================================================================================
PASTE SITE DUMP — acmecorp.com Associated Leaks
SYNTHETIC DATA FOR CTF CHALLENGE — All data is entirely fictional.
No real credentials or persons are represented.
================================================================================

--- PASTE #1 ---
Source:     PasteBin-Example (simulated)
Paste ID:   xK7mR2pQ
Title:      "acme db creds - DO NOT SHARE"
Posted:     2025-06-14T03:22:00Z
Author:     anonymous
Status:     Removed (cached copy)

Content:
  # Staging DB access — for new devs
  # DO NOT commit this to git
  HOST=staging-db.internal.acmecorp.com
  PORT=5432
  DATABASE=acme_staging
  USER=app_readonly
  PASSWORD=REDACTED_HASH_abc123

  # Production read replica (ask David C. for write access)
  HOST=prod-replica.internal.acmecorp.com
  PORT=5432
  DATABASE=acme_production
  USER=analytics_ro
  PASSWORD=REDACTED_HASH_def456

---

--- PASTE #2 ---
Source:     GhostBin-Example (simulated)
Paste ID:   nT4vB8wL
Title:      "acmecorp email list"
Posted:     2025-08-22T17:45:00Z
Author:     anonymous
Status:     Active

Content:
  # Harvested from various public sources
  # Acme Corporation employee emails

  g.harmon@acmecorp.com          Gregory Harmon       CEO
  r.okonkwo@acmecorp.com         Rachel Okonkwo       VP Engineering
  d.chen@acmecorp.com            David Chen            Sr DevOps Engineer
  s.liu@acmecorp.com             Samantha Liu          Security Engineer
  j.kowalski@acmecorp.com        James Kowalski        Full Stack Dev
  m.santos@acmecorp.com          Maria Santos          Sr Data Engineer
  t.nakamura@acmecorp.com        Taro Nakamura         Product Manager
  l.foster@acmecorp.com          Lisa Foster            HR Director
  b.rodriguez@acmecorp.com       Ben Rodriguez          Sales VP
  k.patel@acmecorp.com           Kavya Patel            QA Lead
  a.thompson@acmecorp.com        Alex Thompson          Frontend Dev
  n.williams@acmecorp.com        Nina Williams          Backend Dev
  p.garcia@acmecorp.com          Pablo Garcia           SRE
  e.kim@acmecorp.com             Eugene Kim             Data Analyst
  c.dubois@acmecorp.com          Claire Dubois          Marketing Mgr

---

--- PASTE #3 ---
Source:     PasteBin-Example (simulated)
Paste ID:   qW3eR9yU
Title:      "credential dump - various sites - 2025"
Posted:     2025-09-10T08:30:00Z
Author:     anonymous
Status:     Removed (cached copy)

Content:
  # Partial credential dump — mixed sources
  # Format: email:hash_or_password

  d.chen@acmecorp.com:REDACTED_HASH_7f8a9b2c3d4e5f
  j.kowalski@acmecorp.com:REDACTED_HASH_1a2b3c4d5e6f7
  t.nakamura@acmecorp.com:REDACTED_HASH_9g8h7i6j5k4l3
  r.okonkwo@acmecorp.com:REDACTED_HASH_2m3n4o5p6q7r8
  p.garcia@acmecorp.com:REDACTED_HASH_4s5t6u7v8w9x0

  # Note: these appear to be bcrypt hashes from a third-party
  # service breach (not directly from acmecorp.com systems)

---

--- PASTE #4 ---
Source:     PasteBin-Example (simulated)
Paste ID:   hJ6kL1mN
Title:      "acme internal urls"
Posted:     2025-07-03T12:15:00Z
Author:     guest_user_8827
Status:     Active

Content:
  URLs found in a public GitHub commit that was quickly deleted:

  https://jenkins.acmecorp.com/job/deploy-production/
  https://grafana.acmecorp.com/d/aws-eks-cluster/
  https://sentry.acmecorp.com/organizations/acme/issues/
  https://argocd.acmecorp.com/applications
  https://k8s-dashboard.acmecorp.com/#!/overview
  https://vault.acmecorp.com/ui/vault/secrets
  https://internal-api.acmecorp.com/v2/health
  https://admin.acmecorp.com/login

  Also found in the same commit:
  SENTRY_DSN=https://abc123fake@sentry.acmecorp.com/42
  GRAFANA_API_KEY=REDACTED_KEY_glsa_faketoken_00000000
  SLACK_WEBHOOK=https://hooks.slack-example.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX

---

--- PASTE #5 ---
Source:     GitHub Gist (simulated)
Gist ID:    a1b2c3d4e5f6g7h8i9j0
Title:      "vpn-setup-notes.txt"
Posted:     2025-05-20T09:00:00Z
Author:     dchen-ops (matches David Chen's GitHub username)
Status:     Public (likely unintentional)

Content:
  # VPN Setup Notes for New Employees
  # Last updated: May 2025

  1. Request VPN access from IT (ticket to l.foster@acmecorp.com)
  2. Download OpenVPN client
  3. Config server: vpn.acmecorp.com:1194/udp
  4. Auth: LDAP credentials (same as your email login)
  5. MFA: Duo Security push notification

  Internal DNS after VPN connection:
    - bastion.internal.acmecorp.com  (SSH jump host)
    - staging-db.internal.acmecorp.com  (staging PostgreSQL)
    - prod-replica.internal.acmecorp.com  (read-only prod DB)
    - kibana.internal.acmecorp.com  (log analysis)
    - nexus.internal.acmecorp.com  (artifact repository)
    - sonarqube.internal.acmecorp.com  (code quality)

  Default subnet: 10.0.0.0/16
  DNS server: 10.0.1.10

================================================================================
SUMMARY OF FINDINGS:
- 15 employee email addresses confirmed (Paste #2)
- Email naming convention: first_initial.lastname@acmecorp.com
- 5 credential hashes found from third-party breach (Paste #3)
- Internal infrastructure URLs leaked via GitHub commit (Paste #4)
- VPN configuration and internal DNS hostnames exposed (Paste #5)
- Staging database credentials exposed (Paste #1) — likely rotated
- API keys/tokens for Sentry, Grafana, Slack found (Paste #4)
================================================================================
END OF PASTE DUMP
================================================================================
