Return-Path: <bilgi@evdershanem.com>
Delivered-To: toroimpex@webs501.pakchamp.com
Received: from webs501.pakchamp.com
	by webs501.pakchamp.com with LMTP
	id MEo/D9nF2Gl/wjEAs6j5cQ
	(envelope-from <bilgi@evdershanem.com>)
	for <toroimpex@webs501.pakchamp.com>; Fri, 10 Apr 2026 14:41:45 +0500
Return-path: <bilgi@evdershanem.com>
Envelope-to: sales@toroimpex.com
Delivery-date: Fri, 10 Apr 2026 14:41:45 +0500
Received: from ip-193-53-87-126.muvdns.com ([193.53.87.126]:55793 helo=agitated-wright.193-53-87-126.plesk.page)
	by webs501.pakchamp.com with esmtps  (TLS1.3) tls TLS_AES_256_GCM_SHA384
	(Exim 4.98.2)
	(envelope-from <bilgi@evdershanem.com>)
	id 1wB8N1-0000000DfxD-11eC
	for sales@toroimpex.com;
	Fri, 10 Apr 2026 14:41:45 +0500
Received: from dftr (82-209-148-60.cust.bredband2.com [82.209.148.60])
	by agitated-wright.193-53-87-126.plesk.page (Postfix) with ESMTPSA id DEA6F128A9DD;
	Fri, 10 Apr 2026 09:40:36 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=evdershanem.com;
	s=evdershanem; t=1775814060;
	bh=QmxEbaGl3tkgI1IUpmLDIWsLJ8w6jdyeq0H53KruGhI=; h=From:To:Subject;
	b=KRiUXbEIyimpy+26IzbXMB4dcAvsshvwdEInUrK7jmvt+kPhG6LoUBSyBnMTXJuM1
	 x9yat0HfzulLiIM28DnoxnYZHLz5/kJPGd3WPRVwzodU5vr0qcqp+Oh/0uR/hx8m5p
	 BP7bFSD5IWF/dQlW5Q20nPDqHVGZOfLBQJ2Km2uDUVM3PP8yMupRgr/CHi3ow+POeY
	 20EbZ2Qn1aiKcDQz7SM3rExPt8N3GZ1oGOVo240qz9Xyqk2438p3FP/66UXnvzxg/T
	 pxfsClvNa9hP4pjLFfruPHhgZfhyY74RCd62X3v1hcqpH9lz7XEQzscmAE0Hbj4/VV
	 iU2ohCnWT7kzg==
Authentication-Results: agitated-wright.193-53-87-126.plesk.page;
	spf=pass (sender IP is 82.209.148.60) smtp.mailfrom=bilgi@evdershanem.com smtp.helo=dftr
Received-SPF: pass (agitated-wright.193-53-87-126.plesk.page: connection is authenticated)
Message-ID: <BC467ED221F2DD91E74F77C34093E3F9F0A7@evdershanem.com>
Reply-To: Paul Van <bilgi@evdershanem.com>
From: Paul Van <bilgi@evdershanem.com>
To: Fiona <pssurbd@hotmail.com>
Subject: Casino 1win full database for sale
Date: Fri, 10 Apr 2026 11:40:34 +0200
MIME-Version: 1.0
Content-Type: text/plain;
	format=flowed;
	charset="utf-8";
	reply-type=original
Content-Transfer-Encoding: quoted-printable
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Windows Live Mail 16.4.3528.331
X-MimeOLE: Produced By Microsoft MimeOLE V16.4.3528.331
X-Spam-Status: No, score=4.9
X-Spam-Score: 49
X-Spam-Bar: ++++
X-Ham-Report: Spam detection software, running on the system "webs501.pakchamp.com",
 has NOT identified this incoming email as spam.  The original
 message has been attached to this so you can view it or label
 similar future email.  If you have any questions, see
 root\@localhost for details.
 Content preview:  hello I am selling the database for the 1win casino. The database
    contains 96 million customers with full information, and the file is almost
    30 GB in size. In November 2024, the 1Win platform suffered a data breach
    in which attackers copied data for roughly 96-100 million users, including
    email addresses, telephone numbers, IP addresses, countries, geolo [...] 
 Content analysis details:   (4.9 points, 5.0 required)
  pts rule name              description
 ---- ---------------------- --------------------------------------------------
  0.0 T_SPF_HELO_TEMPERROR   SPF: test of HELO record failed (temperror)
  0.0 T_SPF_TEMPERROR        SPF: test of record failed (temperror)
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily valid
  0.1 DKIM_INVALID           DKIM or DK signature exists, but is not valid
  0.0 KAM_DMARC_STATUS       Test Rule for DKIM or SPF Failure with Strict
                             Alignment
  0.2 STOX_REPLY_TYPE        No description available.
  1.9 STOX_REPLY_TYPE_WITHOUT_QUOTES No description available.
  2.6 RDNS_DYNAMIC           Delivered to internal network by host with
                             dynamic-looking rDNS
X-Spam-Flag: NO

hello

I am selling the database for the 1win casino. The database contains 96 m=
illion customers with full information, and the file is almost 30 GB in s=
ize.

In November 2024, the 1Win platform suffered a data breach in which attac=
kers copied data for roughly 96-100 million users, including email addres=
ses, telephone numbers, IP addresses, countries, geolocation, dates of bi=
rth and passwords hashed with SHA-256. The dataset was later added to the=
 Have I Been Pwned? database

If you are interested in buying the database, contact me on Telegram at @=
emaildba

Price: $2000

I accept only Bitcoin or another cryptocurrency as payment method.











cbjvtxgrcjiiwjolyqffdaftlvnovmqkgrfgbyenvgugxugeqfrotgkzuhykbbbxts
gghirryylegeypbgcogctqrowdrtzqkbdsxhrxcbraqsswf
