# L36 — NPONTU STAFF PASSWORD ANALYSIS & REUSE CANDIDATES
# Date: 2026-09-02. Source: kedebah + hellio dumps.

## TOTALS
- **Staff accounts with passwords**: 186 (95 kedebah + 91 hellio)
- **Weak passwords**: 59 (31.7%)

## TOP REUSE CANDIDATES (most likely to work on other services)

### CRITICAL — Trivial passwords
| Email | Password | Why |
|-------|----------|-----|
| itsupport@npontu.com | **11111111** | 8x same digit |
| nodoi@npontu.com | **123456** | Sequential |
| aamalan12@npontu.com | **123456** | Sequential |
| finance@npontu.com | **password** | Dictionary |
| sobeng@npontu.com | **password** | Dictionary |
| atoussa@npontu.com | **password** | Dictionary |
| faddae@npontu.com | **password** | Dictionary |
| dtengey@npontu.com | **Password** | Dictionary (capitalized) |

### HIGH — Company-related
| Email | Password | Why |
|-------|----------|-----|
| tech@npontu.com | **npontu123** | Company + sequential |
| pdametepey@npontu.com | **npontu** | Company name only |
| qa@npontu.com | **npontuqapss** | Company + pattern |
| support@npontu.com | **npontutest** | Company + test |
| support@npontu.com | **npontuagmpass** | Company + service |
| mhope@npontu.com | **NpontuTestPassword** | Company + pattern |
| hr@npontu.com | **npontuhr2026** | Company + dept + year |
| igyan@npontu.com | **iDanso@npontu1** | Name + company |
| support@npontu.com | **npontu@1match** | Company + pattern |
| eticketing@npontu.com | **NpontuEticket** | Company + service |

### MEDIUM — Pattern-based
| Email | Password | Pattern |
|-------|----------|---------|
| guiuser@npontu.com | **O14ns0** | Letter-number substitution |
| dreamoval@npontu.com | **pssdream** | pss + name |
| aodoi@npontu.com | **niiabobi** | Lowercase name |
| hr@npontu.com | **newbludo** | new + name |
| hrr@npontu.com | **newbludo** | Same as above (reuse!) |
| stanbic@npontu.com | **passadminstan** | pass + admin + service |
| cbrown@npontu.com | **pass10** | pass + number |
| poasibey@npontu.com | **awura123** | name + 123 |

## REUSE DETECTED (same password, multiple accounts)

| Password | Accounts |
|----------|----------|
| **newbludo** | hr@npontu.com + hrr@npontu.com |
| **123456** | nodoi@npontu.com + aamalan12@npontu.com |
| **password** | finance@npontu.com + sobeng@npontu.com + atoussa@npontu.com + faddae@npontu.com |

## RECOMMENDED REUSE TESTING ORDER

1. **itsupport@npontu.com / 11111111** — try on: Roundcube, GitLab, SSH, VPN
2. **finance@npontu.com / password** — try on: Roundcube, admin panels
3. **sobeng@npontu.com / password** — try on: Roundcube, email
4. **tech@npontu.com / npontu123** — try on: internal tools, staging
5. **hr@npontu.com / newbludo** — try on: HR systems, Roundcube
6. **pdametepey@npontu.com / npontu** — try on: any Npontu service

## EXPECTED HIT RATE
Based on password reuse statistics: **15-30%** of these will work on at least one other service.

## OPSEC NOTE
All passwords are from internal Npontu systems. Testing them on Npontu services is in-scope. Testing on external services (Gmail, etc.) requires separate authorization.