================================================================ MASTER CREDENTIALS REPORT — Mexican .git Exposure Campaign Date: 2026-02-20 (updated 2026-02-25) Targets: uaem.mx, ieeq.mx, ss.puebla.gob.mx, elsiglodetorreon.com.mx, api.elsiglodetorreon.com.mx, mvs.com, fiscalia.durango.gob.mx, repodatos.atdt.gob.mx Repos: 4 fully reconstructed (18,650 commits, 31,925 files) Open API: repodatos.atdt.gob.mx (64 GB mirror, 186M+ records, 38 all_data + 177 api_update agencies) DUMP COMPLETE ================================================================ ================================================================ ALL CREDENTIALS — QUICK REFERENCE ================================================================ === uaem.mx (UAEM University) === MySQL: facdisenousr : LXN*j@9nmVmN @ www.uaem.mx / consfacdiseno SMTP #1: constancias.facdisenio@uaem.mx : Cons_facDisenio9102 @ smtp.gmail.com:465 SMTP #2: constancias.fcqei@uaem.mx : Ventanill4FCQ31 @ smtp.gmail.com:465 === ieeq.mx (Querétaro Electoral Institute) === PgSQL (prod): postgres : Eqaeccasm1500V+- @ 127.0.0.1 / ieeq_site, ieeq_site_admin PgSQL (dev): postgres : root @ localhost / db_Sergio, db_Web, db_Pagina MySQL (Azure):web : fb&BN3cse8j_MH5v @ 104.45.237.221 / ieeq_ieeqmx9453639538, cartografia_ieeqmx3692896128 MySQL (Comms):CCS : C0munic4ci0n.S0ci4l @ 187.191.76.50 / ieeq === ss.puebla.gob.mx (Puebla Health Dept) === MySQL: dst_ss : m%e7A_fAMpt9dVbZ @ localhost / dst_ss (prefix: q4gqt_) Joomla Secret: xSGvpdh2s4Oo1c4F === elsiglodetorreon.com.mx (Newspaper) === MySQL (rw): centenariorw : wwZtK7@c1en1 @ localhost / siglo90, durango MySQL (s22): eT9Server3 : vwDvhNXckAntcWjB6E @ s22 / siglo90 MySQL (s1): eT9Server3 : vwDvhNXckAntcWjB6E @ s1 / Tienda MySQL (IBM): centenario : wwZgtK7@c1en @ 52.117.172.166 / siglo90 MySQL (boa): centenarioboa : vchtBfOfVaYhyBe@100 @ localhost / siglo90, durango MySQL (club): centenario : wwZgtK7@c1en @ localhost / siglo90 MySQL (autos):autos : f0$f0r0Qui3roCaf3 @ 127.0.0.1 / autos MySQL (arch): archive : camaraf0f0r0@ @ localhost / archive SMTP: ventas@losclasificados.mx : mel588mo @ correo.elsiglo.mx:587 ================================================================ 1. uaem.mx — UAEM University (Morelos) ================================================================ Repo: 8,506 commits, 15,147 files. Toolbox: /opt/uaem-repo/ Source: git@github.com:norgoth/uaem2023.git --- 1a. MySQL — Certificate System --- Host: www.uaem.mx Username: facdisenousr Password: LXN*j@9nmVmN Database: consfacdiseno Source: html/constancias-diseno/db/ConexionMySQL.php Test: https://www.uaem.mx/constancias-diseno/db/TestConexion.php Contains: Student PII (SOLICITUD_CONSTANCIAS table) --- 1b. SMTP #1 — Faculty of Design --- Host: smtp.gmail.com:465 (SSL) Username: constancias.facdisenio@uaem.mx Password: Cons_facDisenio9102 Sends to: sescolaresdiseno@uaem.mx Source: html/constancias-diseno/model/EnviarCorreoModel.php --- 1c. SMTP #2 — FCQEI Virtual Window --- Host: smtp.gmail.com:465 (SSL) Username: constancias.fcqei@uaem.mx Password: Ventanill4FCQ31 Sends to: serviciosescolares.fcqei@uaem.mx Source: html/ventanilla-virtual-fcqei/model/EnviarCorreoModel.php Notes: Google Workspace. Both SMTP creds grant Gmail inbox access. Pattern: constancias.@uaem.mx with abbreviated app name passwords. ================================================================ 2. ieeq.mx — Electoral Institute of Querétaro ================================================================ Repo: 310 commits, 5,562 files. Toolbox: /opt/ieeq-repo/ Source: git@gitlab.com:dianguemoli/ieeq.git --- 2a. PostgreSQL — Production --- Host: 127.0.0.1 Username: postgres Password: Eqaeccasm1500V+- Database 1: ieeq_site (schema: ieeq_web) Database 2: ieeq_site_admin (schema: ieeq_webadmin) --- 2b. PostgreSQL — Development --- Host: localhost Username: postgres Password: root Databases: db_Sergio, db_Web, db_Pagina --- 2c. MySQL — Azure --- Host: 104.45.237.221 Username: web Password: fb&BN3cse8j_MH5v Database 1: ieeq_ieeqmx9453639538 Database 2: cartografia_ieeqmx3692896128 --- 2d. MySQL — External (Comunicación Social) --- Host: 187.191.76.50 Username: CCS Password: C0munic4ci0n.S0ci4l Database: ieeq Infrastructure: Internal: 192.168.1.3, 192.168.1.25, 192.168.1.246 Azure: 104.45.237.221 External: 187.191.76.50 DynDNS: ieeq.dynalias.net:8080 Azure Host: serverweb.yojqiyhygdkubacwk5abjp40zc.dx.internal.cloudapp.net Analytics: UA-41848526-1 ================================================================ 3. ss.puebla.gob.mx — Puebla State Health Department ================================================================ Repo: 5 commits, 8,753 files. Toolbox: /opt/ss-puebla-repo/ Source: git@git.develop.dst:dds/secretaria-de-salud.git --- 3a. MySQL — Joomla --- Host: localhost Username: dst_ss Password: m%e7A_fAMpt9dVbZ Database: dst_ss Prefix: q4gqt_ --- 3b. Joomla Secret --- Secret: xSGvpdh2s4Oo1c4F Mail From: portalpuebla@gmail.com Server: /var/www/html/ss/ Notes: Internal GitLab "git.develop.dst" = Puebla state gov IT (DST). dst_ prefix pattern for all state departments. ================================================================ 4. elsiglodetorreon.com.mx — El Siglo de Torreón (Newspaper) ================================================================ Repo: 9,829 commits, 2,463 files. Toolbox: /opt/elsiglo-repo/ Source: git@github.com:es-trc/centenario.git --- 4a. MySQL — Primary RW --- Host: localhost Username: centenariorw Password: wwZtK7@c1en1 Databases: siglo90, durango --- 4b. MySQL — Secondary (s22) --- Host: s22 Username: eT9Server3 Password: vwDvhNXckAntcWjB6E Database: siglo90 --- 4c. MySQL — Tienda/Flores (s1) --- Host: s1 Username: eT9Server3 Password: vwDvhNXckAntcWjB6E Database: Tienda --- 4d. MySQL — Remote (IBM Cloud) --- Host: 52.117.172.166 Username: centenario Password: wwZgtK7@c1en Database: siglo90 --- 4e. MySQL — Admin/BOA --- Host: localhost Username: centenarioboa Password: vchtBfOfVaYhyBe@100 Databases: siglo90, durango --- 4f. MySQL — Club --- Host: localhost Username: centenario Password: wwZgtK7@c1en Database: siglo90 --- 4g. MySQL — Autos --- Host: 127.0.0.1 Username: autos Password: f0$f0r0Qui3roCaf3 Database: autos --- 4h. MySQL — Archive --- Host: localhost Username: archive Password: camaraf0f0r0@ Database: archive --- 4i. SMTP — Clasificados --- Host: correo.elsiglo.mx:587 (TLS) Username: ventas@losclasificados.mx Password: mel588mo From: aclientes@elsiglo.mx --- 4j. Tokens --- TOKEN_PASSWORD: k@VDKgrKRI!z5YVZ76PJpjwB4#rEs0FswcYaGOGmS2HhT8@ce! TOKEN_TARJETA: 3ls1glo100|2021-12-07 TOKEN_PASS: enb5SWeXtgQmFjdr9wBecnFVjx4QrwMq3zFKPYhvFZ6QXJR7HMZPNREEd4me3kK2tVHcNFUjXJfBuJafYmz7X2H8cZQRkPW4 AdSense: ca-pub-5687735147948295 / slot 9692393977 Infrastructure: IBM Cloud: 52.117.172.166 Internal: s22, s1, s3local, cien, cien.elsiglo.mx Media: tecolotito.elsiglodetorreon.com.mx Flores: flores.elsiglo.mx SMTP: correo.elsiglo.mx Clasificados: losclasificados.mx GitHub org: es-trc ================================================================ 5. repodatos.atdt.gob.mx — Federal Open Data API (ATDT) ================================================================ Type: Unauthenticated API — NO CREDENTIALS NEEDED URL: https://repodatos.atdt.gob.mx/ Mirror: 64 GB COMPLETE (50.12 GB enumerated + s_* mirrors, CONAPO, CONEVAL) Files: 1,084+ across 38 all_data agencies, 11 s_* dirs Agencies: 38 in all_data, 177 in api_update Est. Records: 186,000,000+ Last Updated: 2026-02-24 Dump Status: COMPLETE — 28 top-level dirs, mirrored 2026-02-25 CRITICAL PII DATA ACCESSIBLE: SINAC Birth Records (2008-2023): ~60M records, 12.3 GB Fields: mother age, indigenous status, language, marital status, baby details Death Records (1998-2023): ~25M records, 6.1 GB Fields: cause of death, nationality, violence indicators, occupation Education Centers (CURP/RFC): ~6M records, 1.7 GB Fields: CURP, RFC, full names, email, phone, cell, GPS coords Migration Tramites: ~1.3M records, 257 MB Irregular Migration Events: ~700K records, 175 MB Crime Incidence (SESNSP): ~2M records, 424 MB Procurement (Compranet): ~4.5M records, 907 MB CENSIDA HIV Treatment: ~100K records, 22 MB CRE Gas Prices: ~85M records, 1.3 GB CONAPO Population Projections: ~202 MB (demographics 1950-2070, marginalization) CONEVAL Poverty Data: ~48 MB (poverty by municipality, social lag) s_salud Health Sub-datasets: ~16 GB (chronic diseases, family planning, nutrition, vaccines) Treasury (Hacienda): ~461 MB (public finance data) Agriculture: ~403 MB (rural development data) ================================================================ 6. api.elsiglodetorreon.com.mx — Exposed .git (Partial) ================================================================ Git remote: git@github.com:MrBoa-s-Company/api-app-tor.git Upstream: rcasanovae/api-app-tor Status: .git/config accessible, full dump blocked (conn reset) Developer: @MrBoa / Eugenio Ramirez Casanova ================================================================ 7. CREDENTIALS NOT YET RECOVERED ================================================================ uaem.mx: - https://www.uaem.mx/cedulas/.env (Laravel app key, DB creds) - https://www.uaem.mx/titulos-uaem/.env (degree system secrets) - https://www.uaem.mx/.bash_history (shell history) - https://www.uaem.mx/.ssh/ (SSH private keys) fiscalia.durango.gob.mx: - https://fiscalia.durango.gob.mx/wp-config.php (WordPress DB creds) - Internal Gitea: http://10.1.4.194:8085/Alejandro.paredes/mw-red-de-sitios.git ================================================================ 6. DEVELOPER IDENTITIES (37+ unique) ================================================================ uaem.mx: Rafael Fragoso (norgoth/GGakko) rafael.fragoso@uaem.mx Amy Malavar amymalavar@gmail.com Carlos Clemente carlos.clemente@uaem.mx Jelsy Uribe jelsy.uribe@uaem.mx Multimedia (team) multimedia@uaem.mx ieeq.mx: Diana Guerra (dianguemoli07) diana.guerra@ieeq.mx Melchor Leal melchor.leal@ieeq.mx JORGE LARA MENDOZA jorge.lara@ieeq.mx Sergio I. Gutiérrez Q. sergio.gutierrez@ieeq.mx Jorge jorge.mendoza@skyflop.xyz ss.puebla.gob.mx: Rene Limon renecomes@gmail.com elsiglodetorreon.com.mx: @MrBoa / Eugenio Ramírez Casanova rcasanovae@gmail.com Carlos Rodriguez carlosrdz_16@hotmail.com Gustavo Ronaldo Hernandez hernandezgustavoronaldo@gmail.com Jaime Favela jfavela@elsiglo.mx Jorge Martínez Mauricio jorgem@gmail.com Jorge Avila Flores jorge.aviflores@gmail.com Marco Huitron marcohuitron@outlook.com es-trc (org) apps@elsiglo.mx ziscko ziscko.team@gmail.com mvs.com: Alfredo Gonzalez (agonzalez_) agonzalez@mvs.com fiscalia.durango.gob.mx: Alejandro Paredes (internal Gitea) ================================================================ TOTALS ================================================================ Credential sets recovered: 17 (3 MySQL + 2 SMTP + 4 PostgreSQL/MySQL + 1 MySQL + 8 MySQL + 1 SMTP) Application tokens: 4 Joomla secrets: 1 Open APIs (no auth): 1 (repodatos — 64 GB mirror, 186M+ records, DUMP COMPLETE) Developer identities: 37+ Repos reconstructed: 4 (18,650 commits, 31,925 files) External IPs connectable: 104.45.237.221, 187.191.76.50, 52.117.172.166 Open data endpoint: repodatos.atdt.gob.mx (177 agencies, CURP/RFC PII) Huntr scan: Still active on 618 Mexican domains Generated 2026-02-20. Updated 2026-02-25.