FOR SALE: Lion Air Corporate Mail Server Access

marlanwg · (This post was last modified: 16-10-26, 02:36 AM by marlanwg.)

FOR SALE — Lion Air Corporate Mail Server Access
Alt-N MDaemon 26.0.3 — Valid Corporate Mailbox + WebAdmin Console

WHAT YOU GET

- Valid corporate mailbox on Lion Air's enterprise mail infrastructure
- Real in-use inbox — Inbox/Sent folders, 15 unread at time of access
- Webmail session on https://mail.lionair.co.id/ (TCP/443)
- WebAdmin console session on https://mail.lionair.co.id:444/ (MDaemon Remote Administration)
- MDaemon 26.0.3 (build 26.0.3.1, Jun 2026)
- No MFA, no account lockout, no CAPTCHA on either surface
- Additional enumerable mailboxes available
- BEC-ready — mailbox bound to password-reset / MFA / verification flows

TARGET DETAILS

Host: mail.lionair.co.id / smtp.lionair.co.id / 47.131.148.9 (PTR mail2.lionair.co.id)
Software: Alt-N MDaemon Messaging Server 26.0.3
Webmail: https://mail.lionair.co.id/WorldClient.dll?View=Logon (TCP/443)
WebAdmin: https://mail.lionair.co.id:444/login.wdm (TCP/444)
Auth requirements: WebAdmin — none (no CSRF token). Webmail — single-use LoginToken from login page.

PROOF OF ACCESS

1. WebAdmin (TCP/444) — authenticated console

Show Content

2. Authenticated .wdm pages render live console

Show Content

3. Webmail (TCP/443) — authenticated mailbox

Show Content

4. Control — password is the discriminating factor

Show Content

5. Spray run that produced the hit

Show Content

WHY HIGH VALUE

- Corporate mailbox, not a test artifact
- Send-as capability — ideal for BEC, internal phishing, invoice fraud
- Password-reset interception — downstream services pivotable
- WebAdmin console — authenticated foothold on management plane
- No MFA, no lockout — reconfirmed after 1166 automated attempts
- Internet-exposed TCP/444 — MDaemon recommends LAN/VPN-only

PRICE

Price: 800 USD — negotiable
Payment: BTC / XMR —
Delivery: Instant — credentials delivered privately via Session after payment confirmation

WHAT'S INCLUDED

- Mailbox credentials + live session tokens (delivered privately)
- Live Webmail session token (tested before handover)
- Live WebAdmin RASession token (tested before handover)
- Full curl PoC for both endpoints
- Saved HTML artifacts: WA_login_success.html, WM_login_callcenter.html, webmail_main.html
- Reusable credential spray script (Python, concurrent, rate-limited)
- Wordlist used (53 org-themed passwords)

CONTACT

Session: 058aa7f236de6df87aba97ae160a245ba6afcc37e9dd82d4573ec91d2a61317b42
Response: Within 24h
Escrow: Accepted — buyer's choice And old customers
Proof of life: Available on request

NOTES

- No auto-bound HTTP transactions; all evidence is verbatim command output and saved artifacts
- Credentials validated end-to-end at time of writing
- Not sold exclusive — first-come, first-served
- If target rotates password after purchase, outside seller's control
- Buyer assumes all responsibility for use

Serious buyers only. Contact via Session.

Sample

marlanwg · (This post was last modified: 16-10-26, 09:11 AM by marlanwg.)

(16-10-26, 02:11 AM)marlanwg Wrote:
FOR SALE — Lion Air Corporate Mail Server Access
Alt-N MDaemon 26.0.3 — Valid Corporate Mailbox + WebAdmin Console

WHAT YOU GET

- Valid corporate mailbox on Lion Air's enterprise mail infrastructure
- Real in-use inbox — Inbox/Sent folders, 15 unread at time of access
- Webmail session on https://mail.lionair.co.id/ (TCP/443)
- WebAdmin console session on https://mail.lionair.co.id:444/ (MDaemon Remote Administration)
- MDaemon 26.0.3 (build 26.0.3.1, Jun 2026)
- No MFA, no account lockout, no CAPTCHA on either surface
- Additional enumerable mailboxes available
- BEC-ready — mailbox bound to password-reset / MFA / verification flows

TARGET DETAILS

Host: mail.lionair.co.id / smtp.lionair.co.id / 47.131.148.9 (PTR mail2.lionair.co.id)
Software: Alt-N MDaemon Messaging Server 26.0.3
Webmail: https://mail.lionair.co.id/WorldClient.dll?View=Logon (TCP/443)
WebAdmin: https://mail.lionair.co.id:444/login.wdm (TCP/444)
Auth requirements: WebAdmin — none (no CSRF token). Webmail — single-use LoginToken from login page.

PROOF OF ACCESS

1. WebAdmin (TCP/444) — authenticated console

Show Content

Spoiler

HTTP/1.1 200 OK Set-Cookie: RASession=ZmVjbGRpbnZmendwenNwa216ZW1qc3ZzZ251cw== <title>MDaemon Administration</title> len 21477 --- console (authenticated) --- MDaemon Administration Main | Status | My Account | Account Details | My Mailing Lists | Autoresponder | Forwarding | IMAP Filters | Shared Folders | Signature | Allow List | Settings | Sign Out

2. Authenticated .wdm pages render live console

Show Content

Spoiler

cookie: {'RASession': 'ZXVyb3FkZXNub2R1cmlocGd2Y3RpYXJlaWFhZQ=='} main.wdm 200 10345 | title: MDaemon Remote Administration account.wdm 200 10345 | title: MDaemon Remote Administration domainlist.wdm 200 10345 | title: MDaemon Remote Administration

3. Webmail (TCP/443) — authenticated mailbox

Show Content

Spoiler

webmail status 200 len 118604 has invalid msg: False has Session=: True title: MDaemon Webmail - authenticated mailbox view --- folder/unread data --- Inbox 7 | Sent 3 | Drafts 0 | Unread 15 | message 126 | folder 203 | logout 1

4. Control — password is the discriminating factor

Show Content

Spoiler

non-existent account / wrong password -> 200, 10744, 'INVALID', False non-existent account / correct password -> 200, 10744, 'INVALID', False valid account / correct password -> 200, 118604, 'SUCCESS', True

5. Spray run that produced the hit

Show Content

Spoiler

[webadmin] progress 800/1166 [webadmin] HIT webadmin :: <redacted> len=21477 1166 attempts = 22 identities x 53 passwords No lockout, no CAPTCHA, no rate-limit triggered.

WHY HIGH VALUE

- Corporate mailbox, not a test artifact
- Send-as capability — ideal for BEC, internal phishing, invoice fraud
- Password-reset interception — downstream services pivotable
- WebAdmin console — authenticated foothold on management plane
- No MFA, no lockout — reconfirmed after 1166 automated attempts
- Internet-exposed TCP/444 — MDaemon recommends LAN/VPN-only

PRICE

Price: 800 USD — negotiable
Payment: BTC / XMR —
Delivery: Instant — credentials delivered privately via Session after payment confirmation

WHAT'S INCLUDED

- Mailbox credentials + live session tokens (delivered privately)
- Live Webmail session token (tested before handover)
- Live WebAdmin RASession token (tested before handover)
- Full curl PoC for both endpoints
- Saved HTML artifacts: WA_login_success.html, WM_login_callcenter.html, webmail_main.html
- Reusable credential spray script (Python, concurrent, rate-limited)
- Wordlist used (53 org-themed passwords)

CONTACT

Session: 058aa7f236de6df87aba97ae160a245ba6afcc37e9dd82d4573ec91d2a61317b42
Response: Within 24h
Escrow: Accepted — buyer's choice And old customers
Proof of life: Available on request

NOTES

- No auto-bound HTTP transactions; all evidence is verbatim command output and saved artifacts
- Credentials validated end-to-end at time of writing
- Not sold exclusive — first-come, first-served
- If target rotates password after purchase, outside seller's control
- Buyer assumes all responsibility for use

Serious buyers only. Contact via Session.

Sample

Update:For sale lionair.co.id webshell access

(16-10-26, 08:36 AM)marlanwg Wrote:
(16-10-26, 02:11 AM)marlanwg Wrote:
FOR SALE — Lion Air Corporate Mail Server Access
Alt-N MDaemon 26.0.3 — Valid Corporate Mailbox + WebAdmin Console

WHAT YOU GET

- Valid corporate mailbox on Lion Air's enterprise mail infrastructure
- Real in-use inbox — Inbox/Sent folders, 15 unread at time of access
- Webmail session on https://mail.lionair.co.id/ (TCP/443)
- WebAdmin console session on https://mail.lionair.co.id:444/ (MDaemon Remote Administration)
- MDaemon 26.0.3 (build 26.0.3.1, Jun 2026)
- No MFA, no account lockout, no CAPTCHA on either surface
- Additional enumerable mailboxes available
- BEC-ready — mailbox bound to password-reset / MFA / verification flows

TARGET DETAILS

Host: mail.lionair.co.id / smtp.lionair.co.id / 47.131.148.9 (PTR mail2.lionair.co.id)
Software: Alt-N MDaemon Messaging Server 26.0.3
Webmail: https://mail.lionair.co.id/WorldClient.dll?View=Logon (TCP/443)
WebAdmin: https://mail.lionair.co.id:444/login.wdm (TCP/444)
Auth requirements: WebAdmin — none (no CSRF token). Webmail — single-use LoginToken from login page.

PROOF OF ACCESS

1. WebAdmin (TCP/444) — authenticated console

Show Content

Spoiler

HTTP/1.1 200 OK Set-Cookie: RASession=ZmVjbGRpbnZmendwenNwa216ZW1qc3ZzZ251cw== <title>MDaemon Administration</title> len 21477 --- console (authenticated) --- MDaemon Administration Main | Status | My Account | Account Details | My Mailing Lists | Autoresponder | Forwarding | IMAP Filters | Shared Folders | Signature | Allow List | Settings | Sign Out

2. Authenticated .wdm pages render live console

Show Content

Spoiler

cookie: {'RASession': 'ZXVyb3FkZXNub2R1cmlocGd2Y3RpYXJlaWFhZQ=='} main.wdm 200 10345 | title: MDaemon Remote Administration account.wdm 200 10345 | title: MDaemon Remote Administration domainlist.wdm 200 10345 | title: MDaemon Remote Administration

3. Webmail (TCP/443) — authenticated mailbox

Show Content

Spoiler

webmail status 200 len 118604 has invalid msg: False has Session=: True title: MDaemon Webmail - authenticated mailbox view --- folder/unread data --- Inbox 7 | Sent 3 | Drafts 0 | Unread 15 | message 126 | folder 203 | logout 1

4. Control — password is the discriminating factor

Show Content

Spoiler

non-existent account / wrong password -> 200, 10744, 'INVALID', False non-existent account / correct password -> 200, 10744, 'INVALID', False valid account / correct password -> 200, 118604, 'SUCCESS', True

5. Spray run that produced the hit

Show Content

Spoiler

[webadmin] progress 800/1166 [webadmin] HIT webadmin :: <redacted> len=21477 1166 attempts = 22 identities x 53 passwords No lockout, no CAPTCHA, no rate-limit triggered.

WHY HIGH VALUE

- Corporate mailbox, not a test artifact
- Send-as capability — ideal for BEC, internal phishing, invoice fraud
- Password-reset interception — downstream services pivotable
- WebAdmin console — authenticated foothold on management plane
- No MFA, no lockout — reconfirmed after 1166 automated attempts
- Internet-exposed TCP/444 — MDaemon recommends LAN/VPN-only

PRICE

Price: 800 USD — negotiable
Payment: BTC / XMR —
Delivery: Instant — credentials delivered privately via Session after payment confirmation

WHAT'S INCLUDED

- Mailbox credentials + live session tokens (delivered privately)
- Live Webmail session token (tested before handover)
- Live WebAdmin RASession token (tested before handover)
- Full curl PoC for both endpoints
- Saved HTML artifacts: WA_login_success.html, WM_login_callcenter.html, webmail_main.html
- Reusable credential spray script (Python, concurrent, rate-limited)
- Wordlist used (53 org-themed passwords)

CONTACT

Session: 058aa7f236de6df87aba97ae160a245ba6afcc37e9dd82d4573ec91d2a61317b42
Response: Within 24h
Escrow: Accepted — buyer's choice And old customers
Proof of life: Available on request

NOTES

- No auto-bound HTTP transactions; all evidence is verbatim command output and saved artifacts
- Credentials validated end-to-end at time of writing
- Not sold exclusive — first-come, first-served
- If target rotates password after purchase, outside seller's control
- Buyer assumes all responsibility for use

Serious buyers only. Contact via Session.

Sample
Update:For sale lionair.co.id webshell access

https://apb.lionair.co.id/apb/