# LoanApps Sri Lanka (LK) — killerloanapps playbook, first harvest

**Built**: 2026-09-20 · **Source**: GPlayAPI v2 (gplayapiv2.fly.dev), `country=lk` · **Corpus**: 155 lending apps, 1,768 permission rows · Schema: same as `Datasets/loanappsdata_NG.db` + extra legal-entity columns.

Context: Kavinda Welagedara (welagedara@proton.me, Fudge/Colombo) emailed 2026-09-19 researching "authorities against micro-lending fraud" in Sri Lanka. This harvest is the same play as the India (IN) and Nigeria (NG) killerloanapps builds: search-term sweep → Play metadata → permissions → developer/legal-entity extraction → template-clone detection.

## What the LK corpus shows (first-pass)

1. **Legal-entity coverage is now 100%** — Play's finance-app policy means every lending app carries `developerLegalName`, legal address, phone, email. The DB makes this queryable (the NG/IN builds predated this).
2. **Clone/template families** (8-gram Jaccard on descriptions):
   - `CashGedara ↔ CashMate ↔ FreedomCash ↔ CashMellon ↔ SkyWallet ↔ SmartCredit` (0.45–0.78) — meta-app network.
   - `KREDITME ↔ MyKredit ↔ DrCash` (0.91) — one template, three shells.
   - `Monigo.lk ↔ Fino.lk` (0.84) — both registered to **S F GROUP (PRIVATE) LIMITED**.
   - `CashLoan - EMI Loan Calculator` published ~11 times, byte-identical descriptions — listing farm.
3. **Shared boilerplate**: the disclosure sentence "apr 12% (per annum) 5000 lkr loan with a term of 91 days / loan interest = 5000lkr x 12% / 365 x 92 = lkr 151" appears in **10 apps** — inherited template from the South Asian clone ecosystem (same pattern seen in NG corpus).
4. **Cross-border shells behind LK loan apps**:
   - `CashNow` → QUANTIX TECHNOLOGY PROJECTS LLC (`weijie.chen@quantix.ae`) — UAE LLC.
   - `InsCash` → EKAOA PRESTIGE ENTERPRISE (`ALLOTEYOSCAR@ekaoaprestige.com`).
   - `CashGedara` → individual dev (`monkeystudio4@gmail.com`).
   - Foreign-market apps (PH PagIBIG, NG Zedvance, IN slice/ICICI/PhonePe) also appear in the LK catalog.
5. **Dangerous permission reach** (of 155): take pictures 84, read storage 74, record audio 44, precise location 42, **read contacts 35**, send SMS 8, read call log 4. No live contacts+SMS combo harvester in this sweep (the worst 2020-India pattern), but 35 contact-readers among shady devs warrant reverse-engineering (MobSF) next.
6. **.lk developer cohort (19 apps)**: CashLoan (Digital Online Solutions PVT LTD), LoanPlus ×2 (A I S I T CONSULTING PVT LTD), OnCredit (ONCREDIT PVT LTD), Loanme (Fintech Software Solutions PVT LTD), CashX ×2 (A V BUSINESS SOLUTIONS PVT LTD), LB Finance PLC (licensed, legit), Mintpay (BNPL, licensed path), Monigo/Fino (S F Group).
7. **Kavinda's named entities (technofin, minicash, axecash, FastRupe) do NOT surface in live Play search** — consistent with takedowns or off-Play distribution. Next playbook step for those: deleted-app tracking + Koodous/APK-archive lookups (his research dir already holds 5 such APKs on Thinkpad).

## Files

- `loanappsdata_LK.db` — SQLite, tables `loanapp_playdata` (155) + `loanapp_permissions` (1,768)
- `notes/2026-09-20-sl-authority-map.md` — who regulates what, with sources
- `srilanka-email-2026.eml` / `.md` — the original email (headers verified: SPF/DKIM pass, Proton)
- Backups: Drive folder "LoanApps Recovery 2026-09-20" + https://zo.pub/cashlessconsumer/loanapps-db

## Queries to start

```sql
-- clone family members and their legal entities
SELECT title, developerLegalName, developerEmail, minInstalls
FROM loanapp_playdata WHERE title IN ('CashGedara','CashMate','FreedomCash','CashMellon','SkyWallet','SmartCredit');
-- all .lk-cohort lending apps
SELECT title, developerLegalName, developerEmail FROM loanapp_playdata
WHERE developerWebsite LIKE '%.lk%' ORDER BY title;
```

## Next steps (playbook queue)

1. MobSF reverse of the 5 APKs in `/media/data/Research/CC/` (Thinkpad) + fresh LK APK fetch via apkeep.
2. Description corpus + survey question drafts for Kavinda's victim interviews (his open loop).
3. Deleted-app / Koodous sweep for the takedown cohort.
4. eROC verification queue → now doubles as MCRA registration queue (Act No. 9 of 2026).