# L40 — NPONTU CREDENTIALS FROM WINGSCLOUD STEALER LOGS
# Date: 2026-09-02. Source: WINGSCLOUD-ULP-AUG-06-AUG-06-21.tsv (3.6GB stealer logs)

## TOTAL NPONTU-RELATED ENTRIES: 94 (13 unique credential pairs)

## CONFIRMED NPONTU DOMAIN CREDENTIALS

### CRITICAL — Internal Systems
| URL | Username | Password | Notes |
|-----|----------|----------|-------|
| **https://gitlab.npontu.com/users/sign_in** | aodoi | **niilaryea** | GitLab login — SAME as kedebah? |
| **https://mx.npontu.com** | klokko.com | **5Xpyp5aVGA** | Roundcube email |
| **https://mx.npontu.com/iredadmin/create/user/npontu.com** | dmodey | **rmuwh4d9pk** | iRedAdmin (mail admin) |
| **https://mx.npontu.com/iredadmin/create/user/npontu.com** | nptt@npontu.com | **3em34tg3xd** | iRedAdmin (mail admin) |
| **http://mx.npontu.com/iredadmin/create/user/npontu.com** | rclottey | **russelpassword** | iRedAdmin (mail admin) |
| **https://signin.aws.amazon.com/signin** | support@npontu.com | **niilaryea@01** | AWS console — SAME PASSWORD PATTERN |
| **http://iipgh.npontu.com/login** | admin@iipgh.org | **IMP@))3$s!+1** | Internal app |

### MEDIUM — Third-party
| URL | Username | Password | Notes |
|-----|----------|----------|-------|
| https://webpay.etranzactgh.com/xportal2/login/ | npontu | **npontu@1** | Payment portal |
| https://npontu.kedebah.test | npontu | **password** | Test environment |

### NOT NPONTU (false positives — "pontus" in name)
| URL | Username | Password | Notes |
|-----|----------|----------|-------|
| https://accounts.google.com | olofssonpontus2@icloud.com | pontus201355 | NOT NPONTU |
| https://funds.gofundme.com | nordstenpontus@gmail.com | pontus123123 | NOT NPONTU |
| http://web.facebook.com | luitha0716 | Deanpontus1 | NOT NPONTU |

## KEY FINDINGS

### 1. PASSWORD REUSE PATTERN
- **niilaryea** (GitLab) → **niilaryea@01** (AWS)
- Same base password + suffix = **credential reuse confirmed**

### 2. iRedAdmin Credentials (3 users)
- dmodey / rmuwh4d9pk
- nptt@npontu.com / 3em34tg3xd
- rclottey / russelpassword
- **iRedAdmin = mail server admin panel** — can create/modify email accounts

### 3. AWS Console Access
- support@npontu.com / niilaryea@01
- **AWS = cloud infrastructure** — potential for full cloud compromise

### 4. GitLab Access
- aodoi / niilaryea
- **aodoi = Abraham Nii Laryea Odoi** (from kedebah staff list)
- Same password as AWS (niilaryea base)

## EXPLOITATION VALUE

| Credential | Target | Access Level | Risk |
|------------|--------|--------------|------|
| aodoi/niilaryea | GitLab | Developer | HIGH |
| support@npontu.com/niilaryea@01 | AWS | Admin? | CRITICAL |
| dmodey/rmuwh4d9pk | iRedAdmin | Mail admin | HIGH |
| nptt@npontu.com/3em34tg3xd | iRedAdmin | Mail admin | HIGH |
| rclottey/russelpassword | iRedAdmin | Mail admin | HIGH |

## RECOMMENDED ACTIONS

1. **AWS Console**: Test support@npontu.com/niilaryea@01 (HIGH VALUE)
2. **iRedAdmin**: Test all 3 creds on mx.npontu.com/iredadmin/
3. **GitLab**: Test aodoi/niilaryea (may have more repos than eaidoo)
4. **Password pattern**: niilaryea + suffix = try niilaryea@02, niilaryea@2024, etc.

## OPSEC NOTE
These are from stealer logs (Aug 6, 2026) — may be stale or rotated. Test carefully.