# OSINT Report: mvs.com — Grupo MVS

**Date:** 2026-02-20
**Source:** Exposed `.git/` directory on production webserver at `https://mvs.com/.git/`
**Recovery Method:** git-dumper (Python 3.13)
**Local Path:** `C:\Users\Squir\Desktop\MEXICO\V A U L T\mvs.com\`
**Status:** Full source code recovered (13 MB, complete checkout)

---

## 1. Target Overview

**Grupo MVS** is one of Mexico's largest private media conglomerates, owning MVS Radio, MVS TV, MVS Noticias, Dish Mexico (satellite TV), and a portfolio of restaurant brands under CMR. Headquartered in Mexico City.

---

## 2. Repository Identity

| Field | Value |
|-------|-------|
| Repo name | `grupo_mvs_v2_landing` |
| Remote URL | `https://agonzalez_@bitbucket.org/mvsradio/grupo_mvs_v2_landing.git` |
| Bitbucket workspace | `mvsradio` |
| Platform | Bitbucket Cloud (private repo) |
| Branch | `master` (production), `dev` (development) |
| Total commits | 14 |
| Active period | March 13 - April 13, 2023 |

**Note:** The "v2" in the repo name implies a v1 landing page exists or previously existed.

---

## 3. Personnel Identified

### Alfredo Gonzalez (MVS Internal Employee)
| Field | Value |
|-------|-------|
| Full name | Alfredo Gonzalez |
| Corporate email | `agonzalez@mvs.com` |
| Bitbucket username | `agonzalez_` |
| Role | DevOps / web deployer |
| Activity | Created repo, performed all pull/merge operations, deployed to production |
| First seen | 2023-03-13 17:46:09 UTC |
| Last seen | 2023-04-13 20:34:52 UTC |

### Noe/Alan Olvera (Contractor)
| Field | Value |
|-------|-------|
| Full name | Noe Olvera / Alan Olvera (same person, alternating git names) |
| Personal email | `olvera.alan@gmail.com` |
| Role | Frontend web developer (built the entire landing page) |
| Timezone | UTC-6 (Mexico City / CST) |
| First seen | 2023-03-14 10:31:10 -0600 |
| Last seen | 2023-04-13 14:34:29 -0600 |

**Key finding:** Olvera used a personal Gmail, not a corporate email — indicates **freelancer/external contractor**, not full-time MVS staff. His git `user.name` alternates between "Noe Olvera" (local commits) and "Alan Olvera" (Bitbucket merges), suggesting legal name is "Alan Noe Olvera" or similar.

---

## 4. Full Commit History

| Hash | Author | Date | Message |
|------|--------|------|---------|
| `8c9d482` | Alfredo Gonzalez | 2023-03-13 | Initial commit (.gitignore only) |
| `81e5031` | Noe Olvera | 2023-03-14 | update: first commit (all assets + HTML) |
| `d13d0a4` | Noe Olvera | 2023-03-14 | update: header |
| `22447db` | Alfredo Gonzalez | 2023-03-14 | Merged dev into master |
| `b2eadcb` | Noe Olvera | 2023-03-16 | update: fix fundaciones and animation |
| `47a24e3` | Alan Olvera | 2023-03-16 | Merged in dev (PR #1) |
| `4373c76` | Noe Olvera | 2023-03-16 | fix: remove acerca de nosotros |
| `e437aec` | Alan Olvera | 2023-03-16 | Merged in dev (PR #2) |
| `1aa2633` | Noe Olvera | 2023-04-13 | images: change los almendros logo |
| `4e9d1d4` | Alan Olvera | 2023-04-13 | Merged in dev (PR #3) |
| `649ab7a` | Noe Olvera | 2023-04-13 | update: new logos for cmr |
| `354e4b3` | Alan Olvera | 2023-04-13 | Merged in dev (PR #4) |
| `7db75cb` | Noe Olvera | 2023-04-13 | update: cmr logo |
| `8b69d55` | Alan Olvera | 2023-04-13 | Merged in dev (PR #5) |

**Workflow:** Developer commits to `dev`, submits PR on Bitbucket, Alfredo merges to `master`, then `git pull` on the production server. The webserver IS the git clone — direct deploy-by-pull.

---

## 5. Deployment Infrastructure

From `.git/logs/HEAD` (reflog):
- Alfredo cloned directly to the production web root
- 6 operations total: 1 clone + 5 pulls
- `.git/` directory left exposed — the source of this dump
- No CI/CD, no hooks, purely manual deployment

---

## 6. All URLs & Domains Found in Source

### MVS Properties
| URL | Entity |
|-----|--------|
| `https://mvs.com` | This site (root) |
| `https://mvscapital.com.mx` | MVS Capital (financial arm) |
| `https://mvstv.com` | MVS Television |
| `https://mvsradio.com/` | MVS Radio |
| `https://mvseducacion.com/` | MVS Educacion |
| `https://mvsentretenimiento.com/` | MVS Entretenimiento |
| `https://mvsideas.com/` | MVS Ideas |

### CMR Restaurant Portfolio
| URL | Brand |
|-----|-------|
| `http://www.cmr.mx` | CMR parent |
| `http://www.wings.com.mx/` | Wings |
| `https://nube7.mx/` | Nube 7 |
| `https://matildbistro.mx/` | Matild Bistro |
| `https://delbosquerestaurante.com.mx/` | Del Bosque |
| `http://bistrochapultepec.com/` | Bistro Chapultepec |
| `https://lago.com.mx/` | Lago |
| `https://thecapitalgrille.com.mx/` | The Capital Grille Mexico |
| `https://chilis.com.mx/` | Chili's Mexico |
| `https://redlobster.com.mx/` | Red Lobster Mexico |
| `https://olivegardenmexico.com.mx/` | Olive Garden Mexico |
| `https://www.sushi-itto.com.mx/` | Sushi Itto |
| `http://salagastronomica.mx/` | Sala Gastronomica |

### Dish Mexico Portfolio
| URL | Service |
|-----|---------|
| `https://www.dish.com.mx` | Dish Mexico (satellite TV) |
| `https://www.dish.com.mx/NETBOX/index.html` | Dish Netbox (streaming device) |
| `https://octopusmx.com/` | Octopus MX |
| `https://oninternet.com.mx/` | On Internet |
| `https://fpop.com.mx/` | FreedomPop Mexico |

### Foundations
| URL | Foundation |
|-----|-----------|
| `https://fundaciondish.org/` | Fundacion Dish |
| `https://fundacioncmr.org/` | Fundacion CMR |
| `https://fundacionmvsradio.org/` | Fundacion MVS Radio |

### Facebook Pages (Raw IDs)
| ID | Entity |
|----|--------|
| `100083292405376` | Los Almendros |
| `100064131215295` | Dish Movil |

### Removed (Divested)
- `http://www.ladestileria.com.mx/` — La Destileria removed from CMR portfolio April 2023, replaced by Nube 7, Matild Bistro, and Del Bosque

---

## 7. Technology Stack

- Pure static HTML/CSS/JS (no backend, no database)
- jQuery 3.6.0 from CDN (with SRI integrity hash)
- CSS image-map layout (invisible `<a>` overlays on image backgrounds)
- No analytics, no tracking pixels, no Google Tag Manager
- Bitbucket-generated default `.gitignore`

---

## 8. Files Recovered

```
.gitignore
index.html
assets/css/styles.css
assets/js/index.js
assets/img/cmr_companies.png
assets/img/dish_companies.png
assets/img/footer.png
assets/img/fundaciones.png
assets/img/header.png
assets/img/main_companies.png
assets/img/mvs_capital.png
assets/img/mvs_companies.png
assets/img/mvs_tv.png
```

---

## 9. Key Intelligence Summary

| Finding | Value |
|---------|-------|
| Bitbucket workspace | `bitbucket.org/mvsradio` (likely has other repos) |
| Internal employee | `agonzalez@mvs.com` (Alfredo Gonzalez) |
| Contractor | `olvera.alan@gmail.com` (Noe/Alan Olvera) |
| Deployment method | git clone to web root (insecure, no CI/CD) |
| Divested brand | La Destileria (removed April 2023) |
| V1 landing exists | Unknown URL (repo named `v2`) |
| No security hardening | No analytics, no WAF, no CSP headers in HTML |