===== tokens: 5 rows =====
token=site-mgmt jwt-private.pem (RS256) /var/www/vhosts/site-mgmt.afd.tools/htdocs/storage/app/private/jwt-private.pem | kind=jwt_private_key | source=prober-rce-post | first_seen=2026-09-12T16:21:46Z
token=6Le5l-wSAAAAANaT_bXrPrSw2vvTXEYTKMGjU-g_ | kind=recaptcha_private_key | source=op03-z6-runner-secrets | first_seen=2026-10-04T17:36:06Z
token=6Le5l-wSAAAAADIrQD5FOLU8Kj6I92CTuqsnUWFX | kind=recaptcha_site_key | source=op03-z6-runner-secrets | first_seen=2026-10-04T17:36:06Z
token=7idTP49H8X8whEYssXv3af1xohystXYlBzec7KHY | kind=django_secret_key | source=op03-z6-runner-secrets | first_seen=2026-10-04T17:36:06Z
token=lTNaYMHA5cVGt62ISuNwdd2MCpiCScp4fthuNXd2 | kind=django_secret_key | source=op03-z6-runner-secrets | first_seen=2026-10-04T17:36:06Z

===== creds: 227 rows =====
cred=dh | kind=wp-username-spenden.afd.de | source=g42 enum: feed dc:creator + posts author id4 | first_seen=2026-09-09T18:51:50Z
cred=3240 | kind=wp-username-www.afd.de | source=g42 enum: posts author id (main, 284x) | first_seen=2026-09-09T18:51:50Z
cred=3238 | kind=wp-username-www.afd.de | source=g42 enum: posts author id | first_seen=2026-09-09T18:51:50Z
cred=akussma | kind=username | source=bdafdbundestag-prober | first_seen=2026-09-10T12:23:31Z
cred=anastasia.dudko@gmx.de | kind=email | source=prober-rce-db | first_seen=2026-09-12T18:16:24Z
cred=anastasiaronald@gmx.de | kind=email | source=prober-rce-db | first_seen=2026-09-12T18:16:24Z
cred=euer_ostseemarkt@yahoo.com | kind=email | source=prober-rce-db | first_seen=2026-09-12T18:16:24Z
cred=gassmann.ua@t-online.de | kind=email | source=prober-rce-db | first_seen=2026-09-12T18:16:24Z
cred=grossmann-selm@t-online.de | kind=email | source=prober-rce-db | first_seen=2026-09-12T18:16:24Z
cred=guido-murawski@web.de | kind=email | source=prober-rce-db | first_seen=2026-09-12T18:16:24Z
cred=gweissmann71@gmail.com | kind=email | source=prober-rce-db | first_seen=2026-09-12T18:16:24Z
cred=hessmarina489@gmail.com | kind=email | source=prober-rce-db | first_seen=2026-09-12T18:16:24Z
cred=jerrybrunner@web.de | kind=email | source=prober-rce-db | first_seen=2026-09-12T18:16:24Z
cred=karinblessmann51@yahoo.de | kind=email | source=prober-rce-db | first_seen=2026-09-12T18:16:24Z
cred=klaudia.bielawski@gmail.com | kind=email | source=prober-rce-db | first_seen=2026-09-12T18:16:24Z
cred=messmerf@gmx.de | kind=email | source=prober-rce-db | first_seen=2026-09-12T18:16:24Z
cred=mielkehorststephan@gmail.com | kind=email | source=prober-rce-db | first_seen=2026-09-12T18:16:24Z
cred=passtscho@hotmail.com | kind=email | source=prober-rce-db | first_seen=2026-09-12T18:16:24Z
cred=r.jassmann@web.de | kind=email | source=prober-rce-db | first_seen=2026-09-12T18:16:24Z
cred=rossmeiermarcel@gmail.com | kind=email | source=prober-rce-db | first_seen=2026-09-12T18:16:24Z
cred=stefanostsee.ss@gmail.com | kind=email | source=prober-rce-db | first_seen=2026-09-12T18:16:24Z
cred=thorsten.kossmann@freenet.de | kind=email | source=prober-rce-db | first_seen=2026-09-12T18:16:24Z
cred=poststelle@nuernberger-land.de | kind=email | source=prober-sister-db | first_seen=2026-09-12T19:05:15Z
cred=timothytissmer@web.de | kind=email | source=prober-sister-db | first_seen=2026-09-12T19:05:15Z
cred=kleinesmiststueck77@web.de | kind=email | source=prober-sister-db | first_seen=2026-09-12T19:07:52Z
cred=daniel_brunner@web.de | kind=email | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
cred=gravityactions-banner-1544x500@2x.png | kind=email | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
cred=stshh@web.de | kind=email | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
cred=weissmichaela@web.de | kind=email | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
cred=brunner.ja@t-online.de | kind=email | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
cred=dtm-grossmeister@gmx.de | kind=email | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
cred=gi.grossmann@t-online.de | kind=email | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
cred=grossmanngerdo@gmail.com | kind=email | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
cred=issmer-klassik@t-online.de | kind=email | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
cred=laurasiatheria@hotmail.de | kind=email | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
cred=lawskruemel@gmail.com | kind=email | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
cred=mariongassmann@gmx.de | kind=email | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
cred=martin.kussmann01@gmail.com | kind=email | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
cred=mrssmall@web.de | kind=email | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
cred=oli.kaltenbrunner@icloud.com | kind=email | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
cred=oliver.weissmann@t-online.de | kind=email | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
cred=poststelle@bmf.bund.de | kind=email | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
cred=thessmanns@yahoo.de | kind=email | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
cred=uwe.rossmann@gmx.de | kind=email | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
cred=wflessmann@t-online.de | kind=email | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
cred=wolfgang.brunner@icloud.com | kind=email | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
cred=aao36479@awsoo.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=afd.frenzy027@passmail.net | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=afdistschwul@web.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=alexander@bewusstscout.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=anastasia.schilling@gmx.net | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=andrea.weissmann@web.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=andreastessmer@hotmail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=anton.m.brunner@t-online.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=asimmer@bossmail.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=august.geir.agustsson@for.is | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=awstoeckl@yahoo.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=b.b.weissmann@freenet.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=b.brunnert@gmx.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=basiareinke@arcor.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=basis-treffen@lists.riseup.net | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=berndwissmann@gmx.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=bestseotools7@gmail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=bossmopss@gmail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=brunnert@gmx.net | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=c-grossmann@online.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=chadwick.pawsey@gmail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=chr.kossmann@gmx.net | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=christophweissmuenchen@web.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=claussmonika7130@gmail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=clx85512@awsoo.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=contact@ssmbucharest.ro | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=cssmbayern33@gmail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=daniel-wassmann@gmx.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=david.messmann@web.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=dgl07122@awsoo.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=dickistschick@gmail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=dirkgressmann@yahoo.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=dobbybrunner@gmail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=eastasiainfo@voanews.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=eurasia@gmx.net | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=eurasiainfo@voanews.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=firstsunrise@gmx.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=flugrostsammler@gmx.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=foirequests@homeoofice.gsi.gov.uk | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=gereonschlossmacher@mac.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=grassmann.r@compact-mail.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=grossmann.stefan@me.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=grossmann.udo@gmail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=grossmogul13437@gmx.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=hans.fissmer@gmail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=hansflossmann@web.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=harald-freissmann@web.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=harald.wissmueller@yahoo.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=hartmut.glossmann@i-med.ac.at | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=holger.rossmeier.afd@gmail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=horstschlemmer@gmail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=horstsonnenberg@outlook.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=horststahl5@gmail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=horststeininger@gmx.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=ichandreaskussmaul@yahoo.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=info-sts@t-online.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=info@kunstschlosserei.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=info@sts-verbund.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=j-hussmann@t-online.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=jasenasiat@vasemmistoliitto.fi | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=jasenasiat@vihreat.fi | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=jens.nessmann@t-online.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=jessmortenhansen@yahoo.dk | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=karlheinzhassmer@yahoo.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=kasia.krys79@gmail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=kaufmannshauselbe.westside@gmail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=kissmann.christopher@dpa.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=klaus.cossmann@web.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=kletternistsuper@gmail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=kochbssm@gmail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=kujawsko-pomorskie@solidarna.org | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=kujawskopomorskie@ruchnarodowy.net | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=l.mussmann67@gmx.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=lars.brunner@stud.unibas.ch | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=lebrawsf@gmail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=limbrunner-parnkofen@t-online.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=marceleissmann@gmail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=mario.assmann@afdsachsen.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=martin.lessmeister@hotmail.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=masia.ernestina@gmx.es | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=massmy@web.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=melirissmann@gmail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=messmannmanuel@gmail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=michael.bussmann@freenet.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=missmorgana44@googlemail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=murawski-jutta@t-online.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=nadinefuessmann@gmx.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=neurasiainfo@voanews.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=nik-brunner2@aol.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=npoststelle@bundeskanzlerin.de-mail.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=npoststelle@jum.bwl.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=npoststelle@lg.justiz.hamburg.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=nsts-noetzel@t-online.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=olga_brunner@web.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=oliver.rossmeier@t-online.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=ortmann@bossmail.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=ostseefloh@freenet.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=passmann2210@gmail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=philipptessmann@googlemail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=pjdawson98@gmail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=post4aws@yaho.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=poststelle-sw@arbg-wue.bayern.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=poststelle@ag-has.bayern.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=poststelle@bgh.bund.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=poststelle@bka.bund.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=poststelle@bmbf-bund.de-mail.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=poststelle@bmel.bund.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=poststelle@brh.bund.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=poststelle@bundeskanzlerin.de-mail.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=poststelle@bundesregierung.de-mail.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=poststelle@generalbundesanwalt.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=poststelle@gensta-ba.bayern.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=poststelle@gensta-m.bayern.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=poststelle@lag-m.bayern.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=poststelle@lg-ba.bayern.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=poststelle@lg-sw.bayern.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=poststelle@lrh.nrw.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=poststelle@olg-ba.bayern.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=poststelle@olg-hamm.nrw.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=poststelle@olg-m.bayern.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=poststelle@olg-n.bayern.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=poststelle@sta-bielefeld.nrw.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=poststelle@sta-sw.bayern.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=poststelle@vg-w.bayern.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=puststeffen@gmail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=qawse25800@gmail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=rassmann72@t-online.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=rastschubai2012@gmail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=redbaron@bossmail.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=reinhard.w.grossmann@t-online.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=rita.giannini@lawsociety.org.uk | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=roadrunner.2910@t-online.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=roadrunner@netcologne.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=robert.schoenbrunner@arcor.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=robertogrossmann@gmail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=rossma@versanet.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=ruediger.grossmann@googlemail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=simonassmann7@gmail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=sonjarossmann@hotmail.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=southandcentralasiainfo@voanews.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=ssm@skm.dk | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=ssmartkid@yahoo.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=stefan.a.brunner@gmail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=stefan.lissmann@web.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=steven.grossmann@gmx.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=sts-noetzel@t-online.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=sts03021967@gmail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=stsandb2@gmail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=stschmid@gmx.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=svensassmann@gmail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=thomas.gaenssmantel@web.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=thomas.nauroschat@primesolutionasia.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=thomas.wissmann@gmx.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=tim.jassmann@gmail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=tim.kossman@bbs-bsb.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=ugrossmann@gmx.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=ursularhorstspam@gmail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=vossmaik@googlemail.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=w.limbrunner@gmx.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=walter.weissmueller@gmx.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=wbsasia_2000@yahoo.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=westphalen@awservice.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=wissmann-peter@web.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=yhdistysasiat@vihreat.fi | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=yhx53692@awsoo.com | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=zaslawski@t-online.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=zima@bossmail.de | kind=email | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
cred=amazon1170@online.de | kind=email | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
cred=anastasia.sacharenko@gmail.com | kind=email | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
cred=bigagebjoernassmann@gmail.com | kind=email | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
cred=ernstseitz@hairforce1.de | kind=email | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
cred=feistserina@gmail.com | kind=email | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
cred=grossmannmandy8@gmail.com | kind=email | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
cred=pa.bussmann@outlook.de | kind=email | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
cred=stschneider@gmx.net | kind=email | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
cred=wandalissmus62@gmail.com | kind=email | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
cred=michael.rossmeier@afd-bielefeld.de | kind=email | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
cred=rro@alternita.gmbh mail_mgmt role=1 with allowed_actions [domains,mailboxes,forwards,bcc_redirects] = full mail-routing write over 500 domains | kind=panel_account | source=op03-j3b-itdept | first_seen=2026-10-03T16:18:42Z
cred=gunnar@g10f.de | kind=idp_account | source=op03-v2-vendor-account | first_seen=2026-10-04T08:40:47Z
cred=Anastasia2012@gmail.com | kind=email | source=op03-y7-hildesheim-more | first_seen=2026-10-04T16:43:09Z
cred=ec1e39cbe3e746c787b770ace4165d13:dCH8rLoO6UEa2T6pxG6Wt4AI | kind=oidc_client_secret:g10f+dwbn_prod | source=op03-bb4-oidc-secrets | first_seen=2026-10-04T19:43:12Z

===== pivots: 399 rows =====
kind=vhost | value=SNI-routed HTTPS: live vhosts afd.de(301->www), www(200), mitmachen(200), spenden(200), wahlkampf(200), stammdaten(302); unknown *.afd.de -> nginx 403 "Zugriff gesperrt" 146B | related=front pool | source=g7 | first_seen=2026-09-09T03:01:24Z
kind=vhost | value=afd-hosting.de wildcard A->3.79.68.56 (AWS dead); real mail: mail./smtp./imap./pop./mx.afd-hosting.de -> 162.55.9.211 | related=afd-hosting.de | source=g7 | first_seen=2026-09-09T03:01:24Z
kind=vhost | value=afd.tools apex->34.248.116.63 (AWS dead); webmail/mail-autodiscover.afd.tools -> 88.198.31.157+162.55.9.211; autodiscover/autoconfig.afd.tools -> 213.239.234.92 | related=afd.tools | source=g7 | first_seen=2026-09-09T03:01:24Z
kind=app | value=Tourscope Partner Portal (portal*.tourscope.site) | related=AWS ELB direct (no CF); /login partner UI | source=g19 | first_seen=2026-09-09T13:41:05Z
kind=mail-tenant | value=afd.tools | related=MX mx.afd-hosting.de; A 34.248.116.63 (AWS) website/cdn; mail tenants on afd-hosting infra | source=g18 | first_seen=2026-09-09T14:08:27Z
kind=mail-tenant | value=afd-hosting.de | related=MX mx.afd-hosting.de; website A 3.79.68.56 AWS unreachable direct+proxy; operator of mail infra for afd.tools/afd-anhalt-bitterfeld.de | source=g18 | first_seen=2026-09-09T14:08:27Z
kind=org-candidate | value=AfD Bundesverband (federal) | related=manager-23/erfassung-23/wolke-23/zeit-23 = AfD federal IT; erfassung-23 membership form lists all 471 KVs; TiMaS licence to Alternita Dienstleistungs-GmbH | source=g28 sewobe research | first_seen=2026-09-09T14:47:37Z
kind=aws_access_key_id | value=AKIATPQD5KSQ53XPDKG6 | related=appears in presigned GET URLs returned by unauth upload (id only, no secret exposed) | source=g41 | first_seen=2026-09-09T18:33:45Z
kind=wp_user_id | value=7=Tino Pinkert | related=author-sitemap + posts author=7 | source=xplore-3 | first_seen=2026-09-10T00:20:37Z
kind=wp_user_id | value=hidden-6 | related=posts author id {uid} exists but ?author={uid} 403 WAF | source=xplore-3 | first_seen=2026-09-10T00:20:37Z
kind=wp_user_id | value=hidden-8 | related=posts author id {uid} exists but ?author={uid} 403 WAF | source=xplore-3 | first_seen=2026-09-10T00:20:37Z
kind=wp_user_id | value=hidden-9 | related=posts author id {uid} exists but ?author={uid} 403 WAF | source=xplore-3 | first_seen=2026-09-10T00:20:37Z
kind=tooling-framework | value=logs\_artifacts\icmpc2\key.json | related=AES-256-GCM per-deployment key (local, generated; never in code) | source=icmp-c2 | first_seen=2026-09-10T04:13:32Z
kind=backend | value=3.79.68.56 AWS eu-central-1 (bw-lv-portal/stellenportal) | related=afd-hosting AWS portals (522) | source=cvesvc | first_seen=2026-09-10T06:34:42Z
kind=backend | value=34.248.116.63 AWS eu-west-1 (cp.afd-hosting.de) | related=522 origin down | source=cvesvc | first_seen=2026-09-10T06:34:42Z
kind=cve | value=CVE-2026-6728-sliderrev-stream | related=69 leaking WP hosts (afd.de fleet) | source=cve-sliderrev | first_seen=2026-09-10T07:27:09Z
kind=service | value=8082/tcp nginx (all 4 mail-out-proxy hosts, IP-allowlisted 403) | related=mail cluster | source=prober-bkmail | first_seen=2026-09-10T08:54:14Z
kind=internal-path | value=/mnt/webserver/hosts/manager-23.de/manager_source/webportal/ | related=manager-23.de webportal | source=bkcluster | first_seen=2026-09-10T09:09:49Z
kind=backend_api | value=api-ameen.tourscope.site | related=AMEEN DevOps backend (Express, AWS ELB, registry v2) | source=bktourscope-prober | first_seen=2026-09-10T09:13:24Z
kind=rdns | value=ec2-18-184-211-89.eu-central-1.compute.amazonaws.com | related=18.184.211.89 | source=vhost-cert | first_seen=2026-09-10T11:41:31Z
kind=rdns | value=ec2-18-195-98-53.eu-central-1.compute.amazonaws.com | related=18.195.98.53 | source=vhost-cert | first_seen=2026-09-10T11:41:31Z
kind=rdns | value=ns-94.awsdns-11.com | related=205.251.192.94 | source=vhost-cert | first_seen=2026-09-10T11:41:31Z
kind=rdns | value=ns-679.awsdns-20.net | related=205.251.194.167 | source=vhost-cert | first_seen=2026-09-10T11:41:31Z
kind=rdns | value=ns-1240.awsdns-27.org | related=205.251.196.216 | source=vhost-cert | first_seen=2026-09-10T11:41:31Z
kind=rdns | value=ns-1936.awsdns-50.co.uk | related=205.251.199.144 | source=vhost-cert | first_seen=2026-09-10T11:41:31Z
kind=rdns | value=designerlb.hr1.hoststar.ch | related=213.239.221.71 | source=vhost-cert | first_seen=2026-09-10T11:41:31Z
kind=rdns | value=ec2-3-122-37-211.eu-central-1.compute.amazonaws.com | related=3.122.37.211 | source=vhost-cert | first_seen=2026-09-10T11:41:31Z
kind=rdns | value=ec2-3-79-68-56.eu-central-1.compute.amazonaws.com | related=3.79.68.56 | source=vhost-cert | first_seen=2026-09-10T11:41:31Z
kind=rdns | value=ec2-34-248-116-63.eu-west-1.compute.amazonaws.com | related=34.248.116.63 | source=vhost-cert | first_seen=2026-09-10T11:41:31Z
kind=rdns | value=g10f.de | related=35.157.38.218 | source=vhost-cert | first_seen=2026-09-10T11:41:31Z
kind=rdns | value=ec2-52-213-108-4.eu-west-1.compute.amazonaws.com | related=52.213.108.4 | source=vhost-cert | first_seen=2026-09-10T11:41:31Z
kind=rdns | value=ec2-52-214-180-27.eu-west-1.compute.amazonaws.com | related=52.214.180.27 | source=vhost-cert | first_seen=2026-09-10T11:41:31Z
kind=rdns | value=ec2-52-58-51-188.eu-central-1.compute.amazonaws.com | related=52.58.51.188 | source=vhost-cert | first_seen=2026-09-10T11:41:31Z
kind=rdns | value=ec2-63-186-27-45.eu-central-1.compute.amazonaws.com | related=63.186.27.45 | source=vhost-cert | first_seen=2026-09-10T11:41:31Z
kind=rdns | value=ec2-63-187-184-188.eu-central-1.compute.amazonaws.com | related=63.187.184.188 | source=vhost-cert | first_seen=2026-09-10T11:41:31Z
kind=rdns | value=ec2-63-188-134-31.eu-central-1.compute.amazonaws.com | related=63.188.134.31 | source=vhost-cert | first_seen=2026-09-10T11:41:31Z
kind=rdns | value=acd89244c803f7181.awsglobalaccelerator.com | related=75.2.60.5 | source=vhost-cert | first_seen=2026-09-10T11:41:31Z
kind=internal-host | value=ip-172-31-12-78.eu-central-1.compute.internal | related=AWS internal hostname on 35.157.38.218 (afd-braunschweig admin) | source=vhost-cert-tls | first_seen=2026-09-10T11:41:31Z
kind=vhost | value=front pool serves -23.de vhosts | related=57.129.83.60/.68 Host: erfassung-23.de/manager-23.de/wolke-23.de | source=vhost-cert-ffuf | first_seen=2026-09-10T11:41:31Z
kind=backend-ip | value=35.157.38.218 | related=afd-braunschweig admin (AWS internal hostname) | source=vhost-cert | first_seen=2026-09-10T11:43:24Z
kind=backend-ip | value=34.248.116.63 | related=afd.tools AWS portal | source=vhost-cert | first_seen=2026-09-10T11:43:24Z
kind=backend-ip | value=3.79.68.56 | related=afd-hosting AWS | source=vhost-cert | first_seen=2026-09-10T11:43:24Z
kind=server_path | value=/mnt/webserver/hosts/verwaltung.sewobe.de/manager_source/webportal/ | related=serviceportal AJAX | source=bd-sewobe | first_seen=2026-09-10T12:04:33Z
kind=internal-path | value=/mnt/webserver/hosts/manager-23.de/manager_source/webportal/ | related=manager-23.de webportal (unauth config leak) | source=bd-sewobeunauth | first_seen=2026-09-10T12:05:23Z
kind=internal-path | value=/mnt/webserver/hosts/manager-23.de/ | related=SEWOBE deploy base (from PORTAL_BASE_PATH) | source=bd-sewobeunauth | first_seen=2026-09-10T12:05:23Z
kind=vendor | value=Cephei AG | related=cephei.com; hosts afdbt-devop.de n8n + n8n.cephei.to + cephei.to SearXNG | source=bd-misc | first_seen=2026-09-10T12:10:46Z
kind=person | value=Gunnar Scherf (g10f) | related=author of afd-braunschweig Django site + OIDC IdP; g10f.de, gunnar-scherf.de | source=bd-misc | first_seen=2026-09-10T12:10:46Z
kind=internal_host | value=ip-172-31-12-78.eu-central-1.compute.internal | related=AWS EC2 internal name leaked in cert on 35.157.38.218 | source=bd-misc | first_seen=2026-09-10T12:10:46Z
kind=ip | value=34.248.116.63 | related=upgrade-test.afdbayern.de (AWS) | source=bd-state | first_seen=2026-09-10T12:18:45Z
kind=domain | value=gunnar-scherf.de | related=IdP author g10f personal site (g10f.de 301 -> here) | source=bd-idp | first_seen=2026-09-10T12:50:21Z
kind=server_path | value=/mnt/webserver/hosts/dlrg-schulung.sewobe.de/manager_source/ | related=dlrg-schulung.sewobe.de phpinfo DOCUMENT_ROOT | source=bd-sewobe2 | first_seen=2026-09-10T13:11:30Z
kind=internal-path | value=/mnt/webserver/hosts/manager-23.de/manager_source/webportal/ | related=manager-23.de SEWOBE deploy base (from PORTAL_BASE_PATH) | source=sewobe-extract | first_seen=2026-09-10T17:02:45Z
kind=source_path | value=C:/entwicklung/webprojekte/jobagent/webportal/view/core/style/scss/components/component/bootstrap/scss/mixins/_lists.scss | related=sewobe-build | source=asset-urls | first_seen=2026-09-10T20:52:52Z
kind=source_path | value=D:/webprojekte/jobagent/webportal/view/core/style/scss/components/component/bootstrap/scss/mixins/_lists.scss | related=sewobe-build | source=asset-urls | first_seen=2026-09-10T20:52:52Z
kind=source_path | value=file:///tmp/bildscan-branch-review/integration/webportal/view/core/style/scss/components/component/bootstrap/scss/mixins/_lists.scss | related=sewobe-build | source=asset-urls | first_seen=2026-09-10T20:59:38Z
kind=ad-infra-leak | value=Autodiscover leaks internal AD/Exchange: domain bgs.afd.de, DC SRV-BGS-DC-02.bgs.afd.de, servers SRV-BGS-EX-01/02, internal URLs ol.bgs.afd.de/webmail.bgs.afd.de, DeploymentId 29f0c3e9-df11-4519-9cee- | related=autodiscover.afd.de | source=prober-exchcred | first_seen=2026-09-10T21:05:24Z
kind=oidc_issuer | value=https://accounts.afd-team.de | related=AfD SSO (g10f/sso v5.4.0) | source=prober-n8n-oidc2 | first_seen=2026-09-10T22:00:00Z
kind=source_repo | value=https://github.com/g10f/sso | related=exact IdP source v5.4.0 | source=prober-n8n-oidc2 | first_seen=2026-09-10T22:00:00Z
kind=software | value=Elementor Pro 4.2.1 | related=37 AfD hosts; CVE-2026-32475 latent (no upload widget) | source=cve-inventory | first_seen=2026-09-10T21:25:28Z
kind=software | value=Slider Revolution 6.7.58 | related=www.afd.de + 70 hosts; CVE-2026-6728 confirmed | source=cve-inventory | first_seen=2026-09-10T21:25:28Z
kind=oidc_issuer | value=https://accounts.afd-team.de | related=AfD SSO IdP g10f/sso 5.4.0 / Django 5.2.17 | source=prober-ssoidp | first_seen=2026-09-10T21:33:59Z
kind=username | value=GunnarScherfAdmin | related=MoinMoin wiki admin (rss_rc/info leak); g10f/sso dev | source=prober-moinmoin | first_seen=2026-09-10T21:47:28Z
kind=cve | value=CVE-2026-41940 cPanel/WHM - NOT exploitable (patched) on AfD hosts | related=cpanel | source=panel-cve | first_seen=2026-09-11T00:30:00Z
kind=vpn-user | value=Frank.Gossmann@afd.de | related=vpn-nutzer@afd.de | source=prober-mailboxpivot | first_seen=2026-09-12T13:36:20Z
kind=internal-staff | value=Frank.Gossmann@afd.de | related=bgs-intern@bgs.afd.de | source=prober-mailboxpivot | first_seen=2026-09-12T13:36:20Z
kind=vuln_class | value=g10f-sso-emailbackend-is_active-gap | related=EmailBackend.authenticate ignores is_active; OAuth2 password grant validate_user uses it directly -> deactivated accounts can get tokens | source=prober-ssoexploit | first_seen=2026-09-12T13:44:46Z
kind=protected_vhost | value=mailfilter.afd.de + webmail.afd.tools + mail-autodiscover.afd.tools | related=HAProxy 443 http-request deny (403, 93B) for these 3 vhosts on 162.55.9.211/88.198.31.157; all other vhosts 503 | source=prober-mailadmin | first_seen=2026-09-12T15:12:36Z
kind=email | value=poststelle@nuernberger-land.de | related=generationdeutschland_de | source=prober-sister-db | first_seen=2026-09-12T19:05:15Z
kind=email | value=timothytissmer@web.de | related=generationdeutschland_de | source=prober-sister-db | first_seen=2026-09-12T19:05:15Z
kind=email | value=kleinesmiststueck77@web.de | related=afd_berlin | source=prober-sister-db | first_seen=2026-09-12T19:07:52Z
kind=email | value=daniel_brunner@web.de | related=afd_de | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
kind=email | value=gravityactions-banner-1544x500@2x.png | related=afd_de | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
kind=email | value=stshh@web.de | related=afd_de | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
kind=email | value=weissmichaela@web.de | related=afd_de | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
kind=email | value=brunner.ja@t-online.de | related=afdkompakt_de | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
kind=email | value=dtm-grossmeister@gmx.de | related=afdkompakt_de | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
kind=email | value=gi.grossmann@t-online.de | related=afdkompakt_de | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
kind=email | value=grossmanngerdo@gmail.com | related=afdkompakt_de | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
kind=email | value=issmer-klassik@t-online.de | related=afdkompakt_de | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
kind=email | value=laurasiatheria@hotmail.de | related=afdkompakt_de | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
kind=email | value=lawskruemel@gmail.com | related=afdkompakt_de | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
kind=email | value=mariongassmann@gmx.de | related=afdkompakt_de | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
kind=email | value=martin.kussmann01@gmail.com | related=afdkompakt_de | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
kind=email | value=mrssmall@web.de | related=afdkompakt_de | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
kind=email | value=oli.kaltenbrunner@icloud.com | related=afdkompakt_de | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
kind=email | value=oliver.weissmann@t-online.de | related=afdkompakt_de | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
kind=email | value=poststelle@bmf.bund.de | related=afdkompakt_de | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
kind=email | value=thessmanns@yahoo.de | related=afdkompakt_de | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
kind=email | value=uwe.rossmann@gmx.de | related=afdkompakt_de | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
kind=email | value=wflessmann@t-online.de | related=afdkompakt_de | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
kind=email | value=wolfgang.brunner@icloud.com | related=afdkompakt_de | source=prober-sister-db | first_seen=2026-09-12T19:20:49Z
kind=sql_dump | value=/var/www/vhosts/afdkompakt.de/migration/20230723_AFDDE/afd_de.sql | related=662755478B readable uid1020 | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
kind=sql_dump | value=/var/www/vhosts/afdkompakt.de/migration/20230624_AFDDE/afdde.sql | related=762041047B readable uid1020 | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
kind=sql_dump | value=/var/www/vhosts/wahlkampf.afd.de/wahlkampf_afd_de.sql | related=270942986B readable uid1020 | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
kind=sql_dump | value=/var/www/vhosts/afdkompakt.de/backup_20230603/komapkt.sql | related=216496401B readable uid1020 | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
kind=sql_dump | value=/var/www/vhosts/afdkompakt.de/migration/20230525_DB/mitmachenafdde.sql | related=91243357B readable uid1020 | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
kind=sql_dump | value=/var/www/vhosts/mitmachen.afd.de/migration/mitmachen.sql | related=91124850B readable uid1020 | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
kind=sql_dump | value=/var/www/vhosts/afdkompakt.de/migration/20230525_DB/spendenafdde.sql | related=79330147B readable uid1020 | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
kind=sql_dump | value=/var/www/vhosts/afdkompakt.de/migration/20230525_DB/linksrutsch.sql | related=4124378B readable uid1020 | source=prober-sqldumps | first_seen=2026-09-12T21:18:12Z
kind=email | value=amazon1170@online.de | related=alice_weidel_de | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
kind=email | value=anastasia.sacharenko@gmail.com | related=alice_weidel_de | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
kind=email | value=bigagebjoernassmann@gmail.com | related=alice_weidel_de | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
kind=email | value=ernstseitz@hairforce1.de | related=alice_weidel_de | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
kind=email | value=feistserina@gmail.com | related=alice_weidel_de | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
kind=email | value=grossmannmandy8@gmail.com | related=alice_weidel_de | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
kind=email | value=pa.bussmann@outlook.de | related=alice_weidel_de | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
kind=email | value=stschneider@gmx.net | related=alice_weidel_de | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
kind=email | value=wandalissmus62@gmail.com | related=alice_weidel_de | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
kind=email | value=michael.rossmeier@afd-bielefeld.de | related=mail_mgmt_afd_tools | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
kind=email | value=anastasia.dudko@gmx.de | related=mitmachen_afd_de | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
kind=email | value=anastasiaronald@gmx.de | related=mitmachen_afd_de | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
kind=email | value=euer_ostseemarkt@yahoo.com | related=mitmachen_afd_de | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
kind=email | value=gassmann.ua@t-online.de | related=mitmachen_afd_de | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
kind=email | value=grossmann-selm@t-online.de | related=mitmachen_afd_de | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
kind=email | value=guido-murawski@web.de | related=mitmachen_afd_de | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
kind=email | value=gweissmann71@gmail.com | related=mitmachen_afd_de | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
kind=email | value=hessmarina489@gmail.com | related=mitmachen_afd_de | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
kind=email | value=jerrybrunner@web.de | related=mitmachen_afd_de | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
kind=email | value=karinblessmann51@yahoo.de | related=mitmachen_afd_de | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
kind=email | value=klaudia.bielawski@gmail.com | related=mitmachen_afd_de | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
kind=email | value=messmerf@gmx.de | related=mitmachen_afd_de | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
kind=email | value=mielkehorststephan@gmail.com | related=mitmachen_afd_de | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
kind=email | value=passtscho@hotmail.com | related=mitmachen_afd_de | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
kind=email | value=r.jassmann@web.de | related=mitmachen_afd_de | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
kind=email | value=rossmeiermarcel@gmail.com | related=mitmachen_afd_de | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
kind=email | value=stefanostsee.ss@gmail.com | related=mitmachen_afd_de | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
kind=email | value=thorsten.kossmann@freenet.de | related=mitmachen_afd_de | source=prober-sister-db | first_seen=2026-10-02T03:14:52Z
kind=internal_control_plane | value=Apache 0-management/management vhosts on 10.12.51.11/.12/.13/.18/.19/.21 + orcus.mgmt.afd.tools (10.108.1.192) WP-Connect (RS256 jwt-private.pem mints WP SSO for any site) | related=site-mgmt.afd.tools | source=op03-g6-internal | first_seen=2026-10-02T15:44:19Z
kind=idp-latent | value=EmailBackend is_active gap (g10f/sso) | related=OAuth2 password grant | source=unexplored-u6 | first_seen=2026-10-02T21:14:29Z
kind=wp-branch-fleet | value=528 de-duped branch hosts / 326 WordPress; one centrally-managed template fleet | related=71 hosts SliderRev CVE-2026-6728 leak; 8 in-range core; 4 exploitable | source=op03-g1-branch-fleet | first_seen=2026-10-02T21:27:01Z
kind=sliderrev-stream-leak | value=CVE-2026-6728 unauth post_content+author on 71 hosts via ?rest_route= (comma-id list) | related=root cause: public REST callback + no post-visibility check (revslider <=7.0.9) | source=op03-g1-branch-fleet | first_seen=2026-10-02T21:27:01Z
kind=expired-branch-domains | value=~7 of the 84 new branch hosts are expired AfD domains re-registered by 3rd parties | related=gambling/link-shortener/parking/foreign content on afdwittmund.de etc. | source=op03-g1-branch-fleet | first_seen=2026-10-02T21:27:01Z
kind=x1-fleet-wide-primitive | value=P1 SliderRev CVE-2026-6728 leak | related=71 hosts confirmed; inherited from one centrally-managed WP template | source=op03-x1-cross-app | first_seen=2026-10-02T22:15:01Z
kind=x1-fleet-wide-primitive | value=P4 ?rest_route= WAF bypass | related=>=10 front/fleet hosts (www.afd.de, afdkompakt.de, alice-weidel.de, spenden, mitmachen, stammdaten + live afdsaarpfalz.de); dynamic per-vhost rule | source=op03-x1-cross-app | first_seen=2026-10-02T22:15:01Z
kind=x1-fleet-wide-primitive | value=P2 route-confusion signature | related=56 hosts fire the signature but only 4-5 are in-range = RCE-grade | source=op03-x1-cross-app | first_seen=2026-10-02T22:15:01Z
kind=site-class | value=WP | related=300 hosts | source=op03-x2-sitebysite | first_seen=2026-10-02T22:39:20Z
kind=site-class | value=panel | related=230 hosts | source=op03-x2-sitebysite | first_seen=2026-10-02T22:39:20Z
kind=site-class | value=mail | related=67 hosts | source=op03-x2-sitebysite | first_seen=2026-10-02T22:39:20Z
kind=site-class | value=app | related=77 hosts | source=op03-x2-sitebysite | first_seen=2026-10-02T22:39:20Z
kind=site-class | value=WAF-blocked | related=124 hosts | source=op03-x2-sitebysite | first_seen=2026-10-02T22:39:20Z
kind=site-class | value=vendor | related=7 hosts | source=op03-x2-sitebysite | first_seen=2026-10-02T22:39:20Z
kind=site-class | value=dead | related=883 hosts | source=op03-x2-sitebysite | first_seen=2026-10-02T22:39:20Z
kind=key-host | value=admin.afd-braunschweig.de | related=g10f/Wagtail CMS + OIDC | source=op03-x2b-capability | first_seen=2026-10-02T23:13:36Z
kind=key-host | value=admin.afd-fraktion-rgb.de | related=g10f/Wagtail CMS + OIDC | source=op03-x2b-capability | first_seen=2026-10-02T23:13:36Z
kind=x1b-new-host | value=accounts.afd-team.de | related=AfD SSO IdP (g10f/sso v5.4.0) = shared trust root (P6) | source=op03-x1b-cross-app-expand | first_seen=2026-10-02T23:14:40Z
kind=x1b-shared-nfs | value=P7 shared-NFS salts (14 sites world-readable wp-config) | related=10.12.51.101:/NFS_2280104_web_0401 -> /var/www; one shell harvests every salt -> cookie-forge becomes fleet-wide (conditional) | source=op03-x1b-cross-app-expand | first_seen=2026-10-02T23:14:40Z
kind=x1b-dev-twins | value=dev/staging twins of production hosts | related=dev.afdstuttgart.de (P2 SIG), dev.afd-heidekreis.de (Plesk default), dev.afd.nrw, test.afd-hessen.org, stage.tourscope.live, staging.afd-verbot.de, module-demo.sewobe.de | source=op03-x1b-cross-app-expand | first_seen=2026-10-02T23:14:40Z
kind=d6-new-host | value=hn-afd.de | related=D6: branch; no WAF on /wp-json/ (200); ai1wm/v1 backup REST route exists (401) | source=op03-d6-new-primitives | first_seen=2026-10-02T23:44:23Z
kind=d6-new-primitive | value=P11 WP MCP adapter REST namespace (unauth index, cross-app) | related=GET /?rest_route=/mcp = 200 unauth on www.afd.de (807B), mitmachen.afd.de (601B), sachsen-anhalt.afd.de (658B); routes /mcp, /mcp/mcp-oauth-server, /mcp/mcp-adapter-default-server (GET/POST/DELETE); r | source=op03-d6-new-primitives | first_seen=2026-10-02T23:44:23Z
kind=d6-no-waf-branches | value=Two branch hosts have no WAF on /wp-json/ | related=hn-afd.de and weserbergland-afd.de return 200 on /wp-json/ (no bypass needed; whole REST surface already open); exposure = missing edge WAF | source=op03-d6-new-primitives | first_seen=2026-10-02T23:44:23Z
kind=mcp_tool_gate | value=mcp-adapter-default-server | related=401 rest_forbidden on all hosts | source=op03-e6-mcp-newlead | first_seen=2026-10-03T00:57:08Z
kind=f3-fleet-count | value=P4 ?rest_route= WAF bypass | related=F3 fleet sweep (430 WP hosts, 377 reachable): bypass CONFIRMED on 61 hosts (rest_route 200 + namespaces while /wp-json/ 403/500); 204 hosts have no edge WAF (wp-json 200, whole REST surface open); 17  | source=op03-f3-fleet-sweep | first_seen=2026-10-03T02:51:45Z
kind=f3-fleet-count | value=P11 mcp adapter namespace | related=F3 fleet sweep: mcp namespace on 54/430 WP hosts; unauth index 200 on 34; mcp-adapter-default-server GET = 401 on all 30 reachable hosts (tool gate holds) | source=op03-f3-fleet-sweep | first_seen=2026-10-03T02:51:45Z
kind=f3-new-primitive | value=P11c MCP OAuth authorization-server metadata (unauth) + CIMD | related=F3 (NEW): /.well-known/oauth-authorization-server/ = 200 unauth on 15 hosts; client_id_metadata_document_supported=true on 13 -> server-side fetch of an attacker-supplied client_id URL (CIMD) is FLEET | source=op03-f3-fleet-sweep | first_seen=2026-10-03T02:51:45Z
kind=f3-fleet-count | value=P1 SliderRevolution CVE-2026-6728 | related=F3 fleet sweep: sliderrevolution namespace on 68/430 hosts; stream 200 on 38 but only 11 return a real payload (rest 200-empty-data for ids 1-10); F3 re-confirmed 10 of G1's 71 leak_hosts; 4 hosts lea | source=op03-f3-fleet-sweep | first_seen=2026-10-03T02:51:45Z
kind=f3-fleet-count | value=P12 ai1wm/v1 / P13 gravityview/v1 / P14 duplicator/v1 / P15 redirection/v1 | related=F3 fleet sweep: ai1wm/v1 ns on 33 hosts (endpoint 401 x17, 403 x10 - gated); gravityview/v1 on 7 (views index 200 on www.afd.de + www.afdbayern.de); duplicator/v1 on 9 (500 x6); redirection/v1 on 21 ( | source=op03-f3-fleet-sweep | first_seen=2026-10-03T02:51:45Z
kind=f3-no-waf | value=204 hosts have no edge WAF on /wp-json/ | related=F3 fleet sweep: 204/430 WP hosts return 200 on /wp-json/ directly - the entire WP REST surface is open without any bypass; the exposure is the missing edge WAF, not the bypass | source=op03-f3-fleet-sweep | first_seen=2026-10-03T02:51:45Z
kind=gap-untouched-hosts | value=773 | related=zero-evidence hosts (egress-died) - re-probe with httpx/ISP pool | source=op03-G1-gapmap | first_seen=2026-10-03T03:39:19Z
kind=gap-untouched-hosts | value=38 | related=class=unknown never fingerprinted | source=op03-G1-gapmap | first_seen=2026-10-03T03:39:19Z
kind=gap-untouched-hosts | value=64 | related=class=static never fingerprinted | source=op03-G1-gapmap | first_seen=2026-10-03T03:39:19Z
kind=gap-untouched-hosts | value=475 | related=scheme=None never port-scanned | source=op03-G1-gapmap | first_seen=2026-10-03T03:39:19Z
kind=gap-untouched-hosts | value=479 | related=cert/rDNS IPs never nmap'd | source=op03-G1-gapmap | first_seen=2026-10-03T03:39:19Z
kind=gap-untouched-hosts | value=90 | related=REST namespaces on >=5 hosts never route-enumerated | source=op03-G1-gapmap | first_seen=2026-10-03T03:39:19Z
kind=gap-untouched-hosts | value=993 | related=fingerprinted hosts with zero REST + zero primitive sweep | source=op03-G1-gapmap | first_seen=2026-10-03T03:39:19Z
kind=gap-untouched-hosts | value=34 | related=hosts with any dir enumeration (1.4% of 2,480) | source=op03-G1-gapmap | first_seen=2026-10-03T03:39:19Z
kind=gap-untouched-hosts | value=11 | related=class=mail never fingerprinted | source=op03-G1-gapmap | first_seen=2026-10-03T03:39:19Z
kind=gap-untouched-hosts | value=13 | related=vendor+panel+app never fingerprinted | source=op03-G1-gapmap | first_seen=2026-10-03T03:39:19Z
kind=gap-untouched-hosts | value=124 | related=WAF-blocked hosts now addressable via ?rest_route= | source=op03-G1-gapmap | first_seen=2026-10-03T03:39:19Z
kind=gap-untouched-hosts | value=15 | related=MCP OAuth AS metadata unauth (13 CIMD=true) | source=op03-G1-gapmap | first_seen=2026-10-03T03:39:19Z
kind=shared_egress | value=87.191.56.50 | related=admin egress IP that also casts named poll votes (dta+hb) | source=op03-j4b-novel-links | first_seen=2026-10-03T16:22:55Z
kind=money_control | value=Finanz department (GAL): Gossmann/Kobs/Janke/Thomas/Forde + Weyel (deputy treasurer) | related=federal money + dues-collection control | source=op03-j2-money-corruption | first_seen=2026-10-03T16:30:47Z
kind=money_power_map | value=Tier A statutory finance (Weyel/Janke/Forde/Gossmann/Kobs/Thomas/Lausch/Roeder/Czech) vs Tier B vendor write (ganzrund hk@/ps@/smr@/os@, alternita rro@ role=1) | related=statutory money authority holds ZERO mail-routing/WP-payment write; all write is vendor | source=op03-k2-money-corruption | first_seen=2026-10-03T17:08:47Z
kind=path | value=/portal/public_docs/ | related=403 exists, listing denied | source=op03-k4-sewobe-deep | first_seen=2026-10-03T17:31:58Z
kind=wp_namespace | value=nv/v1/posts | related=19 | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=rankmath_v1_an_postsRowsByObjects | related=afd-bautzen.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=rankmath_v1_links_posts | related=afd-bautzen.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=koko-analytics_v1_posts | related=afd-bautzen.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=rankmath_v1_an_postsSummary | related=afd-bautzen.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=rankmath_v1_links_posts-stats | related=afd-bautzen.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=mapsvg_v1_posts | related=afd-bautzen.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=elementor_v1_site-navigation_recent-posts | related=afd-bielefeld.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_stats_posts | related=afd-fraktion-rlp.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_posts | related=afd-fraktion-rlp.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=nv_v1_posts | related=afd-frankfurt.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=rankmath_v1_an_postsRows | related=afd-fulda.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=jetpack_v4_stats-app_sites_227829480_posts | related=afd-mtk.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=wpcom_v2_related-posts | related=afd-mtk.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=cky_v1_settings_laws | related=afd-ortenau.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=filebird_public_v1_post-type-folder_posts | related=afd-rems-murr.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=liquidweb_harbor_v1_hosts | related=afd-rems-murr.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=divi_v1_module-data_filterable-portfolio_posts | related=afdleipzig.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=divi_v1_module-data_fullwidth-portfolio_posts | related=afdleipzig.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=divi_v1_ai-agent_context-posts | related=afdleipzig.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=elementor-pro_v1_posts-widget | related=suendenregister.afdbayern.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_posts_p16 | related=www.afd-schwandorf-cham.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_posts_p34 | related=www.afd-schwandorf-cham.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_posts_p20 | related=www.afd-schwandorf-cham.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_posts_p10 | related=www.afd-schwandorf-cham.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_posts_p23 | related=www.afd-schwandorf-cham.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_stats_posts_p1 | related=www.afd-schwandorf-cham.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_stats_posts_p14 | related=www.afd-schwandorf-cham.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_stats_posts_p23 | related=www.afd-schwandorf-cham.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_stats_posts_p8 | related=www.afd-schwandorf-cham.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_posts_p1 | related=www.afd-schwandorf-cham.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_stats_posts_p2 | related=www.afd-schwandorf-cham.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_posts_p40 | related=www.afd-schwandorf-cham.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_posts_p14 | related=www.afd-schwandorf-cham.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_stats_posts_p25 | related=www.afd-schwandorf-cham.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_posts_p7 | related=www.afd-schwandorf-cham.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_posts_p27 | related=www.afd-schwandorf-cham.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_posts_p38 | related=www.afd-schwandorf-cham.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_posts_p6 | related=www.afd-schwandorf-cham.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_stats_posts_p19 | related=www.afd-schwandorf-cham.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_stats_posts_p11 | related=www.afd-schwandorf-cham.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_posts_p18 | related=www.afd-schwandorf-cham.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_posts_p21 | related=www.afd-schwandorf-cham.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_stats_posts_p7 | related=www.afd-schwandorf-cham.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_posts_p32 | related=www.afd-schwandorf-cham.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_stats_posts_p32 | related=www.afd-schwandorf-cham.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_stats_posts_p33 | related=www.afd-schwandorf-cham.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_stats_posts_p21 | related=www.afd-schwandorf-cham.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_posts_p15 | related=www.afd-schwandorf-cham.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_posts_p3 | related=www.afd-schwandorf-cham.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_stats_posts_p5 | related=www.afd-schwandorf-cham.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_posts_p17 | related=www.afd-schwandorf-cham.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_stats_posts_p27 | related=www.afd-schwandorf-cham.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_stats_posts_p17 | related=www.afd-schwandorf-cham.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_posts_p4 | related=www.afd-schwandorf-cham.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_posts_p13 | related=www.afd-schwandorf-cham.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=statify_v1_posts_p35 | related=www.afd-schwandorf-cham.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=wp_ns_route | value=jetpack_v4_stats-app_sites_174704457_posts | related=www.aufstehen-gegen-rassismus.de | source=op03-n3-live-harvest | first_seen=2026-10-03T21:23:27Z
kind=backup_surface | value=ai1wm/v1 on 29 fleet hosts (one-test) | source=op03-o2-new-paths | first_seen=2026-10-03T23:01:27Z
kind=attendee_surface | value=Events-Calendar tribe/tec on 94 hosts | source=op03-o2-new-paths | first_seen=2026-10-03T23:01:27Z
kind=doc-host | value=Top missing-doc asset hosts: www.afd.de 1445, afd-oberhausen.de 1006, www.afd-nordhausen.de 826, afd-mv.de 638, afd-sh.de 525, rtk.afd-hessen.org 413, lv-lsh.westmark-hosting.de 405 | source=op03-o3-data-pull | first_seen=2026-10-03T23:33:56Z
kind=events | value=Events-Calendar public event/venue/organizer surface on 134 AfD fleet hosts (tribe/* + tec/*); 5045 venue records, 85 with public email/phone; attendee collections empty | source=op03-p6-data-more | first_seen=2026-10-04T01:01:07Z
kind=ai1wm | value=AI1WM backup REST surface on 45 hosts; route index public on 31; all data routes auth-gated | source=op03-p6-data-more | first_seen=2026-10-04T01:01:07Z
kind=doc-host | value=Missing-doc asset hosts resumed: afdbundestag.de, afdbt-cdn.b-cdn.net, afd-oberhausen.de, www.afdbundestag.de, afd-mv.de, rtk.afd-hessen.org, chapinc.org | source=op03-p6-data-more | first_seen=2026-10-04T01:01:07Z
kind=backend_ip | value=3.79.68.56 | related=afd-hosting AWS | source=q2-archaeology | first_seen=2026-10-04T02:11:05Z
kind=backend_ip | value=34.248.116.63 | related=afd.tools AWS portal | source=q2-archaeology | first_seen=2026-10-04T02:11:05Z
kind=host | value=ded344243.iceservers.net | related=82.221.128.212 | source=op03-r3-missed-hosts | first_seen=2026-10-04T03:56:35Z
kind=service | value=202.61.202.98:8443 Plesk 18.0.81 | related=afd-hessen | source=op03-r3-missed-hosts | first_seen=2026-10-04T03:56:35Z
kind=service | value=202.61.202.98:21 ProFTPD | related=mailhost.westmark-hosting.de | source=op03-r3-missed-hosts | first_seen=2026-10-04T03:56:35Z
kind=service | value=78.46.5.205:993/143 Dovecot | related=webmail.afdstuttgart.de | source=op03-r3-missed-hosts | first_seen=2026-10-04T03:56:35Z
kind=service | value=188.245.250.122:22 OpenSSH 9.6p1 | related=afdstuttgart | source=op03-r3-missed-hosts | first_seen=2026-10-04T03:56:35Z
kind=service | value=35.157.38.218:443 nginx 1.24.0 | related=afd-braunschweig admin | source=op03-r3-missed-hosts | first_seen=2026-10-04T03:56:35Z
kind=service | value=82.221.128.212 webp_server_go | related=IceServers stub | source=op03-r3-missed-hosts | first_seen=2026-10-04T03:56:35Z
kind=account | value=SEWOBE manager-23 rroesler/aconradi/hmalcomess/mahau | related=www.afd.de admins | source=op03-r3-missed-hosts | first_seen=2026-10-04T03:56:35Z
kind=person | value=Gunnar Scherf (g10f) | related=author of g10f/sso IdP + afd-braunschweig.de site; wiki admin GunnarScherfAdmin | source=op03-s4-idp-identity | first_seen=2026-10-04T04:34:39Z
kind=username | value=GunnarScherfAdmin | related=RESOLVED -> Gunnar Scherf (g10f vendor), wiki.afd-team.de/general admin | source=op03-s4-idp-identity | first_seen=2026-10-04T04:34:39Z
kind=email | value=gunnar.scherf@gmail.com | related=g10f/sso ADMINS + DEFAULT_FROM_EMAIL + SSO_NOREPLY_EMAIL | source=op03-s4-idp-identity | first_seen=2026-10-04T04:34:39Z
kind=email | value=gunnar@g10f.de | related=g10f vendor mailbox | source=op03-s4-idp-identity | first_seen=2026-10-04T04:34:39Z
kind=domain | value=g10f.de | related=SSO vendor; 35.157.38.218 same host as accounts.afd-team.de | source=op03-s4-idp-identity | first_seen=2026-10-04T04:34:39Z
kind=vuln_class | value=g10f-sso-token-exchange-NOT-supported | related=no RFC8693 (NotImplementedError; live 400 unsupported_grant_type); aud+session-hash per client | source=op03-s4-idp-identity | first_seen=2026-10-04T04:34:39Z
kind=source_repo | value=https://github.com/g10f/sso | related=AfD SSO IdP source; 5.4.0 tree at commit 2439982d, 5.4.8 tag 5a5ae754 | source=op03-t1-sso-audit | first_seen=2026-10-04T06:28:56Z
kind=version | value=g10f/sso 5.4.8 | related=LIVE deployed IdP version (privacy footer + .well-known userinfo pointer); S4 '5.4.0' is stale | source=op03-t1-sso-audit | first_seen=2026-10-04T06:28:56Z
kind=vuln_class | value=g10f-sso-chained-filter-oracle-FIXED | related=5.4.0 unauth field-injection oracle (TOTP/refresh/authcode); fixed 5.4.5 dc299cc5; live 404 | source=op03-t1-sso-audit | first_seen=2026-10-04T06:28:56Z
kind=vuln_class | value=g10f-sso-open-redirect-FIXED | related=5.4.0 oauth2 authorize error-handler open redirect; fixed 5.4.8 f9c1aa01; needs auth session | source=op03-t1-sso-audit | first_seen=2026-10-04T06:28:56Z
kind=vuln_class | value=g10f-sso-throttle-bypass-FIXED | related=5.4.0 login throttle keyed on raw XFF+full path; fixed 5.4.8 5ec5d10d | source=op03-t1-sso-audit | first_seen=2026-10-04T06:28:56Z
kind=vuln_class | value=g10f-sso-is-active-gap-LATENT | related=EmailBackend skips is_active; web login form blocks; password grant needs trusted client (none) | source=op03-t1-sso-audit | first_seen=2026-10-04T06:28:56Z
kind=vhost | value=g10f multi-tenant estate on 35.157.38.218 | related=ONE AWS host runs AfD IdP + vendor's own SSO + Keycloak + SAML demo + school site + Collabora/Nextcloud/WOPI + Plausible | source=op03-t2-vendor-pivot | first_seen=2026-10-04T07:54:09Z
kind=idp-deployment | value=sso.g10f.de = g10f/sso v5.4.10 (vendor's own IdP) | related=public self-registration; 3 JWKS keys; introspection; >=1 RP (oauth-python-sample.g10f.de); one patch level AHEAD of the AfD deployment (5.4.8) | source=op03-t2-vendor-pivot | first_seen=2026-10-04T07:54:09Z
kind=idp-deployment | value=idp.g10f.de = Keycloak (2nd, independent IdP) | related=master realm only (8 other realm names 404); discovery+certs+token live; /admin/ reachable (login-gated); /admin/realms/ = 401; password grant ENABLED; master realm publishes an RSA-OAEP enc key | source=op03-t2-vendor-pivot | first_seen=2026-10-04T07:54:09Z
kind=oidc_client | value=ca96cd88bc2740249d0def68221cba88 CROSS-IDP | related=SSO_BROWSER_CLIENT_ID registered on BOTH IdPs: accounts.afd-team.de AND sso.g10f.de (18/18 consistent, controls clean); javascript/PKCE type | source=op03-t2-vendor-pivot | first_seen=2026-10-04T07:54:09Z
kind=secret-history | value=7 RSA private keys committed to public g10f/sso git history | related=initial commit 21ab3dc6 (2013-12-02) apps/sso/cert/*.key + settings/defaults.py; later commits 'keys rollover' 4efb0a5a/45841b2c; all ROTATED OUT of live JWKS (0/7 still trusted) | source=op03-t2-vendor-pivot | first_seen=2026-10-04T07:54:09Z
kind=api_key | value=AIzaSyAKW01tWxJuX5zuWf1w8Uahyr2DF5nd7dk | related=Google Maps API key in g10f/sso update_location.py, commits 2014-09-03; never rotated in repo; low-grade abuse/quota exposure | source=op03-t2-vendor-pivot | first_seen=2026-10-04T07:54:09Z
kind=tenant | value=non-AfD tenants on the vendor's host | related=michal.g10f.de + admin.michal.g10f.de; heilpaedagogik-luckenwalde.g10f.de (school); oauth-python-sample.g10f.de (RP on his own SSO); saml2.g10f.de (SAML SP); plausible.g10f.de (self-hosted analytics) | source=op03-t2-vendor-pivot | first_seen=2026-10-04T07:54:09Z
kind=source_repo | value=github.com/g10f helm-charts | related=charts for g10f/sso + django-app + moin wiki; the deployment mechanism for every tenant (no credentials leaked in chart values) | source=op03-t2-vendor-pivot | first_seen=2026-10-04T07:54:09Z
kind=email | value=gunnar@g10f.de | related=BOUND + ACTIVE account on the AfD IdP (accounts.afd-team.de); vendor inside customer SSO | source=op03-v2-vendor-account | first_seen=2026-10-04T08:40:47Z
kind=email | value=gunnar.scherf@gmail.com | related=BOUND + ACTIVE account on the vendor's own IdP (sso.g10f.de) | source=op03-v2-vendor-account | first_seen=2026-10-04T08:40:47Z
kind=tenant | value=DWBN (Diamond Way Buddhism) = live g10f/sso customer | related=sso.dwbn.org + sso-dev.dwbn.org on 213.95.241.26 run g10f/sso v5.4.10 (privacy footer + .well-known userinfo_endpoint=/api/v2/users/me/). A SECOND tenant estate, separate host from the AfD/vendor AWS  | source=op03-v4-github | first_seen=2026-10-04T08:45:30Z
kind=source_repo | value=https://github.com/g10f/helm-charts | related=Helm charts for g10f/sso + django-app + moin wiki; the deployment mechanism for every tenant. Latest releases sso-1.2.0 / wiki-1.1.1 (2026-03-15); default domain sso.g10f.de; no credentials/AfD values | source=op03-v4-github | first_seen=2026-10-04T08:45:30Z
kind=source_repo | value=https://github.com/g10f/blog-site | related=Wagtail blog + OIDC RP (mozilla-django-oidc); active (v2.0.9, 2026-10-02); OIDC client config all env-driven (no secrets). | source=op03-v4-github | first_seen=2026-10-04T08:45:30Z
kind=source_repo | value=https://github.com/g10f/wiki | related=MoinMoin wiki farm deployment (farmconfig superuser GunnarScherf, base_sso_uri https://sso.g10f.de); mirrors the AfD wiki farm; uses G10F_CLIENT_SECRET env var. | source=op03-v4-github | first_seen=2026-10-04T08:45:30Z
kind=source_repo | value=https://github.com/g10f/oauth-python-sample | related=OIDC sample RP for sso.g10f.de; fixture issuer https://sso-dev.dwbn.org (DWBN dev tenant). | source=op03-v4-github | first_seen=2026-10-04T08:45:30Z
kind=source_repo | value=https://github.com/g10f/saml-demo | related=SAML 2.0 SP demo deployed at saml2.g10f.de; docker-compose demo creds saml_demo/saml_demo. | source=op03-v4-github | first_seen=2026-10-04T08:45:30Z
kind=source_repo | value=DWBN/g10f-helm-charts + tobstone/gf10-helm-charts | related=Public FORKS of g10f/helm-charts by DWBN (Diamond Way Buddhism) and its collaborator tobstone (Tobias Steinhoff). DWBN fork active 2026-09-12; tree mirrors upstream (no private values in the public fo | source=op03-v4-github | first_seen=2026-10-04T08:45:30Z
kind=deployment | value=helm-chart default admin/changeme | related=charts/sso/values.yaml ships django.adminName=admin, django.adminPassword=changeme, secretKey=changeme; if a tenant deploys without overriding, the IdP admin is admin/changeme. NOT tested (mission = p | source=op03-v4-github | first_seen=2026-10-04T08:45:30Z
kind=tenant_host | value=sso.dwbn.org / sso-dev.dwbn.org | related=Live g10f/sso v5.4.10 instances; public OIDC discovery + self-registration. Separate org (Diamond Way Buddhism) - out of AfD scope, recorded as fan-out evidence. | source=op03-v4-github | first_seen=2026-10-04T08:45:30Z
kind=idp-deployment | value=sso.g10f.de = g10f/sso 5.4.10 TEST instance | related=only selectable organisations Test (id2) / Test1 (id3); created account = RegistrationProfile pk 11; no AfD orgs/clients except the shared browser client | source=op03-v1-g10f-sso | first_seen=2026-10-04T08:58:26Z
kind=idp-deployment | value=idp.g10f.de = Keycloak >=26.1 (2nd independent IdP) | related=master realm only; admin console exposed; password grant enabled; registration disabled; no forgot-password; 6 bounded default creds invalid | source=op03-v1-g10f-sso | first_seen=2026-10-04T08:58:26Z
kind=oidc_client | value=ca96cd88bc2740249d0def68221cba88 cross-IdP browser client (re-confirmed) | related=registered on BOTH accounts.afd-team.de and sso.g10f.de; 8 candidate redirect_uris all 'Mismatching redirect URI' on both -> no cross-IdP code delivery | source=op03-v1-g10f-sso | first_seen=2026-10-04T08:58:26Z
kind=vhost | value=one AWS host 35.157.38.218 runs two IdPs + SAML + customers | related=AfD IdP (5.4.8) + vendor's own IdP (5.4.10 test) + Keycloak + SAML SP + oauth-python-sample + Plausible + non-AfD customers | source=op03-v1-g10f-sso | first_seen=2026-10-04T08:58:26Z
kind=registration | value=sso.g10f.de open self-registration (reCAPTCHA v2 gated) | related=sitekey 6Le5l-wSAAAAADIrQD5FOLU8Kj6I92CTuqsnUWFX; account lands is_active=False with unusable password; email validation completes but login fails; admin activation only | source=op03-v1-g10f-sso | first_seen=2026-10-04T08:58:26Z
kind=vuln-candidate | value=CVE-2026-18963 Keycloak reset-credentials unauth ATO | related=fixed 26.7.2; idp.g10f.de is >=26.1 but reset flow NOT exposed on master and exact version undisclosed; NOT tested (account tampering forbidden) | source=op03-v1-g10f-sso | first_seen=2026-10-04T08:58:26Z
kind=key-history | value=g10f RSA key history = 3 DISTINCT keys (ee18cf60 RSA-1024 / cd0ef6c0 RSA-2048 / abdaf34a RSA-2048), all rotated out | related=CORRECTS T2's '7 distinct keys' (that was a file count). Full history of all 7 repos + 2 clones; blob scan confirms 3 SPKI, 0 missed. 0/3 trusted by any of 26 live key surfaces across 14 hosts. Oldest | source=op03-v3-key-history | first_seen=2026-10-04T08:59:11Z
kind=key-surface | value=g10f estate publishes 26 public keys across 14 hosts (3 OIDC JWKS + 1 SAML SP cert + 13 TLS leafs + history certs) | related=sso.g10f.de JWKS(3)/accounts.afd-team.de JWKS(3)/idp.g10f.de Keycloak JWKS(2)/saml2 SP cert(1, localhost dev)/TLS leafs for plausible, michal, admin.michal, heilpaedagogik, oauth-python-sample, cloud, | source=op03-v3-key-history | first_seen=2026-10-04T08:59:11Z
kind=key-host | value=ldap.g10f.de = phpLDAPadmin 1.2.5 -> OpenDJ (estate-wide directory) | related=Internet-facing phpLDAPadmin 1.2.5, single server 'opendj'. The identity store is shared by ALL tenants (AfD, school, private). Anonymous bind denied; Directory Manager default creds denied (2 tries). | source=op03-v6-g10f-tenants | first_seen=2026-10-04T09:04:33Z
kind=shared-service | value=plausible.g10f.de = one analytics DB for every tenant | related=Plausible CE (Elixir+ClickHouse). Registration disabled; API Bearer-key-gated (realtime 401). Site list observable from tenant pages' data-domain: accounts.afd-team.de, afd-braunschweig.de, sso.g10f.d | source=op03-v6-g10f-tenants | first_seen=2026-10-04T09:04:33Z
kind=tenant | value=g10f live tenant map (8+ sites on 35.157.38.218) | related=michal.g10f.de + admin.michal.g10f.de (Wagtail, Polish private blog); heilpaedagogik-luckenwalde.g10f.de (Wagtail, special-needs school, MAP ONLY); oauth-python-sample.g10f.de (Django OIDC sample); ss | source=op03-v6-g10f-tenants | first_seen=2026-10-04T09:04:33Z
kind=source_repo | value=g10f/helm-charts = per-tenant deployment mechanism | related=3 charts (sso, django-app, wiki). Tenant hostnames are deployment-time values, not committed. SSO chart defaults: adminPassword=changeme, adminName=admin, createAdmin=on; history adds secretKey=change | source=op03-v6-g10f-tenants | first_seen=2026-10-04T09:04:33Z
kind=secret | value=oauth-python-sample hardcoded fallback Django SECRET_KEY (public repo) | related=apps/client/settings.py:137 SECRET_KEY=os.environ.get('SECRET_KEY', '&9w&vwpc7uahoddb0e+^oyh#v@=hjemup0zb0t^8a++!r1lypp'). If the env var is unset the live app's sessions/password-reset tokens are for | source=op03-v6-g10f-tenants | first_seen=2026-10-04T09:04:33Z
kind=oidc_client | value=sso.g10f.de clients discovered via oauth-python-sample page | related=ec1e39cbe3e746c787b770ace4165d13 (sample RP), g10f-kums (external customer kums.de), g10f-localhost (dev), plus ca96cd88... shared with accounts.afd-team.de. | source=op03-v6-g10f-tenants | first_seen=2026-10-04T09:04:33Z
kind=keycloak-version | value=26.x >=26.1 (exact patch masked; resourceVersion=nvcaj) | related=idp.g10f.de admin assets main-B_L5XslH.js/main-DmoViYol.css; PF5 keycloak.v2; PAR/CIBA/RFC8414 present | source=op03-w2-keycloak | first_seen=2026-10-04T10:23:58Z
kind=misconfig | value=Keycloak dynamic client registration ENABLED but Trusted-Hosts gated | related=registration_endpoint advertised + processes unauth POST; policy rejects 'Host not trusted'; not bypassed by Origin/XFH/Forwarded/Host | source=op03-w2-keycloak | first_seen=2026-10-04T10:23:58Z
kind=idp-deployment | value=idp.g10f.de = Keycloak (2nd, independent IdP) - master realm only, no AfD identities | related=admin-cli direct grants on; admin console exposed; 9 bounded creds invalid | source=op03-w2-keycloak | first_seen=2026-10-04T10:23:58Z
kind=infra | value=g10f ingress = nginx 1.24.0 + Varnish 7.1 on 35.157.38.218 (single EC2 host) | related=All g10f.de vhosts (AfD IdP, vendor IdP, Keycloak, LDAP admin, Plausible, tenant CMS, AfD Braunschweig) terminate on one AWS EC2 box. The helm-charts Traefik IngressRoute is the k8s deployment templat | source=op03-w4-g10f-traefik | first_seen=2026-10-04T10:27:10Z
kind=unrouted | value=traefik/cloud/wopiserver/collabora/www.g10f.de = stale CNAMEs to the apex, no service | related=DNS-live but no server block/router, no ACME cert. The office stack (Nextcloud/Collabora/WOPI) is NOT deployed on the g10f estate. Do not re-probe expecting content. | source=op03-w4-g10f-traefik | first_seen=2026-10-04T10:27:10Z
kind=email | value=gunnar@g10f.de | related=BOUND account on the AfD IdP (accounts.afd-team.de) | source=op03-w3-afd-idp-users | first_seen=2026-10-04T11:20:29Z
kind=realm | value=Keycloak realm 'demo' EXISTS on idp.g10f.de (2nd realm; default clients only) | related=resetPasswordAllowed=true; JWKS kid SrFikAHZDjHmA7wTJ87M-_5oINY0n1Q9mzjC782SY2k; registration disabled; no AfD clients | source=op03-w2-keycloak | first_seen=2026-10-04T11:23:12Z
kind=vuln_class | value=phpLDAPadmin-config-auth-unauth-read | related=ldap.g10f.de phpLDAPadmin 1.2.5 processes cmd.php query_engine/server_info/schema/export without a session (config-auth auto-bind); full directory read + LDIF export unauth. | source=op03-w1-g10f-ldap | first_seen=2026-10-04T11:25:00Z
kind=ldap-demo | value=dc=example,dc=org (stock OpenDJ sample directory) | related=The only namingContext on ldap.g10f.de; 20 sample entries, example.org/example.net mail, uid=schergu mail=schergu@g10f.de. NOT the real g10f/AfD identity store (corrects V6). | source=op03-w1-g10f-ldap | first_seen=2026-10-04T11:25:00Z
kind=service | value=OpenDJ Server 5.1.2 (Open Identity Platform Community) | related=ldap.g10f.de backend; read-only; SHA256/PBKDF2 schemes; SASL PLAIN/EXTERNAL/CRAM-MD5/DIGEST-MD5. | source=op03-w1-g10f-ldap | first_seen=2026-10-04T11:25:00Z
kind=path-disclosure | value=/var/www/phpldapadmin/... | related=Absolute install path leaked by phpLDAPadmin error pages on invalid server_id. | source=op03-w1-g10f-ldap | first_seen=2026-10-04T11:25:00Z
kind=keycloak-federation | value=uid=keycloak,ou=services,dc=example,dc=org | related=Service account in the demo LDAP, consistent with idp.g10f.de Keycloak LDAP federation. | source=op03-w1-g10f-ldap | first_seen=2026-10-04T11:25:00Z
kind=tenant | value=sso.kagyu.net | related=NEW g10f/sso tenant (Kagyu Net) on DWBN host 213.95.241.26, v5.4.8 | source=op03-w5-g10f-customers | first_seen=2026-10-04T12:45:59Z
kind=host-cluster | value=213.95.241.26 | related=DWBN prod+dev IdP, Kagyu IdP, DWBN Keycloak, registration portal | source=op03-w5-g10f-customers | first_seen=2026-10-04T12:45:59Z
kind=client-oracle | value=ca96cd88bc2740249d0def68221cba88 | related=browser client registered on DWBN prod+dev but NOT on sso.kagyu.net | source=op03-w5-g10f-customers | first_seen=2026-10-04T12:45:59Z
kind=jwks | value=kagyu/dwbn/afd/g10f disjoint kids | related=each tenant is a separate DB; no shared signing key | source=op03-w5-g10f-customers | first_seen=2026-10-04T12:45:59Z
kind=parked | value=kums.de | related=HTTPS handshake fails; HTTP 200 parked placeholder; no live IdP | source=op03-w5-g10f-customers | first_seen=2026-10-04T12:45:59Z
kind=second-idp | value=idp.dwbn.org | related=DWBN Keycloak master realm (separate from g10f/sso) | source=op03-w5-g10f-customers | first_seen=2026-10-04T12:45:59Z
kind=keycloak_version | value=idp.g10f.de >=26.7.2 (CVE-2026-18963 patched; exact masked) | related=resourceVersion=nvcaj | source=op03-x1-keycloak-exploit | first_seen=2026-10-04T13:10:44Z
kind=keycloak_realm | value=idp.g10f.de demo + master | related=demo reset enabled but patched | source=op03-x1-keycloak-exploit | first_seen=2026-10-04T13:10:44Z
kind=no-prod-directory | value=ldap.g10f.de has a single user backend userRoot=dc=example,dc=org | related=cn=monitor proves only one user backend; candidate production bases absent; cn=config denied. No production directory behind the panel. | source=op03-x3-ldap-prod | first_seen=2026-10-04T13:30:00Z
kind=keycloak-federation-demo | value=uid=keycloak,ou=services,dc=example,dc=org | related=Keycloak LDAP federation binds the stock demo OpenDJ; no separate production LDAP host exists on g10f.de. | source=op03-x3-ldap-prod | first_seen=2026-10-04T13:30:00Z
kind=opendj-version | value=OpenDJ Server 5.1.2 buildid 20260717142447 | related=Exact build of the ldap.g10f.de backend from unauth cn=Version,cn=monitor. | source=op03-x3-ldap-prod | first_seen=2026-10-04T13:30:00Z
kind=latent_forge | value=oauth-python-sample.g10f.de signed_cookies session forge (needs live SECRET_KEY) | related=client_session_id | source=op03-x2-django-forge | first_seen=2026-10-04T13:36:19Z
kind=latent_forge | value=g10f/sso auth:token user_data password-step bypass (needs live SECRET_KEY) | related=accounts.afd-team.de,sso.g10f.de | source=op03-x2-django-forge | first_seen=2026-10-04T13:36:19Z
kind=fingerprint | value=g10f/sso session engine = jwt_cookies HS256 DB key (not SECRET_KEY) | related=accounts.afd-team.de,sso.g10f.de | source=op03-x2-django-forge | first_seen=2026-10-04T13:36:19Z
kind=source_repo | value=https://github.com/g10f/sso | related=5.4.11 tag commit 64612552 (tag obj 674fa39c); worktree 96_sso_5411/src/sso-5.4.11 | source=op03-y2-sso-5411 | first_seen=2026-10-04T16:15:33Z
kind=version | value=g10f/sso 5.4.11 | related=LIVE on accounts.afd-team.de AND sso.g10f.de (privacy footer); SecurityMiddleware active | source=op03-y2-sso-5411 | first_seen=2026-10-04T16:15:33Z
kind=vuln_class | value=g10f-sso-5.4.11-no-new-regression | related=5.4.8->5.4.11 diff = SecurityMiddleware (5.4.9) + configurable legacy userinfo (5.4.10/11) + throttle debug; no auth-logic change | source=op03-y2-sso-5411 | first_seen=2026-10-04T16:15:33Z
kind=vuln_class | value=g10f-sso-legacy-userinfo-flag-LOW | related=when enabled, discovery -> /api/v2/users/me/ which returns unscoped organisations/admin metadata and skips client.is_active check vs validate_bearer_token; self-only | source=op03-y2-sso-5411 | first_seen=2026-10-04T16:15:33Z
kind=vuln_class | value=g10f-sso-coop-disabled-LOW | related=SECURE_CROSS_ORIGIN_OPENER_POLICY=None; live COOP header absent (deliberate for display=popup) | source=op03-y2-sso-5411 | first_seen=2026-10-04T16:15:33Z
kind=keycloak_bind_dn | value=uid=keycloak,ou=services,dc=example,dc=org | related=idp.g10f.de Keycloak -> OpenDJ demo LDAP (plaintext, internal 172.20.0.0/24) | source=op03-y5-keycloak-deep | first_seen=2026-10-04T16:35:45Z
kind=keycloak_realm | value=demo (LDAP-federated vendor test) | related=idp.g10f.de | source=op03-y5-keycloak-deep | first_seen=2026-10-04T16:35:45Z
kind=keycloak_realm | value=master | related=idp.g10f.de | source=op03-y5-keycloak-deep | first_seen=2026-10-04T16:35:45Z
kind=admin_console | value=https://idp.g10f.de/admin/master/console/ (public, 401 data routes) | related=idp.g10f.de | source=op03-y5-keycloak-deep | first_seen=2026-10-04T16:35:45Z
kind=oauth2_client_secret_live | value=client 2e8f7879dce540ac846a7d0c3d908d96 secret k3TMazCbsWKPMTsLIqytjrJtK1qBY0 LIVE (leaked g10f/blog-site a283d65887) | related=admin.afd-fraktion-rgb.de (RGB Django admin) | source=op03-y4-idp-session | first_seen=2026-10-04T16:40:24Z
kind=mail_routing | value=g10f.de=Mailgun; afd-braunschweig.de=one.com; afd-team.de=AWS SES inbound; gunnar.scherf@gmail.com=Google; all DMARC p=none | related=reset-email interception surface | source=op03-y4-idp-session | first_seen=2026-10-04T16:40:24Z
kind=host_header_base_url | value=get_base_url()/get_current_site() Host-derived (no django.contrib.sites); discovery + reset links; mitigated by ALLOWED_HOSTS | related=accounts.afd-team.de | source=op03-y4-idp-session | first_seen=2026-10-04T16:40:24Z
kind=shared-service | value=plausible.g10f.de = shared Plausible CE v3.2.1 analytics for all g10f tenants (AfD IdP + party site + school + private customers) | related=No unauth access: Stats API Bearer-key gated (401), internal API session+membership (404), no public site, no share link, no exposed ClickHouse/Postgres (only 80/443), no unauth SSRF, no applicable CV | source=op03-y3-plausible | first_seen=2026-10-04T16:42:48Z
kind=latent_ssrf | value=Wagtail 8.0 oEmbed (admin-gated) -> server-side URL fetch | related=admin.afd-braunschweig.de,admin.michal.g10f.de | source=op03-y1-pivot-ssrf | first_seen=2026-10-04T16:56:25Z
kind=latent_ssrf | value=oauth-python-sample IdentityProvider.jwks_uri fetch (admin-config) | related=oauth-python-sample.g10f.de | source=op03-y1-pivot-ssrf | first_seen=2026-10-04T16:56:25Z
kind=latent_ssrf | value=Keycloak OIDC broker backchannel fetch (admin-config) | related=idp.g10f.de/realms/demo-ldap | source=op03-y1-pivot-ssrf | first_seen=2026-10-04T16:56:25Z
kind=exposure | value=Keycloak dynamic client registration enabled (Trusted-Hosts gated) | related=idp.g10f.de | source=op03-y1-pivot-ssrf | first_seen=2026-10-04T16:56:25Z
kind=surface | value=Keycloak realm demo-ldap (SAML IdP for saml2.g10f.de) | related=idp.g10f.de | source=op03-y1-pivot-ssrf | first_seen=2026-10-04T16:56:25Z
kind=ci-secret-ref | value=g10f CI secrets.PAT -> private repo g10f/deployment (Ansible + vault + AWS SSM deploy for all tenants) | related=g10f/{sso,saml-demo,oauth-python-sample,wiki}/.github/workflows/ci.yaml; value not recoverable (write-only Actions secret) | source=op03-z1-github-pat | first_seen=2026-10-04T17:28:29Z
kind=ci-secret-ref | value=g10f/sso gitlab_sync.yaml -> secrets.GITLAB_TARGET_URL/USERNAME/TOKEN (private GitLab mirror) | related=likely gitlab.dwbn.org (DWBN collaborator, out of AfD scope); no GitLab PAT in our data | source=op03-z1-github-pat | first_seen=2026-10-04T17:28:29Z
kind=access_gap | value=GitHub PAT (secrets.PAT) + g10f/deployment private repo | related=recover only via a workflow+repo-scoped token on a g10f repo (we hold none) or an Actions foothold; do not push | source=op03-z1-github-pat | first_seen=2026-10-04T17:28:29Z
kind=pat-source | value=afdbt-devop.de n8n credential store (Git/GitHub/AWS creds) | related=auth-gated (401); prime PAT source if a foothold is obtained | source=op03-z1-github-pat | first_seen=2026-10-04T17:28:29Z
kind=host-cluster | value=213.95.241.0/24 (NORIS, Nuremberg) | related=DWBN/Kagyu Buddhist network hosting: .26 IdPs+51 apps, .10 registration, .11 karmapa.org, .15 mahamudra.de, .31 buddhizmus.sk, .27 DWBN 'bu' hosts | source=op03-z8-related-network | first_seen=2026-10-04T17:28:32Z
kind=host-cluster | value=128.140.24.250 (Hetzner) | related=DWBN Argo CD 3.5.3 + Grafana 13.0.1 + 48 argo/catalog hosts | source=op03-z8-related-network | first_seen=2026-10-04T17:28:32Z
kind=tenant | value=Kagyu Net | related=g10f/sso 5.4.8 IdP + www.kagyu.net | source=op03-z8-related-network | first_seen=2026-10-04T17:28:32Z
kind=new_afd_host | value=plausible.afd-team.de | related=NEW AfD-owned Plausible CE (separate from vendor plausible.g10f.de) | source=op03-z8-related-network | first_seen=2026-10-04T17:28:32Z
kind=shared_idp_code | value=g10f/sso powers AfD + DWBN + Kagyu | related=one codebase, per-tenant DBs (disjoint JWKS); a code flaw fans out to all tenants | source=op03-z8-related-network | first_seen=2026-10-04T17:28:32Z
kind=repo | value=g10f/deployment | related=private CI/deploy repo (Ansible + vault + per-tenant values); referenced by g10f/sso,saml-demo,oauth-python-sample CI | source=op03-z6-runner-secrets | first_seen=2026-10-04T17:36:06Z
kind=host | value=gitlab.dwbn.org | related=g10f/sso GitlabSync target; live GitLab; sso mirror private; 36 public projects are generic ansible roles | source=op03-z6-runner-secrets | first_seen=2026-10-04T17:36:06Z
kind=cloud | value=aws:348107122702 | related=g10f AWS account (from g10f/sso scripts/create_aws_login.py); role Test; deploys via SSM | source=op03-z6-runner-secrets | first_seen=2026-10-04T17:36:06Z
kind=path | value=/proj/<domain>/env.list | related=per-tenant secrets file on the g10f Docker host (from public Ansible --diff logs) | source=op03-z6-runner-secrets | first_seen=2026-10-04T17:36:06Z
kind=host | value=g10f-sso | related=Ansible inventory host for the sso.g10f.de container (AWS EC2 35.157.38.218 estate) | source=op03-z6-runner-secrets | first_seen=2026-10-04T17:36:06Z
kind=ci_secret | value=g10f/sso CI secrets | related=PAT, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, SSH_KEY, KNOWN_HOSTS, INSTANCE_ID, ANSIBLE_VAULT_PASSWORD, GITLAB_TARGET_URL/USERNAME/TOKEN (values masked) | source=op03-z6-runner-secrets | first_seen=2026-10-04T17:36:06Z
kind=local-auth-surface | value=/django-admin/login/ local Django admin on every Wagtail tenant (re-confirmed live) | related=admin.afd-braunschweig.de,admin.afd-fraktion-rgb.de,admin.michal.g10f.de,heilpaedagogik-luckenwalde.g10f.de; Z4 1152-combo test 0 hits | source=op03-z4-wagtail-login | first_seen=2026-10-04T17:48:54Z
kind=closed-negative | value=Wagtail/Django local-login credential set exhausted (1152 pairs, 0 successes) | related=held set incl. all 13 leaked Django SECRET_KEYs, killbill2, J1t::E0gv, AfD-Support-2026!x7Q, wp2 app-password, playground default, helm changeme, g10f history; do not re-run | source=op03-z4-wagtail-login | first_seen=2026-10-04T17:48:54Z
kind=live_secret_key | value=oauth-python-sample.g10f.de Django SECRET_KEY (Z6 leak) - LIVE | related=7idTP49H8 | source=op03-aa2-secretkey-forge | first_seen=2026-10-04T18:23:46Z
kind=live_secret_key | value=saml2.g10f.de Django SECRET_KEY (Z6 leak) - LIVE | related=lTNaYMHA5 | source=op03-aa2-secretkey-forge | first_seen=2026-10-04T18:23:46Z
kind=forged_session | value=oauth-python-sample.g10f.de authenticated session as oauth2.User uid=29 GlobalAdmin | related=client_session_id | source=op03-aa2-secretkey-forge | first_seen=2026-10-04T18:23:46Z
kind=forged_session | value=saml2.g10f.de arbitrary SAML session (attacker-controlled attributes) | related=sessionid | source=op03-aa2-secretkey-forge | first_seen=2026-10-04T18:23:46Z
kind=oidc_client | value=7ed4848fa1cb4ca184d2dec14b19d54a | related=wiki.afd-team.de/general | source=op03-aa5-afd-team-hosts | first_seen=2026-10-04T18:24:27Z
kind=oidc_client | value=9c131fbf8e4445db875c3c61e66f4e2a | related=wiki.afd-team.de/fraktion-rgb | source=op03-aa5-afd-team-hosts | first_seen=2026-10-04T18:24:27Z
kind=oidc_client | value=e880d1a79c2c49f09f749af6d5a44b58 | related=wiki.afd-team.de/braunschweig | source=op03-aa5-afd-team-hosts | first_seen=2026-10-04T18:24:27Z
kind=oidc_client | value=43f13bff5f624dd6874852fedd2edcc7 | related=wiki.afd-team.de/fraktion-bs | source=op03-aa5-afd-team-hosts | first_seen=2026-10-04T18:24:27Z
kind=oidc_client | value=effc0468dbf841c29bf889bd26f20b10 | related=wiki.afd-team.de/fraktion-gf | source=op03-aa5-afd-team-hosts | first_seen=2026-10-04T18:24:27Z
kind=oidc_client | value=70611d6dc0ae4428bf3d7c80caa75a30 | related=wiki.afd-team.de/ostverbund-ni | source=op03-aa5-afd-team-hosts | first_seen=2026-10-04T18:24:27Z
kind=gitlab_version | value=gitlab.dwbn.org=GitLab CE 19.4.1 (rev 191678a3764) not-vuln CVE-2026-85706 | related=dwbn.org | source=op03-aa5-afd-team-hosts | first_seen=2026-10-04T18:24:27Z
kind=redirect_alias | value=plausible.afd-team.de -> plausible.g10f.de | related=plausible.g10f.de | source=op03-aa5-afd-team-hosts | first_seen=2026-10-04T18:24:27Z
kind=password_grant_exhausted_aa3 | value=32 evidence-derived password-grant pairs (Z2 10 + AA3 22) -> 0 tokens; bound accounts are only gunnar@g10f.de (active) and stefan.wirtz@afd-braunschweig.de (bound); no password exists in any held corp | related=https://accounts.afd-team.de/oauth2/token/ | source=op03-aa3-oauth-full | first_seen=2026-10-04T18:30:17Z
kind=idp_session_unforgeable | value=g10f/sso IdP session is a jwt_cookies HS256 JWT signed with a DB-stored random ComponentConfig key (not SECRET_KEY); leaked SECRET_KEYs also fail the auth:token magic-link oracle -> session forgery im | related=https://accounts.afd-team.de/oauth2/ | source=op03-aa3-oauth-full | first_seen=2026-10-04T18:30:17Z
kind=oauthsample_globaladmin_session | value=Forged signed_cookies session (Z6 key 7idTP...) on oauth-python-sample.g10f.de as uid 29 GlobalAdmin (non-staff); vendor demo RP, no AfD data | related=https://oauth-python-sample.g10f.de/oauth2/session/ | source=op03-aa3-oauth-full | first_seen=2026-10-04T18:30:17Z
kind=forged_session | value=oauth-python-sample.g10f.de FULL ADMIN as uid=180 GunnarScherf (is_staff) | related=/admin/oauth2/ | source=op03-aa2-secretkey-forge | first_seen=2026-10-04T18:37:11Z
kind=oidc_registry_exposed | value=g10f oauth-python-sample OIDC registry (25 clients/22 secrets, 15 IdPs, 94 users) | related=data/admin_clients.tsv,data/admin_idps.tsv,data/admin_users.tsv | source=op03-aa2-secretkey-forge | first_seen=2026-10-04T18:37:11Z
kind=third_party_secrets | value=Volkswagen Group CloudIDP OIDC client secrets exposed via g10f admin | related=idp.cloud.vwgroup.com,login.microsoftonline.com/2882be50-2012-4d88-ac86-544124e120c8 | source=op03-aa2-secretkey-forge | first_seen=2026-10-04T18:37:11Z
kind=secret_enabled | value=oauth-python-sample.g10f.de /admin/oauth2/ | related=full Django admin reachable via forged uid 180 (Z6 live SECRET_KEY) - OIDC registry (AA2) | source=op03-aa6-exfil-secrets | first_seen=2026-10-04T18:43:09Z
kind=negative | value=SSH key-auth negative (13 held keys x 5 OpenSSH hosts) | related=114_ssh_ftp | source=op03-aa4-ssh-ftp | first_seen=2026-10-04T18:50:05Z
kind=oidc_registry | value=oauth-python-sample.g10f.de OIDC registry fully extracted (25 clients/23 secrets/15 IdPs/94 users) | related=data/registry_clients.tsv,data/registry_idps.tsv,data/registry_users.tsv | source=op03-bb1-django-exhaust | first_seen=2026-10-04T19:30:07Z
kind=oidc_rp_client | value=g10f SSO RP client_id ec1e39cbe3e746c787b770ace4165d13 registered redirect https://oauth-python-sample.g10f.de/oauth2/login/ | related=sso.g10f.de/oauth2/authorize/ | source=op03-bb1-django-exhaust | first_seen=2026-10-04T19:30:07Z
kind=forged_admin | value=oauth-python-sample.g10f.de FULL admin as uid 180 GunnarScherf (is_superuser) | related=/admin/oauth2/ | source=op03-bb1-django-exhaust | first_seen=2026-10-04T19:30:07Z
kind=private_repo | value=gitlab.dwbn.org/dwbn-admin/dev-devops-dwbn | related=DWBN private admin repo named in galaxy/ansible-common MOTD; 404 unauth (not exposed) | source=op03-bb3-dwbn-devops | first_seen=2026-10-04T19:35:17Z
kind=internal_domain | value=dwbn.internal | related=DWBN internal FQDN suffix (galaxy/ansible-postfix ansible_fqdn) | source=op03-bb3-dwbn-devops | first_seen=2026-10-04T19:35:17Z
kind=ci_secret_ref | value=gitlab.dwbn.org = g10f/sso CI mirror target | related=gitlab_sync.yaml GITLAB_TARGET_URL/USERNAME/TOKEN (values masked); 36 public projects are generic roles | source=op03-bb3-dwbn-devops | first_seen=2026-10-04T19:35:17Z
kind=live_oidc_client_secret | value=g10f OIDC client ec1e39cbe3e746c787b770ace4165d13 (dCH8rLoO...) LIVE at sso.g10f.de | related=sso.g10f.de/oauth2/token/ | source=op03-bb1-django-exhaust | first_seen=2026-10-04T19:36:24Z
kind=django_superuser | value=oauth-python-sample.g10f.de superusers uid180/316/405/421 (2 VW employees) | related=/admin/oauth2/user/ | source=op03-bb1-django-exhaust | first_seen=2026-10-04T19:36:24Z
kind=oidc_registry_exhausted | value=g10f oauth-python-sample full OIDC registry (25 clients/22 secrets/15 IdPs/94 users/6 orgs/5 roles) | related=data/registry_clients.json | source=op03-bb1-django-exhaust | first_seen=2026-10-04T19:36:24Z
kind=third_party_secrets | value=14 VW CloudIDP/QS + 2 Entra OIDC client secrets exposed via g10f admin | related=idp.cloud.vwgroup.com,login.microsoftonline.com/2882be50-2012-4d88-ac86-544124e120c8 | source=op03-bb1-django-exhaust | first_seen=2026-10-04T19:36:24Z
kind=host-cluster | value=34.248.116.63 / 3.79.68.56 (AWS) | related=afd-hosting.de control/web estate: cp/dev-test/web1 + apex; eu-west-1 & eu-central-1 | source=op03-bb6-afd-devops | first_seen=2026-10-04T19:37:58Z
kind=vendor | value=g10f (DE, 35.157.38.218) | related=AfD SSO/IdP + Wagtail CMS + Keycloak; accounts/cms/wiki/plausible/cuxhaven/peine.afd-team.de | source=op03-bb6-afd-devops | first_seen=2026-10-04T19:37:58Z
kind=live_oidc_client_secret | value=g10f CONFIDENTIAL OIDC client ec1e39cbe3e746c787b770ace4165d13 (dCH8rLoO...) LIVE at sso.g10f.de | related=sso.g10f.de/oauth2/token/ | source=op03-bb1-django-exhaust | first_seen=2026-10-04T19:41:10Z
kind=public_oidc_client | value=g10f PUBLIC OIDC client ff15f1201d734ec1908b782ad6da960e (javascript; secret not validated) | related=sso.g10f.de/oauth2/token/ | source=op03-bb1-django-exhaust | first_seen=2026-10-04T19:41:10Z
kind=public_oidc_client | value=g10f PUBLIC OIDC client 9fd1e548078e4482a25cf94abd198ed7 (native; secret not validated) | related=sso.g10f.de/oauth2/token/ | source=op03-bb1-django-exhaust | first_seen=2026-10-04T19:41:10Z
kind=oidc_client_secret_live | value=ec1e39cbe3e746c787b770ace4165d13 | related=g10f web client secret valid at sso.g10f.de AND sso.dwbn.org (DWBN prod); password grant enabled; control-verified | source=op03-bb4-oidc-secrets | first_seen=2026-10-04T19:43:12Z
kind=oidc_cross_tenant_client | value=ec1e39cbe3e746c787b770ace4165d13 | related=client_id registered at two production g10f/sso tenants (g10f + DWBN) | source=op03-bb4-oidc-secrets | first_seen=2026-10-04T19:43:12Z
kind=oidc_token_unlock | value=ec1e39cb... password grant | related=needs a valid g10f or DWBN user password; none held | source=op03-bb4-oidc-secrets | first_seen=2026-10-04T19:43:12Z
kind=pat-source | value=afdbt-devop.de n8n credential store (Git/GitHub/AWS creds) | related=still auth-gated (401 /rest/credentials); owner credential not recoverable from corpora or unauth surface; PAT source remains unread | source=op03-bb5-n8n-owner | first_seen=2026-10-04T19:44:27Z
kind=negative | value=n8n host static file probe (config/backup/DB/source-map) | related=51 paths x 2 hosts; SPA catch-all (200/52122) for unknown paths; *.js.map 404; /server-status 403; no .env/.git/docker/sqlite/backup | source=op03-bb5-n8n-owner | first_seen=2026-10-04T19:44:27Z
kind=devops_estate_map | value=E1 g10f / E2 afd-hosting / E3 SEWOBE / E4 Tourscope-AMEEN / E5 n8n / E6 Plesk | related=six vendor-run estates; central map in 118_devops_map | source=op03-bb2-devops-map | first_seen=2026-10-04T19:51:20Z
kind=chokepoint | value=g10f/deployment + AWS account 348107122702 | related=root of the vendor identity/deploy chain (every tenant secret at deploy) | source=op03-bb2-devops-map | first_seen=2026-10-04T19:51:20Z
kind=devops_source | value=github.com/g10f (7 repos) + ghcr.io/g10f/sso + g10f.github.io/helm-charts | related=vendor source/registry/charts for all tenants | source=op03-bb2-devops-map | first_seen=2026-10-04T19:51:20Z
kind=devops_source | value=gitlab.dwbn.org (GitLab CE 19.4.1) | related=private mirror of g10f/sso | source=op03-bb2-devops-map | first_seen=2026-10-04T19:51:20Z
kind=devops_automation | value=afdbt-devop.de / n8n.cephei.to (n8n 2.41.5) | related=automation node holding Git/GitHub/AWS creds (auth-gated) | source=op03-bb2-devops-map | first_seen=2026-10-04T19:51:20Z
kind=vendor_cluster | value=g10f (Gunnar Scherf) multi-tenant identity/deploy | related=AfD + DWBN + Kagyu + school + private on one host/AWS account | source=op03-bb2-devops-map | first_seen=2026-10-04T19:51:20Z