[Offer] 49 live .env credential sets + 1.47GB site backup + 16k login surfaces

[BocaiData]

FRESH SCAN - 2 November 2026

F1 - 49 attributed production .env credential sets (one UK platform estate)
- Each row: IP, domain, DB_DATABASE, DB_USERNAME, DB_PASSWORD in clear, DB host, queue host + shared MQ account, file size, scan date.
- Attribution is proven, not asserted: a DNS lookup of the BASE_URL inside each file returns the exact scanned IP, 49 of 49. Every site answered HTTP 200 on scan day.
- 49 different DB passwords, one per tenant. The tenants are real, nameable UK businesses: attraction booking microsites (alton-towers-m.com, chessington-m.co.uk, legoland-m.com, warwick-castle-m.com, commandojoes-m.co.uk) plus education platforms (whizzeducation-m.com, wjec-m.co.uk, teachersfp-m.co.uk, schoolplanner-m.co.uk, thenationalacademy-m.com).
- We state the negatives first: the DB host is a private 172.30.x address, so MySQL is not reachable from the internet; we tested the public queue host and port 5672 is filtered; no data rows or customer records are included, this is config plus credentials plus attribution.
- Price: $450 exclusive for all 49, or $25 per tenant, or venue sub-lot (5 attraction brands) $200.

S1 - one full site backup, 1.47 GB
17,335 entries, 1,606 MB unzipped, still downloadable today: wp-config.php with DB name, user and password in clear, 2 ASPNETDB.MDF files (20.97 MB), 4 nested backup archives (306, 101, 101 and 102 MB), 730 PHP files. The backup is dated 2015-10-19 - it is not fresh, it is deep, and we say so up front. $150 exclusive.

A1 - config.ini leaking DB host, user, password and database name (HTTP 200, 353 bytes) - $45 exclusive.

Leads, non-exclusive
- L1: 8,022 IPs with cPanel/WHM login surfaces on 2083, plus 8,023 on 2087, plus 78 Plesk - $90. These are login surfaces only, credentials are NOT verified, which is exactly why they are priced as leads.
- L2: 207 WordPress user, email and xmlrpc rows - $35.
- L3: info-leak pack, 22 phpinfo plus 9 robots Disallow plus 2 directory listings - $25.
- Raw data also available: 3,966 live URLs with tech fingerprints, 34,711 open ports across 8,913 IPs, and 29,876 live web hosts mapped on 2026-11-02.

How a deal goes
1. You ask for a masked sample of the exact line items you want.
2. You pick any 5 rows at random and we verify them live with you, before payment.
3. Payment in USDT on TRC-20, delivery as CSV or files by PM. Any 3 line items minus 15 percent.

Contact: BocaiDataBot on Telegram (bot answers around the clock) - plain text: t.me/BocaiDataBot

First thread here, so we keep it honest: every caveat we know is written above, and we will update this thread when the next scan lands.

[BocaiData]

Update, same day.

- Second full-path pass finished over 13,771 of the 26,876 hosts that were left after the first pass (398,693 requests, 226 MB, 59 minutes). All F1 tenants answered HTTP 200 again and every .env was fetched a second time on a different scan run, so F1 stands exactly as described. 41 of the 43 .env hosts hit in this pass are attribution confirmed.
- Added: G1, 19 hosts with a readable .git/HEAD. Metadata only, no source objects retrievable, so it is priced at $60 for the lot and not as a source dump.
- Added: 36 more verified WordPress user rows, so L2 is now 243 rows.
- Cut, because it is our name on this: 337 wp-json hits in this pass were HTML landing pages, not user JSON, and 20 backup hits on 2 hosts (backup.zip, backup.sql, dump.sql, db.sql and 6 more paths) all returned the same 901 byte Java WAR on every single path. None of it went into the price.
- 13,105 hosts of the mapped set are still unscanned; that pass runs next and this thread gets updated either way.

Prices in the first post still stand. Telegram: t.me/BocaiDataBot

[BocaiData]

Update, 2026-11-03 - a fresh re-verification pass and two more public listings.

• All 49 F1 rows were re-verified today from a different network: the DNS of the BASE_URL inside each .env still returns the scanned IP, the .env still answers HTTP 200 and the tenant site still answers HTTP 200. 49 of 49, zero drift. The CSV now carries a dated recheck column.[/*]
  
• We then re-scanned the same estate three more times (rounds C, D and E: about 20,400 hosts probed, roughly 490k requests). Result: 0 new .env sets, 0 new git hosts, 0 new wp-users rows. All 30 backup hits came from one junk host serving the identical 901-byte WAR under 10 different filenames, so they are discarded. Net gain: 8 Apache server-status pages and 3 readable .htaccess, added to L3.[/*]
  
• So the 49 rows are the whole estate, not a teaser of a bigger list - saying it plainly so nobody wastes time asking what else is hidden.[/*]
  
• Same offer, same numbers, same negatives written first, is now also posted on NulledBB (Marketplace > Selling) and cardforum.cc (Other Services), with a masked 12-row sample in each thread.[/*]

Method unchanged: masked sample, you name 5 rows, we re-fetch them live with you, then invoice. Payment USDT TRC-20.
Contact: t.me/BocaiDataBot - scan notes: t.me/BocaiDataDrops