|
||||
|
18 May 2015. Add Pastebin elaboration: 18 May 2015 mSpy Addresses
A sends: On Saturday, the file 'clusterscheme.txt' was added to the mSpy leak .onion: http://mspycomkftki3h54.onion/clusterscheme.txt Its entire contents follow below. The .txt mentions the IP address block 136.243.251.80-87, registered to "Bitex Group LTD" and mentioning Pavel Daletski as admin contact. Both Daletski and Bitex were implicated by Krebs as related to mSpy http://krebsonsecurity.com/2015/05/mobile-spy-software-maker-mspy-hacked-customer-data-leaked/ The .txt also mentions, for six IP addresses, table names and sizes, suggesting what data was processed/stored where. This new .txt is AFAIK the first place to publicly mention IP addresses registered by Daletski in conjunction with their possible uses. ----------------- 136.243.251.80 monline_log 17.9453125 GB monline_main 15.9462890625 GB 136.243.251.81 pipe_queue 1.953125 GB 136.243.251.82 pay 152.00390625 GB 136.243.251.83 mcloud 52.052734375 GB monline_mobile_log 181.9892578125 GB test 42.0576171875GB 136.243.251.84 keep 160 GB storage 156.001953125 GB 136.243.251.85 keep 152.00390625GB mailer 152.00390625GB inetnum: 136.243.251.80 - 136.243.251.87 netname: BITEX-GROUP-LTD descr: Bitex Group LTD country: DE admin-c: PD7003-RIPE tech-c: PD7003-RIPE status: LEGACY mnt-by: HOS-GUN created: 2014-11-12T18:15:22Z last-modified: 2014-11-12T18:15:22Z source: RIPE # Filtered person: Pavel Daletski address: Bitex Group LTD address: 306 Victoria House address: 0000 Victoria address: SEYCHELLES phone: +18007137528 nic-hdl: PD7003-RIPE mnt-by: HOS-GUN created: 2013-01-08T03:10:37Z last-modified: 2013-01-08T03:10:37Z source: RIPE # Filtered ------------------------------------------------------------------------- Added 18 May 2015 http://pastebin.com/2aCpcZXD mSpy Addresses http://cryptome.org/2015/05/mspy-addresses.htm http://mspycomkftki3h54.onion/clusterscheme.txt http://mspycomkftki3h54.onion/ Index of / ________________________________________ ../ keep/ 08-May-2015 10:33 - keep2/ 02-May-2015 16:00 - mailer/ 02-May-2015 16:00 - mcloud/ 02-May-2015 16:00 - monline_log/ 02-May-2015 16:00 - monline_main/ 02-May-2015 16:00 - monline_mobile_log/ 02-May-2015 16:01 - pay/ 02-May-2015 16:02 - pipe_queue/ 02-May-2015 16:02 - storage/ 02-May-2015 16:00 - clusterscheme.txt 16-May-2015 09:45 1062 readme.txt 18-May-2015 09:08 14767 ________________________________________ http://mspycomkftki3h54.onion/ Full databases from http://mspy.com > 400 000 users apple id + password, tracking data, payment details, photo and more security info enjoy add 2015/05/15 Downloading is temporarily disabled add 2015/05/18 Downloading is enabled { "_id" : ObjectId("54b53274e0383090418b47bc"), "app" : "pay/spycash", "status" : "success", "total_ms" : NumberLong(291), "start" : ISODate("2015-01-13T14:57:56.521Z"), "transaction" : "api_create_order", "order_status" : "processed", "request_body" : { "user" : { "first_name" : "Paula", "last_name" : "Plato", "country" : "United States of America", "email" : "paula.plato@gmail.com", "city" : "Springtown", "state" : "Texas", "zipcode" : "76082", "country_code" : "us", "identity_no" : "", "identity_issuer" : "", "address" : "901 Rhoades Lane", "address2" : "901 Rhoades Lane", "postcode" : "", "phone" : "", "phone_ext" : "", "remoteAddress" : "64.31.200.185" }, "aff_id" : NumberLong(0), "traffic_source_params" : null, "payment_type" : "avangate", "payment_info" : { "/gateway_avangate_ipn_html" : "", "GIFT_ORDER" : "0", "SALEDATE" : "2015-01-13 14:52:04", "PAYMENTDATE" : "0000-00-00 00:00:00", "REFNO" : "34658143", "REFNOEXT" : "", "ORDERNO" : "0", "ORDERSTATUS" : "PENDING_APPROVAL", "PAYMETHOD" : "PayPal", "PAYMETHOD_CODE" : "PAYPAL", "FIRSTNAME" : "Paula", "LASTNAME" : "Plato", "COMPANY" : "", "REGISTRATIONNUMBER" : "", "FISCALCODE" : "", "CBANKNAME" : "", "CBANKACCOUNT" : "", "ADDRESS1" : "901 Rhoades Lane", "ADDRESS2" : "", "CITY" : "Springtown", "STATE" : "Texas", "ZIPCODE" : "76082", "COUNTRY" : "United States of America", "COUNTRY_CODE" : "us", "PHONE" : "", "FAX" : "", "CUSTOMEREMAIL" : "paula.plato@gmail.com", "FIRSTNAME_D" : "Paula", "LASTNAME_D" : "Plato", "COMPANY_D" : "", "ADDRESS1_D" : "901 Rhoades Lane", "ADDRESS2_D" : "", "CITY_D" : "Springtown", "STATE_D" : "Texas", "ZIPCODE_D" : "76082", "COUNTRY_D" : "United States of America", "COUNTRY_D_CODE" : "us", "PHONE_D" : "", "EMAIL_D" : "paula.plato@gmail.com", "IPADDRESS" : "64.31.200.185", "IPCOUNTRY" : "United States of America", "COMPLETE_DATE" : "0000-00-00 00:00:00", "CURRENCY" : "USD", "LANGUAGE" : "en", "IPN_PID" : [ "4599016" ], "IPN_PNAME" : [ "mSpy for smartphones & tablets - 3 months Premium Subscription" ], "IPN_PCODE" : [ "MPREMIUM3M" ], "IPN_INFO" : [ "" ], "IPN_QTY" : [ "1" ], "IPN_PRICE" : [ "119.99" ], "IPN_VAT" : [ "0.00" ], "IPN_VER" : [ "" ], "IPN_DISCOUNT" : [ "0.00" ], "IPN_PROMONAME" : [ "" ], "IPN_PROMOCODE" : [ "" ], "IPN_ORDER_COSTS" : [ "0" ], "IPN_SKU" : [ "" ], "IPN_PARTNER_CODE" : "", "IPN_PGROUP" : [ "10473" ], "IPN_PGROUP_NAME" : [ "General1" ], "IPN_PCOMMISSION" : [ "0.00" ], "IPN_LICENSE_PROD" : [ "4599016" ], "IPN_LICENSE_TYPE" : [ "REGULAR" ], "IPN_LICENSE_REF" : [ "" ], "IPN_LICENSE_EXP" : [ "" ], "IPN_LICENSE_LIFETIME" : [ "NO" ], "IPN_DELIVEREDCODES" : [ "" ], "IPN_DOWNLOAD_LINK" : "", "IPN_TOTAL" : [ "119.99" ], "IPN_TOTALGENERAL" : "119.99", "IPN_SHIPPING" : "0.00", "IPN_SHIPPING_TAX" : "0.00", "AVANGATE_CUSTOMER_REFERENCE" : "", "EXTERNAL_CUSTOMER_REFERENCE" : "", "IPN_COUPON_DISCOUNT" : "0.00", "IPN_ORIGINAL_LINK_SOURCE" : [ "" ], "IPN_REFERRER" : "https://store.mspy.com/order/renewal-not-available.php?CART_ID=897e40275644a0560d0a79cc369cf6bb", "IPN_RESELLER_ID" : "0", "IPN_RESELLER_NAME" : "", "IPN_RESELLER_URL" : "", "IPN_RESELLER_COMMISSION" : "0.00", "IPN_COMMISSION" : "8.40", "REFUND_TYPE" : "", "IPN_CUSTOM_TEXT" : [ "I agree to the Terms Of Use and Refund Policy", "I agree with the Device Requirements" ], "IPN_CUSTOM_VALUE" : [ "CHECKED", "CHECKED" ], "CHARGEBACK_RESOLUTION" : "NONE", "CHARGEBACK_REASON_CODE" : "", "TEST_ORDER" : "0", "CARD_TYPE" : "", "CARD_LAST_DIGITS" : "", "GATEWAY_RESPONSE" : "", "IPN_DATE" : "20150113145748", "HASH" : "ecd814a4a0be16d178d10b9999a5606a", "USER" : "checkout", "HOME" : "/home/checkout", "FCGI_ROLE" : "RESPONDER", "QUERY_STRING" : "/gateway.avangate_ipn.html", "REQUEST_METHOD" : "POST", "CONTENT_TYPE" : "application/x-www-form-urlencoded", "CONTENT_LENGTH" : "2218", "SCRIPT_FILENAME" : "/home/checkout/public_html//index.php", "SCRIPT_NAME" : "/index.php", "REQUEST_URI" : "/gateway.avangate_ipn.html", "DOCUMENT_URI" : "/index.php", "DOCUMENT_ROOT" : "/home/checkout/public_html/", "SERVER_PROTOCOL" : "HTTP/1.0", "GATEWAY_INTERFACE" : "CGI/1.1", "SERVER_SOFTWARE" : "nginx/1.4.6", "REMOTE_ADDR" : "80.84.242.102", "REMOTE_PORT" : "47606", "SERVER_ADDR" : "67.231.30.192", "SERVER_PORT" : "443", "SERVER_NAME" : "checkout.mspy.com", "HTTPS" : "on", "REDIRECT_STATUS" : "200", "PATH_INFO" : "/index.php", "HTTP_HOST" : "checkout.mspy.com", "HTTP_USER_AGENT" : "GKD_IPN v1.2", "HTTP_CONTENT_TYPE" : "application/x-www-form-urlencoded", "HTTP_CONTENT_LENGTH" : "2218", "HTTP_CONNECTION" : "close", "PHP_SELF" : "/index.php/index.php", "REQUEST_TIME_FLOAT" : 1421161068.5197, "REQUEST_TIME" : NumberLong(1421161068), "contractId" : "4599016", "invoiceAmountUSD" : 119.99 }, "order_hash" : "", "order_plimus_payment_type" : "AVANGATE:PayPal", "order_plimus_transaction_type" : "REGULAR", "order_plimus_contract_id" : "4599016", "order_quantity" : "1", "order_amount" : 119.99, "order_vat_amount" : NumberLong(0), "merchant_commission" : "8.40", "aff_commission" : "0.00", "invoice_id" : "34658143", "orig_currency" : "USD", "orig_amount" : "119.99", "remote_ip" : "64.31.200.185", "remote_agent" : "", "referrer" : "https://store.mspy.com/order/renewal-not-available.php?CART_ID=897e40275644a0560d0a79cc369cf6bb", "track_id" : "", "shop_url" : "", "logs_account_id" : "", "order_type" : "purchase", "subscriptions" : [ { "product_id" : NumberLong(52), "quantity" : "1", "account_id" : NumberLong(0), "currency" : "USD", "shop_host" : "", "affiliate_id" : NumberLong(0), "order_type" : "purchase", "license_id" : "", "end_date" : "", "license_lifetime" : "NO" } ], "compaign" : "", "advert_campaign" : "", "account_was_trial" : NumberLong(0), "order_promoname" : "", "order_license_lifetime" : "NO", "improvements" : [], "is_test_order" : "0" }, "order_ref" : "34658143", "order_data" : [], "order_insert_data" : { "shop_id" : "1", "compaign_id" : NumberLong(0), "mobile_install_id" : NumberLong(0), "order_number" : "DM2094783", "order_hash" : "", "order_plimus_invoice" : "34658143", "order_amount" : 119.99, "order_plimus_payment_type" : "AVANGATE:PayPal", "order_plimus_transaction_type" : "REGULAR", "order_plimus_contract_id" : "4599016", "order_quantity" : "1", "order_orig_currency" : "USD", "order_orig_amount" : "119.99", "order_merchant_commission" : "8.40", "order_commission" : 71.994, "order_vat_amount" : NumberLong(0), "order_parent_commission" : NumberLong(0), "order_pay_method" : "avangate", "order_is_trial" : NumberLong(0), "order_was_trial" : NumberLong(0), "order_advert_compaign" : "", "order_is_plimus_partnered" : NumberLong(0), "order_plimus_partner_id" : NumberLong(0), "order_status" : "unfinished", "order_date" : "2015-01-13 14:57:56", "order_cached" : NumberLong(0), "order_track_id" : "", "order_language" : "es", "order_type" : "purchase", "order_remote_ip" : "64.31.200.185", "order_client_country_id" : "233", "order_remote_agent" : "", "order_remote_agent_platform" : "unknown", "order_search_engine" : "", "order_search_keywords" : "", "order_referrer" : "https://store.mspy.com/order/renewal-not-available.php?CART_ID=897e40275644a0560d0a79cc369cf6bb", "order_coupon" : "", "order_error" : "", "order_found_on" : "", "order_payment_status" : "PENDING_APPROVAL", "order_gateway_response" : "", "order_deliveredcode" : "", "order_complete_date" : "0000-00-00 00:00:00", "improvements" : "", "is_test_order" : "0", "traffic_source_params" : "" }, "order_id" : NumberLong(4304555), "account_create_url" : "http://payment.thd.cc//management/order/process", "account_create_data" : { "user" : { "affiliate_id" : "2", "superaccount_id" : NumberLong(0), "first_name" : "Paula", "last_name" : "Plato", "email" : "paula.plato@gmail.com", "password" : "vvgPPfjx", "country" : "United States of America", "city" : "Springtown", "state" : "Texas", "address" : "901 Rhoades Lane", "address2" : "901 Rhoades Lane", "postcode" : "", "phone" : "", "phone_ext" : "", "order_hash" : "" }, "order" : { "order_id" : "4304555", "order_number" : "DM2094783", "order_plimus_invoice" : "34658143", "shop_id" : "1", "mobile_install_id" : "0", "compaign_id" : "0", "order_hash" : "", "order_amount" : "119.99", "order_orig_currency" : "USD", "order_orig_amount" : "119.99", "order_plimus_payment_type" : "AVANGATE:PayPal", "order_plimus_transaction_type" : "REGULAR", "order_plimus_contract_id" : "4599016", "order_quantity" : "1", "order_merchant_commission" : "8.40", "order_commission" : "71.99", "order_parent_commission" : "0.00", "order_vat_amount" : "0.00", "order_pay_method" : "avangate", "order_language" : "es", "order_status" : "unfinished", "order_refunded_status" : "", "order_search_keywords" : "", "order_search_engine" : "", "order_referrer" : "https://store.mspy.com/order/renewal-not-available.php?CART_ID=897e40275644a0560d0a79cc369cf6bb", "order_is_plimus_partnered" : "0", "order_plimus_partner_id" : "0", "order_date" : "2015-01-13 14:57:56", "order_cached" : "0", "order_type" : "purchase", "order_remote_ip" : "64.31.200.185", "order_client_country_id" : "233", "order_remote_agent" : "", "order_remote_agent_platform" : "unknown", "order_track_id" : "", "order_coupon" : "", "order_refund_notes" : "", "order_is_trial" : "0", "order_was_trial" : "0", "order_advert_compaign" : "", "order_found_on" : "", "order_error" : "", "order_is_premium_support" : "0", "order_payment_status" : "PENDING_APPROVAL", "order_gateway_response" : "", "order_deliveredcode" : "", "order_complete_date" : "0000-00-00 00:00:00", "improvements" : "", "order_minfraud_score" : null, "is_test_order" : "0", "traffic_source_params" : "" }, "subscriptions" : [ { "product_id" : "52", "license_id" : "", "license_lifetime" : "NO", "order_avangate_exp_date" : "1970-01-01 01:00:00", "shop_id" : "1", "quantity" : "1", "affiliate_id" : "2", "order_type" : "purchase", "subscribe_period" : "7776000" } ], "is_prolongation" : false, "affiliate_url" : "www.mspy.com", "affiliate_name" : "mspy" }, "account_create_response" : { "success" : false, "message" : "Transaction type non-acceptable" }, "response_body" : { "success" : false, "error" : "Can't create account" } } http://mspycomkftki3h54.onion/readme.txt 136.243.251.80 monline_log 17.9453125 GB monline_main 15.9462890625 GB 136.243.251.81 pipe_queue 1.953125 GB 136.243.251.82 pay 152.00390625 GB 136.243.251.83 mcloud 52.052734375 GB monline_mobile_log 181.9892578125 GB test 42.0576171875GB 136.243.251.84 keep 160 GB storage 156.001953125 GB 136.243.251.85 keep 152.00390625GB mailer 152.00390625GB inetnum: 136.243.251.80 - 136.243.251.87 netname: BITEX-GROUP-LTD descr: Bitex Group LTD country: DE admin-c: PD7003-RIPE tech-c: PD7003-RIPE status: LEGACY mnt-by: HOS-GUN created: 2014-11-12T18:15:22Z last-modified: 2014-11-12T18:15:22Z source: RIPE # Filtered person: Pavel Daletski address: Bitex Group LTD address: 306 Victoria House address: 0000 Victoria address: SEYCHELLES phone: +18007137528 nic-hdl: PD7003-RIPE mnt-by: HOS-GUN created: 2013-01-08T03:10:37Z last-modified: 2013-01-08T03:10:37Z source: RIPE # Filtered http://mspycomkftki3h54.onion/clusterscheme.txt
|
