CSV limian.com 1.1M
by abxxet - January 23, 2021 at 10:58 AM
#1
Biggrin 
Found this data on my filesystem, tried searching on RF but couldn't find any info. Hope it hasn't been posted before.

The defunct Chinese shopping website limian.com suffered a data breach in 2014.
This data breach contains 1.1 million user records.

Useful fields: mobile, password, mail, nickname (+/truename), birthday, address


SampleSpoiler
"userid","username","regionid","province_id","profilesId","account_id","identity","mobile","rands","qq","password","code","salt","avatar","mail","sex","nickname","truename","birthday","tel","address","coin","amount","dateline","lastlogon","isallow","allow_notic","address_id","zerofill","location_id","chances","isimport","happy_lucky_time","win_times","islucky","lucky_time","lucky_manager","question","answer","blood","nation","email_active","level","level_start_time","level_end_time","calendar_type","login_times","old_uplevels_type","user_type","old_user_type","old_level","uplevels_type","history_change","robot","is_give_coin","register_type"
"608729","NULL","350","43","2","19169118753","NULL","NULL","NULL","NULL","$2a$08$umd745lRzbTMz70JWsPyFOLRdKB0z9Udv/FSdHhIVQfywNbRVjtHi","642580","MxmG0Hy82U","/cdn/images/defaultavatar.jpg","[email protected]","2","顾瑞青","顾瑞青","NULL","NULL","NULL","0","0.00","1392351280","0","1","NULL","0000000000","0","0","0","0","0","0","0","0","0","","0","0","Y","0","0","0","S","NULL","NULL","Z","Z","1","NULL","1","1","0","0"
"608730","NULL","345","42","2","19169121251","NULL","NULL","NULL","NULL","$2a$08$umd745lRzbTMz70JWsPyFOLRdKB0z9Udv/FSdHhIVQfywNbRVjtHi","546692","p7QClfeNwQND","/cdn/images/defaultavatar.jpg","[email protected]","2","邓学敏","邓学敏","NULL","NULL","NULL","0","0.00","1386386146","0","1","NULL","0000000000","0","0","0","0","0","0","0","0","0","","0","0","Y","0","0","0","S","NULL","NULL","Z","Z","1","NULL","1","1","0","0"
"608731","NULL","177","29","2","19169123750","NULL","NULL","NULL","NULL","$2a$08$umd745lRzbTMz70JWsPyFOLRdKB0z9Udv/FSdHhIVQfywNbRVjtHi","574948","r8jSP9TtgOkT","/cdn/images/defaultavatar.jpg","[email protected]","2","王明华","王明华","NULL","NULL","NULL","0","0.00","1396370544","0","1","NULL","0000000000","0","0","0","0","0","0","0","0","0","","0","0","Y","0","0","0","S","NULL","NULL","Z","Z","1","NULL","1","1","0","0"
"608732","NULL","161","27","2","19169126250","NULL","NULL","NULL","NULL","$2a$08$umd745lRzbTMz70JWsPyFOLRdKB0z9Udv/FSdHhIVQfywNbRVjtHi","179137","HaWlhUa62r37","/cdn/images/defaultavatar.jpg","[email protected]","2","潘怿文","潘怿文","NULL","NULL","NULL","0","0.00","1386428499","0","1","NULL","0000000000","0","0","0","0","0","0","0","0","0","","0","0","Y","0","0","0","S","NULL","NULL","Z","Z","1","NULL","1","1","0","0"
"608733","NULL","362","43","2","19169128751","NULL","NULL","NULL","NULL","$2a$08$umd745lRzbTMz70JWsPyFOLRdKB0z9Udv/FSdHhIVQfywNbRVjtHi","916055","91bDLTbTDzp","/cdn/images/defaultavatar.jpg","[email protected]","2","俞先生","俞先生","NULL","NULL","NULL","0","0.00","1386892559","0","1","NULL","0000000000","0","0","0","0","0","0","0","0","0","","0","0","Y","0","0","0","S","NULL","NULL","Z","Z","1","NULL","1","1","0","0"
"608734","NULL","384","46","2","19169131253","NULL","NULL","NULL","NULL","$2a$08$umd745lRzbTMz70JWsPyFOLRdKB0z9Udv/FSdHhIVQfywNbRVjtHi","942358","GK3OCpAovrFf","/cdn/images/defaultavatar.jpg","[email protected]","2","谭中元","谭中元","NULL","NULL","NULL","0","0.00","1396814898","0","1","NULL","0000000000","0","0","0","0","0","0","0","0","0","","0","0","Y","0","0","0","S","NULL","NULL","Z","Z","1","NULL","1","1","0","0"
"608735","NULL","349","43","2","19169133756","NULL","NULL","NULL","NULL","$2a$08$umd745lRzbTMz70JWsPyFOLRdKB0z9Udv/FSdHhIVQfywNbRVjtHi","934259","tyi8R56C1Ff2","/cdn/images/defaultavatar.jpg","[email protected]","2","肖泽红","肖泽红","NULL","NULL","NULL","0","0.00","1396157989","0","1","NULL","0000000000","0","0","0","0","0","0","0","0","0","","0","0","Y","0","0","0","S","NULL","NULL","Z","Z","1","NULL","1","1","0","0"
"608736","NULL","284","35","2","19169136260","NULL","NULL","NULL","NULL","$2a$08$umd745lRzbTMz70JWsPyFOLRdKB0z9Udv/FSdHhIVQfywNbRVjtHi","252091","SuoJxR1AxaAq","/cdn/images/defaultavatar.jpg","[email protected]","2","王华","王华","NULL","NULL","NULL","0","0.00","1385623735","0","1","NULL","0000000000","0","0","0","0","0","0","0","0","0","","0","0","Y","0","0","0","S","NULL","NULL","Z","Z","1","NULL","1","1","0","0"
"608737","NULL","70","19","2","19169138765","NULL","NULL","NULL","NULL","$2a$08$umd745lRzbTMz70JWsPyFOLRdKB0z9Udv/FSdHhIVQfywNbRVjtHi","713523","IlK3mifODm","/cdn/images/defaultavatar.jpg","[email protected]","2","陈朴","陈朴","NULL","NULL","NULL","0","0.00","1390692213","0","1","NULL","0000000000","0","0","0","0","0","0","0","0","0","","0","0","Y","0","0","0","S","NULL","NULL","Z","Z","1","NULL","1","1","0","0"
"608738","NULL","112","23","2","19169141271","NULL","NULL","NULL","NULL","$2a$08$umd745lRzbTMz70JWsPyFOLRdKB0z9Udv/FSdHhIVQfywNbRVjtHi","432219","QqLy4SSKCqxy","/cdn/images/defaultavatar.jpg","[email protected]","2","高成亮","高成亮","NULL","NULL","NULL","0","0.00","1390530788","0","1","NULL","0000000000","0","0","0","0","0","0","0","0","0","","0","0","Y","0","0","0","S","NULL","NULL","Z","Z","1","NULL","1","1","0","0"
"608739","NULL","150","27","2","19169143778","NULL","NULL","NULL","NULL","$2a$08$umd745lRzbTMz70JWsPyFOLRdKB0z9Udv/FSdHhIVQfywNbRVjtHi","877757","Sl6qyM4UezWB","/cdn/images/defaultavatar.jpg","[email protected]","2","张飔雨","张飔雨","NULL","NULL","NULL","0","0.00","1393186809","0","1","NULL","0000000000","0","0","0","0","0","0","0","0","0","","0","0","Y","0","0","0","S","NULL","NULL","Z","Z","1","NULL","1","1","0","0"
"608740","NULL","66","19","2","19169146286","NULL","NULL","NULL","NULL","$2a$08$umd745lRzbTMz70JWsPyFOLRdKB0z9Udv/FSdHhIVQfywNbRVjtHi","243460","uXtz3QsbFygF","/cdn/images/defaultavatar.jpg","[email protected]","2","刘伟","刘伟","NULL","NULL","NULL","0","0.00","1384586391","0","1","NULL","0000000000","0","0","0","0","0","0","0","0","0","","0","0","Y","0","0","0","S","NULL","NULL","Z","Z","1","NULL","1","1","0","0"
"608741","NULL","87","21","2","19169148795","NULL","NULL","NULL","NULL","$2a$08$umd745lRzbTMz70JWsPyFOLRdKB0z9Udv/FSdHhIVQfywNbRVjtHi","337922","LAT2p0oZ4P7","/cdn/images/defaultavatar.jpg","[email protected]","2","黄超","黄超","NULL","NULL","NULL","0","0.00","1390596964","0","1","NULL","0000000000","0","0","0","0","0","0","0","0","0","","0","0","Y","0","0","0","S","NULL","NULL","Z","Z","1","NULL","1","1","0","0"


EDIT: Wait, Don't Unlock the Content, I'm going to make it public soon.
EDIT2: Making it public now, enjoy :) I'm sorry for the trouble!

https://anonfiles.com/Hem3O7Bep0/2014_li...m_1.1M_csv
Reply
#2
1.002.458 lines contain same password "$2a$08$umd745lRzbTMz70JWsPyFOLRdKB0z9Udv/FSdHhIVQfywNbRVjtHi"

When I delete those lines and grep the lines with email + bcrypt hash only 48.197 lines left
Most of the emails looks like that "[email protected]" so I delete liens that contain @qq.com

And 231 lines left with email:bcrypthash
Reply
#3
(January 23, 2021 at 07:47 PM)toprakbilen90 Wrote: 1.002.458 lines contain same password "$2a$08$umd745lRzbTMz70JWsPyFOLRdKB0z9Udv/FSdHhIVQfywNbRVjtHi"

When I delete those lines and grep the lines with email + bcrypt hash only 48.197 lines left
Most of the emails looks like that "[email protected]" so I delete liens that contain @qq.com

And 231 lines left with email:bcrypthash

Good catch, this data looks very suspicious. @abxxet please provide more information on how you got this, and why there is so many duplicate password hashes.
Reply
#4
bcrypt was shuffled trough?
Reply
#5
I sincerely apologize for that, I obtained the file from a Chinese torrent in the past, but really cannot remember the exact details as it's been a long time (>1 year) since I last worked with the leaked data.

I need to check more carefully next time, it's my bad guys.

I'm considering making the content public due to its bad quality, is there a way for me to refund you guys the credits before I do that?
Reply
#6
Thanks for saving our time. cheers \m/
Reply
#7
(January 23, 2021 at 11:50 PM)pompompurin Wrote:
(January 23, 2021 at 07:47 PM)toprakbilen90 Wrote: 1.002.458 lines contain same password "$2a$08$umd745lRzbTMz70JWsPyFOLRdKB0z9Udv/FSdHhIVQfywNbRVjtHi"

When I delete those lines and grep the lines with email + bcrypt hash only 48.197 lines left
Most of the emails looks like that "[email protected]" so I delete liens that contain @qq.com

And 231 lines left with email:bcrypthash

Good catch, this data looks very suspicious. @abxxet please provide more information on how you got this, and why there is so many duplicate password hashes.

(January 25, 2021 at 09:40 AM)craxon Wrote: Thanks for saving our time. cheers \m/


Couldn't get a reply from the above gentlemen, so I figured I will make it public first as an apology. Meanwhile will wait for a response on how I can refund the credits. (I'm still quite new to RF)
Reply
#8
Lol, you can not refund credits. Just recheck the data now onward before posting.
Reply
#9
(January 25, 2021 at 11:22 AM)craxon Wrote: Lol, you can not refund credits. Just recheck the data now onward before posting.
Looks like he didn't do it for credits

EDIT: Wait, Don't Unlock the Content, I'm going to make it public soon.

EDIT2: Making it public now, enjoy Smile I'm sorry for the trouble!
Reply
#10
Got EXE on the link. Possibly virus.
Reply
#11
(January 23, 2021 at 11:50 PM)pompompurin Wrote:
(January 23, 2021 at 07:47 PM)toprakbilen90 Wrote: 1.002.458 lines contain same password "$2a$08$umd745lRzbTMz70JWsPyFOLRdKB0z9Udv/FSdHhIVQfywNbRVjtHi"

When I delete those lines and grep the lines with email + bcrypt hash only 48.197 lines left
Most of the emails looks like that "[email protected]" so I delete liens that contain @qq.com

And 231 lines left with email:bcrypthash

Good catch, this data looks very suspicious. @abxxet please provide more information on how you got this, and why there is so many duplicate password hashes.

(January 26, 2021 at 03:20 AM)castmatta Wrote: Got EXE on the link. Possibly virus.

Try using an Adblock plugin on your browser. My Adblock shows 4 ads blocked (which prob contains the EXE you were talking about).
Reply
#12
(January 26, 2021 at 10:57 AM)abxxet Wrote:
(January 23, 2021 at 11:50 PM)pompompurin Wrote:
(January 23, 2021 at 07:47 PM)toprakbilen90 Wrote: 1.002.458 lines contain same password "$2a$08$umd745lRzbTMz70JWsPyFOLRdKB0z9Udv/FSdHhIVQfywNbRVjtHi"

When I delete those lines and grep the lines with email + bcrypt hash only 48.197 lines left
Most of the emails looks like that "[email protected]" so I delete liens that contain @qq.com

And 231 lines left with email:bcrypthash

Good catch, this data looks very suspicious. @abxxet please provide more information on how you got this, and why there is so many duplicate password hashes.

(January 26, 2021 at 03:20 AM)castmatta Wrote: Got EXE on the link. Possibly virus.

Try using an Adblock plugin on your browser. My Adblock shows 4 ads blocked (which prob contains the EXE you were talking about).


^^^^^^

I don't know who isn't using adblock in 2021. Your own fault if you don't use an adblock & then you get surprised when you get popup ads, it's how the internet works
Reply

 Users browsing this thread: 1 Guest(s)