V15.4.3538.513
X-Master-ID: corporativo
X-Spam-Status: No, score=4.3
X-Spam-Score: 43
X-Spam-Bar: ++++
X-Ham-Report: Spam detection software, running on the system "s3.yayogua.com.py",
 has NOT identified this incoming email as spam.  The original
 message has been attached to this so you can view it or label
 similar future email.  If you have any questions, see
 root\@localhost for details.
 
 Content preview:  hello I am selling the database for the 1win casino. The database
    contains 96 million customers with full information, and the file is almost
    30 GB in size. In November 2024, the 1Win platform suffered a data breach
    in which attackers copied data for roughly 96-100 million users, including
    email addresses, telephone numbers, IP addresses, countries, geolocation,
    dates of birth and passwords hashed with SHA-256. The dataset was later added
    to the Have I Been Pwned? database [...] 
 
 Content analysis details:   (4.3 points, 5.0 required)
 
  pts rule name              description
 ---- ---------------------- --------------------------------------------------
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was blocked.
                             See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: registrocivil.gob.ec]
  0.8 BAYES_50               BODY: Bayes spam probability is 40 to 60%
                             [score: 0.4244]
  0.4 STOX_REPLY_TYPE        No description available.
  1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
               [Blocked - see <https://www.spamcop.net/bl.shtml?45.82.110.150>]
  0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
                              Validity was blocked.  See
                             https://knowledge.validity.com/hc/en-us/articles/20961730681243
                              for more information.
                         [186.46.222.113 listed in sa-trusted.bondedsender.org]
  0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
                              Validity was blocked.  See
                             https://knowledge.validity.com/hc/en-us/articles/20961730681243
                              for more information.
                            [186.46.222.113 listed in bl.score.senderscore.com]
  0.0 RCVD_IN_DNSWL_BLOCKED  RBL: ADMINISTRATOR NOTICE: The query to DNSWL
                             was blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block
                              for more information.
                             [186.46.222.113 listed in list.dnswl.org]
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily valid
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from author's
                             domain
  1.8 STOX_REPLY_TYPE_WITHOUT_QUOTES No description available.
  0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
X-Spam-Flag: NO

hello

I am selling the database for the 1win casino. The database contains 96 m=
illion customers with full information, and the file is almost 30 GB in s=
ize.

In November 2024, the 1Win platform suffered a data breach in which attac=
kers copied data for roughly 96-100 million users, including email addres=
ses, telephone numbers, IP addresses, countries, geolocation, dates of bi=
rth and passwords hashed with SHA-256. The dataset was later added to the=
 Have I Been Pwned? database

If you are interested in buying the database, contact me on Telegram at @=
emaildba

I accept only Bitcoin or another cryptocurrency as payment method.











qugmcxcblflxzjtfuxrkckrjjcqsybtzektluuidjbkqcmfpyctpgsbnyfacikbceprbvnsym=
ityln
huxzldtkbgjklxelvpfrdzvagijrsuyiseoafgynomztswjzdtmxuzlmxejnnirmxg