Brazil
Public Transportation
Database Access
For Sale
Unverified
Moveciti Administrator Access and Exported Database Offered for Sale With 1.18 Million Bus-App Documents
Overview
An actor using the handle "DaOnlySpark" claims to be selling administrator access to Moveciti's database along with a database export dated October 9, 2026. Moveciti is described in the listing as a digital mobility platform that provides bus schedules, real-time bus tracking and nearby stop information.
The actor prices administrator access at $200, the exported database at $150, or both for $300. The listing describes multiple data collections spanning bus GPS data, route history, user accounts, saved favorites, rider information, device-login history, trips, vehicle data, identity-verification documents, push-notification jobs and uploaded profile or vehicle images. The access, database export, collection counts and current availability have not been independently verified.
Post details
BrazilWhat the post claims
- Administrator database access offered for sale
- Pre-exported database offered separately
- Moveciti Bus App: 24 collections and ~1.18M documents
- 686,665 live bus GPS location records
- 260,784 route-bus history records
- 163,466 per-user ride-count records
- 42,442 app-user records
- 6,196 favorite-route records
- 3,255 favorite bus-stop records
- 2,566 review-feedback records
- 2,008 bus-stop records
- 1,025 route-report records
- Moveciti Viagens app: 30 collections and ~24K documents
- 9,856 ride-offer event records
- 7,621 marketing-event records with tracking metadata
- 1,107 device-login-history records
- 807 ride records
- 663 rider-account records
The listing also references vehicle records, rider transactions, registration leads, identity-verification jobs, administrator-user records and a separate document collection of roughly 354 MB across 26,826 files. That document set is described as containing user profile photos, vehicle-registration documents, driver-profile images, driver-licence scans, ID/document verification scans, PIX payment QR-code images and other uploaded media.
Screenshots
IOCs & contact identifiers
Identifiers directly visible in the supplied material. These support correlation and do not independently verify the access or database-sale claim.
| Type | Identifier | Source |
|---|---|---|
| Actor handle | DaOnlySpark | Screenshots 1–2 |
| Session ID | 05f0c154aa452d2d610628fb375d3ef80efb4a5c377b6ee409d99988d80f00605f | Screenshot 2 |
| Telegram | @DaOnlySpark | Screenshot 2 |
| XMR wallet | 89RAbi5JYC6coBuBSGkdSfAmoZUSKEEJsjmcsLtX1VYqDRL8G1kJTk3XbSvxtixe95S9ZQOmupH9EhvZ8PkYehNj5ufSYQ8 | Screenshot 2 |
| Named organization domain | moveciti[.]com | Screenshot 1 |
The organization domain identifies the company named in the claim, not malicious infrastructure. No malware hash or attacker-controlled IP address is visible in the supplied material. Personal identifiers and identity-document contents referenced in the purported database are not included in this table.
Mapped techniques
Claimed identifies behavior explicitly described by the actor. Inferred identifies an analytical mapping supported by the supplied material. Neither label means the activity has been independently verified.
- Initial Access T1078 Valid Accounts Inferred The actor claims to be selling administrator-level database access. The supplied material does not show how that access was obtained or whether it relies on compromised credentials.
- Collection T1213.006 Data from Information Repositories: Databases Inferred The actor claims to possess an exported database containing multiple structured collections and supporting files. The supplied screenshots do not independently establish the acquisition method or the authenticity of the export.
Potential impact
If authentic, administrator access combined with the claimed export could expose user accounts, rider and driver information, GPS and trip history, device-login metadata, vehicle documents, driver-licence scans, identity-verification files and profile images. The combination could support privacy abuse, targeted phishing, identity fraud or further unauthorized access to Moveciti systems.
Status Unverified
Dark Web Informer has not independently verified the administrator-access claim, the exported database, the October 9 export date, collection counts, document counts, pricing or current availability. The supplied screenshots document the sale offer and claimed database structure, not independent confirmation of access to Moveciti systems.
