MEXICO CTF / BUG BOUNTY — RECOVERED CREDENTIALS

Campaign: Mexican .git Exposure + Open API Recon • Updated: 2026-02-25

17
Credential Sets
4
App Tokens
186M+
Records Exposed
64 GB
Mirrored Data
177
Federal Agencies
37+
Developer IDs
7
Git Repos
3
External IPs

1. uaem.mx — Universidad Autonoma del Estado de Morelos

TypeUsernamePasswordHostDatabase
MySQL facdisenousr LXN*j@9nmVmN www.uaem.mx consfacdiseno
SMTP [email protected] Cons_facDisenio9102 smtp.gmail.com:465 —
SMTP [email protected] Ventanill4FCQ31 smtp.gmail.com:465 —

2. ieeq.mx — Instituto Electoral del Estado de Queretaro

TypeUsernamePasswordHostDatabase
PgSQL prod postgres Eqaeccasm1500V+- 127.0.0.1 ieeq_site, ieeq_site_admin
PgSQL dev postgres root localhost db_Sergio, db_Web, db_Pagina
MySQL Azure web fb&BN3cse8j_MH5v 104.45.237.221 ieeq_ieeqmx9453639538
MySQL Ext CCS C0munic4ci0n.S0ci4l 187.191.76.50 ieeq

3. ss.puebla.gob.mx — Secretaria de Salud de Puebla

TypeUsernamePasswordHostDatabase
MySQL dst_ss m%e7A_fAMpt9dVbZ localhost dst_ss (prefix: q4gqt_)
Joomla — xSGvpdh2s4Oo1c4F — —

4. elsiglodetorreon.com.mx — El Siglo de Torreon

TypeUsernamePasswordHostDatabase
MySQL rw centenariorw wwZtK7@c1en1 localhost siglo90, durango
MySQL s22 eT9Server3 vwDvhNXckAntcWjB6E s22 siglo90
MySQL s1 eT9Server3 vwDvhNXckAntcWjB6E s1 Tienda
MySQL IBM centenario wwZgtK7@c1en 52.117.172.166 siglo90
MySQL boa centenarioboa vchtBfOfVaYhyBe@100 localhost siglo90, durango
MySQL club centenario wwZgtK7@c1en localhost siglo90
MySQL autos autos f0$f0r0Qui3roCaf3 127.0.0.1 autos
MySQL arch archive camaraf0f0r0@ localhost archive
SMTP [email protected] mel588mo correo.elsiglo.mx:587 —

Application Tokens

TokenValue
TOKEN_PASSWORDk@VDKgrKRI!z5YVZ76PJpjwB4#rEs0FswcYaGOGmS2HhT8@ce!
TOKEN_TARJETA3ls1glo100|2021-12-07
TOKEN_PASS (push)enb5SWeXtgQmFjdr9wBecnFVjx4QrwMq3zFKPYhvFZ6QXJR7HMZPNREEd4me3kK2tVHcNFUjXJfBuJafYmz7X2H8cZQRkPW4
AdSenseca-pub-5687735147948295 / slot 9692393977

5. repodatos.atdt.gob.mx — Federal Open Data API (CRITICAL)

NO AUTHENTICATION REQUIRED — EVERYTHING IS OPEN

URL: https://repodatos.atdt.gob.mx/

Total Data: 64 GB full mirror (50.12 GB enumerated + s_* mirrors)

Agencies: 38 in all_data, 177 in api_update, 11 s_* secretariat dirs

Est. Records: 186,000,000+

Last Activity: 2026-02-24

Mirror Status: COMPLETE — 2026-02-25

PII Data Exposed (Full URLs)

DatasetRecordsSizePII LevelFull URL
Education Centers
CURP, RFC, names, email, phone, GPS		 ~6M 1.7 GB CRITICAL https://repodatos.atdt.gob.mx/all_data/secretaria_educacion/2a1d047c-546b-4293-971a-c835689a37a5/
SINAC Birth Records (2008-2023)
Mother age, indigenous status, language, baby details		 ~60M 12.3 GB HIGH https://repodatos.atdt.gob.mx/all_data/secretaria_salud/77c166cc-bcbf-4b28-806e-f2a60c3de821/
Death Records (1998-2023)
Cause of death, nationality, violence indicators		 ~25M 6.1 GB HIGH https://repodatos.atdt.gob.mx/all_data/secretaria_salud/6fecbbb3-afd9-44a1-8665-679a80ce4a15/
Migration Tramites
Nationality, sex, age, resolution		 ~1.3M 257 MB HIGH https://repodatos.atdt.gob.mx/INM/regulacion_migratoria/Tramites_Migratorios.csv
https://repodatos.atdt.gob.mx/INM/regulacion_migratoria/Documentos_Migratorios.csv
Irregular Migration Events
Border crossing events, demographics		 ~700K 175 MB HIGH https://repodatos.atdt.gob.mx/all_data/secretaria_gobernacion/eventos_migratoria_irregular_2023/situ_irregular_2023.csv
Crime Incidence (SESNSP)
Municipal crime statistics		 ~2M 424 MB MEDIUM https://repodatos.atdt.gob.mx/SESNSP/incidencia_delictiva/IDM_NM_ene25.csv
Procurement (Compranet)
Vendor names, contract amounts		 ~4.5M 907 MB MEDIUM https://repodatos.atdt.gob.mx/compranet_historico.csv
CENSIDA HIV Treatment
ARV treatment by facility		 ~100K 22 MB MED-HIGH https://repodatos.atdt.gob.mx/CENSIDA/activas_con_tratamiento/Personas_Tratamiento_Antirretroviral_julio_2023_diciembre_2024.csv
CRE Gas Prices
Station-level pricing		 ~85M 1.3 GB LOW https://repodatos.atdt.gob.mx/CRE/precios_gas_lp/Historico_Precios_Expendios.csv_2024.csv
IMSS CNDH Complaints
Human rights violations		 ~5K 1 MB MEDIUM https://repodatos.atdt.gob.mx/IMSS/recomendaciones_cndh/RecCNDH-2024-4Trim.csv
Forest Fire Data
Geospatial data + CSV		 ~1M 187 MB LOW https://repodatos.atdt.gob.mx/CONAFOR/incendios_forestales/
CONAPO Population Projections
Demographics 1950-2070, marginalization		 — 202 MB MEDIUM https://repodatos.atdt.gob.mx/CONAPO/proyecciones/
CONEVAL Poverty Data
Poverty by municipality, social lag indices		 — 48 MB MEDIUM https://repodatos.atdt.gob.mx/CONEVAL/pobreza/
s_salud Health Sub-datasets
Chronic diseases, family planning, nutrition, vaccines		 — 16 GB HIGH https://repodatos.atdt.gob.mx/s_salud/
Treasury (Hacienda)
Public finance data		 — 461 MB MEDIUM https://repodatos.atdt.gob.mx/s_hacienda_cred_publico/
Agriculture
Rural development data		 — 403 MB LOW https://repodatos.atdt.gob.mx/s_agricultura_des_rural/
177 Agency API Directory — — INDEX https://repodatos.atdt.gob.mx/api_update/

6. api.elsiglodetorreon.com.mx — Exposed .git (Partial)

FieldValue
Git Remote[email protected]:MrBoa-s-Company/api-app-tor.git
Upstreamrcasanovae/api-app-tor
Status.git/config exposed, full dump blocked (connection reset)

Connectable External IPs

IPTargetService
104.45.237.221ieeq.mxMySQL (Azure)
187.191.76.50ieeq.mxMySQL (Comunicacion Social)
52.117.172.166elsiglodetorreonMySQL (IBM Cloud)

Git Repos Discovered

RepositoryTarget
github.com:norgoth/uaem2023.gituaem.mx
gitlab.com:dianguemoli/ieeq.gitieeq.mx
git.develop.dst:dds/secretaria-de-salud.gitss.puebla.gob.mx (internal)
github.com:es-trc/centenario.gitelsiglodetorreon.com.mx
github.com:MrBoa-s-Company/api-app-tor.gitapi.elsiglodetorreon.com.mx
bitbucket.org:mvsradio/grupo_mvs_v2_landing.gitmvs.com
10.1.4.194:8085/.../mw-red-de-sitios.gitfiscalia.durango.gob.mx (internal)

Developer Identities (37+)

TargetNameEmail
uaem.mxRafael Fragoso (norgoth)[email protected]
uaem.mxAmy Malavar[email protected]
uaem.mxCarlos Clemente[email protected]
uaem.mxJelsy Uribe[email protected]
uaem.mxVictor Gonzalez[email protected]
uaem.mxRicardo Morales[email protected]
ieeq.mxDiana Guerra[email protected]
ieeq.mxMelchor Leal[email protected]
ieeq.mxJorge Lara Mendoza[email protected]
ieeq.mxSergio Gutierrez[email protected]
ieeq.mxJorge[email protected]
ss.pueblaRene Limon[email protected]
elsiglo@MrBoa / Eugenio Ramirez[email protected]
elsigloCarlos Rodriguez[email protected]
elsigloGustavo Hernandez[email protected]
elsigloJaime Favela[email protected]
elsigloJorge Martinez[email protected]
elsigloJorge Avila Flores[email protected]
elsigloMarco Huitron[email protected]
elsigloes-trc (org)[email protected]
elsigloziscko[email protected]
mvs.comAlfredo Gonzalez[email protected]
fiscaliaAlejandro Paredes(internal Gitea)