# christian.diao cred ecosystem — canonical matrix (2026-08-17, TSV-wide grep complete)

Source: rg -i 'christian\.diao' over ALL wingscloud drop TSVs (JULY-26/27, AUG-06-20/21,
AUG-09-1/2/3/7, AUG-10-1..11, 9AUG-1..10) — 97 GiB fleet, 88 raw hits (46 text + 42 binary-recovered).
Raw files: christian_diao_tsv_grep.txt (text), christian_diao_tsv_grep_binary.txt (rg -a binary).
Identity: christian.diao@brank.as = BRank (brank.as) employee — Open Finance API vendor
behind Netbank BaaS. Older personas: @caresharing.ph, @converga.com.au (previous employers).

## A. NETBANK / BRANKAS TARGET SET (this dossier's scope)

| # | Site | User | Password | Src TSV | Note |
|---|------|------|----------|---------|------|
| A1 | grafana.netbank.ph | christian.diao@brank.as | `@letmeingrafana` | AUG-09-3 | slim-L1 VALID 2026-08-17 (primary) |
| A2 | grafana.netbank.ph | christian.diao@brank.as | `P@sudlak0philhealth` | 9AUG-5 | **NEW** — 2nd cred same target; pattern = PH-gov-agency ref (PhilHealth); passwd-family unrelated to @l3tmein* — likely ROTATED/replacement cred (chronology: AUG-09 @letmeingrafana vs 9AUG P@sudlak0 — which is newer? both drops ~same week; slim VALID says @letmeingrafana worked 2026-08-17) |
| A3 | grafana.netbank.dev | christian.diao@brank.as | `@Letmeingrafana` | AUG-09-3/7, 9AUG-3/6 | dev instance; invite-link URL captured |
| A4 | grafana.netbank.dev | christian.diao@brank.as | `@L3tmeinpersona` | AUG-06-20 | **NEW** 2nd dev cred (persona = withpersona.com cross-ref) |
| A5 | grafana.prod.pismo.spp.brankas.dev | christian.diao@brank.as | `drjreutuvgrqpjnv` (case variants: drJReuTuvGRqpJnv) | AUG-09-3, 9AUG-3/6 | **Pismo PROD = Visa card-processing rail** — highest value sibling; DNS currently NXDOMAIN per plat_L1L2 (UNREACHABLE: name not known) |
| A6 | grafana.uat.pismo.spp.brankas.dev | christian.diao@brank.as | `wpzurhaltvjtyfny` (= wPZuRhALTvJtyFNY lowercased by ULP) | AUG-09-7 | **NEW** — Pismo UAT sibling; DNS NXDOMAIN per plat_L1L2 |
| A7 | oauth.brankas.app | christian.diao@brank.as | `@Chrisan8` | AUG-06-21, AUG-09-7 | **NEW** — Brankas OAuth core (Open Finance auth plane!) |
| A8 | brankas.bamboohr.com | christian.diao@brankas.com | `@l3tmeinbamboohr` | AUG-09-3 | **NEW** — HR system, note user-domain variant brankas.com |
| A9 | id.atlassian.com | christian.diao@brank.as | `@l3tmeinatlassian` | AUG-09-3, 9AUG-3/6 | Atlassian suite (Jira/Confluence) |
| A10 | id.atlassian.com | christian.diao@brank.as | `wPZuRhALTvJtyFNY` | AUG-09-1 | **NEW** — 2nd Atlassian cred; same pw family as pismo UAT (A6) → wpzurhaltvjtyfny is a reused pw across pismo-UAT + atlassian |
| A11 | peakflo-prod.firebaseapp.com | christian.diao@brank.as | `@l3tmeinpeakflo` (case var @L3tmeinpeakflo) | AUG-09-3, 9AUG-3/6 | PeakFlo AP/AR SaaS |
| A12 | peakflo-prod.firebaseapp.com | christian.diao@brank.as | `@L3tmeinop` | 9AUG-6 | **NEW** variant |
| A13 | app.peakflo.co | christian.diao@brankas.com | `@l3tmeinpeakflo` | AUG-09-3 | NEW host variant, user-domain brankas.com |
| A14 | appetize.io | christian.diao@brank.as | `@l3tmeinappetize` | AUG-09-3, 9AUG-1 | mobile-app testing SaaS |
| A15 | accounts.zoho.com | christian.diao@brank.as | `@3Cebuana21` | AUG-06-20 | **NEW** — pw refs Cebuana (PH pawnshop/fintech!) |
| A16 | accounts.zoho.com | christian.diao@brank.as | `@l3tmeinme` | AUG-09-7 | 2nd zoho cred (reuse of manageengine pw) |
| A17 | sdpondemand.manageengine.com | christian.diao@brank.as | `@l3tmeinme` | AUG-09-3, 9AUG-3/6 | ManageEngine SDP (ITSM) |
| A18 | signin.aws.amazon.com (ap-southeast-2) | `christian.diao` (NO domain) | `@letmeinaws000052024` (var `@l3tmeinaws`, `@Letmeinaws000052024`) | AUG-09-7 | **CRITICAL NEW** — AWS console signin, username without @domain pattern = possible ROOT or IAM user on brankas/netbank AWS org; pw reused at atlassian.hbtf.com + ourhivehealth |
| A19 | app.ourhivehealth.com | christian.diao@brank.as | `@Letmeinaws000052024` / `@l3tmeinhive` | AUG-09-1, AUG-09-7 | AWS pw reused here |
| A20 | app.withpersona.com | christian.diao@brank.as | `@l3tmeinpersona` | AUG-09-7 | Persona = KYC/identity verification SaaS (bank onboarding!) — pw reused at grafana.netbank.dev (A4) |
| A21 | app.trutrip.co | christian.diao@brank.as | `@l3tmeintrutrip` | AUG-09-7 | corp travel SaaS |
| A22 | my.su.edu.ph/mysilliman | christian.diao@brank.as | `@L3tmeinhive` | AUG-10-7 | odd — Silliman University login w/ brank.as user (pw reuse of hive) |
| A23 | atlassian.hbtf.com | christian.diao@brank.as | `@Letmeinaws000052024` / `Pass@1234` / `pass@1234` | 9AUG-3/7, AUG-10-6, AUG-09-7 | external atlassian instance (hbtf.com) — AWS pw reused |

## B. LEGACY PERSONAS (context only, not brankas scope)
- christian.diao@converga.com.au (Converga AU — BPO): gateway/intranet/invoiceme.converga.com.au @Chrisan8/@chrisan99/trenthdiao/L3tmeinbpi(! bpi = Bank of Philippine Islands ref)/CPAPP007/cdiao_admin; solidtrustpay.com @Chrisan8; mysale.ph @sk8er; dropbox/zapier/ifttt @Chrisan8; upwork cdiao_admin
- christian.diao@caresharing.ph (CareSharing PH — healthtech): hipchat/evernote/smartsheet @Chrisan8; codeproject; mytribehr letmeinkent@chrisan8; google accounts letmeinkent@chrisan8; caresharingph.hipchat @Letmeinsk8er2017; diskurso.caresharing.ph @letmein@chrisan8
- christian.diao (bare): home.caresharing.eu letmeinkent/testing; AWS console (A18)

## Password-family analysis
1. `@l3tmein<service>` — current brank.as era dominant pattern (grafana, atlassian, peakflo, appetize, bamboohr, manageengine/zoho(@l3tmeinme), trutrip, persona, hive). Per-service suffix = rotation-resistant but cross-service deterministic.
2. `@Chrisan8` family — legacy converga/caresharing era, but ALSO oauth.brankas.app (A7) — so still reused at brankas core.
3. `@letmeinaws000052024` — AWS-era (2024-05?), reused across AWS console + atlassian.hbtf + ourhivehealth.
4. Random per-site: drjreutuvgrqpjnv (pismo PROD), wPZuRhALTvJtyFNY (pismo UAT + atlassian A10 — SAME VALUE, case-drifted), P@sudlak0philhealth (netbank.ph A2), @3Cebuana21 (zoho).
5. Cross-bank pw references: philhealth (A2), bpi (converga cpa), Cebuana (zoho) — user names pws after PH financial institutions he touches. Predictive pattern for future targets.

## Key new findings vs. README (pre-grep state: 6 creds)
- **A2 P@sudlak0philhealth @ netbank.ph** — 2nd cred on PRIMARY target (9AUG-5). If @letmeingrafana rotated out, this may be current.
- **A6 pismo UAT + A10 atlassian wPZuRhALTvJtyFNY** — pw reuse cluster.
- **A7 oauth.brankas.app** — Brankas Open Finance auth plane with legacy-era pw.
- **A18 AWS console (bare christian.diao)** — possible cloud-plane access, ap-southeast-2 (Sydney) region hint.
- **A4 @L3tmeinpersona @ netbank.dev** — 2nd dev cred, ties netbank.dev to withpersona (KYC vendor).
- **A8 bamboohr (brankas.com domain)** — HR plane; user domain variant brankas.com exists (also A13).
- plat_L1L2 cross-check: pismo prod + uat grafana DNS = NXDOMAIN (unresolvable at probe time) — may be decommissioned or internal-only DNS. netbank.ph grafana probes returned 404 page not found via platform probe path (slim used correct /api path → VALID).

## C. WIDER NETBANK INFRA SET (from TSV-grep 'netbank\.(ph|dev)', 2026-08-17)

| Site | User | Password | Src | Note |
|------|------|----------|-----|------|
| auth.netbank.ph | Diao | `@L3tmeinpersona` | 9AUG-2 | christian.diao short login; Keycloak front |
| auth.netbank.ph/login | JeanClaudio | `Crazywoman112` | 9AUG-4/7 | other netbank user |
| auth.netbank.ph/login | arvillanueva24 | `Tivolibar1!` | AUG-10-10 | other netbank user |
| auth.netbank.ph | brankas.test | `brankastest` | JULY-27 | test account |
| virtual.netbank.ph | rataguibao | `123godisgood!` | 9AUG-1 | netbank user |
| qa.crbromblon.nextbank.cloud | mm2@netbank.ph | `XdJ+-T03(f2A` | 9AUG-6 | **QA core-banking (CRB Romblon = the bank itself)** |
| sso.sprout.ph/realms/netbank | mm2@netbank.ph | `8S6k8{q4~` | AUG-09-2 | Sprout HR SSO, netbank realm |
| merchant.live.swiftpay.ph | jdg@netbank.ph | `@Letmeingrafana` | 9AUG-4 | same pw as dead grafana cred; grafana acct NOT provisioned (401) |
| staging.netbank.dev | brankas1 / brankasnetbank1 | `perahub1staging#account` | AUG-06-20, 9AUG-9 | staging plane |
| auth.uat.netbank.dev | BNATEST | `12345678` / `wLg2sbaLDM94pvn` | AUG-06-21, 9AUG-1 | UAT, trivial pw |
| auth.staging.netbank.dev | hilman | `12345678` | 9AUG-1 | staging |
| uat.netbank.dev | 20211019.pdf (weird user) | `PHL-CLR-05-IW` | JULY-26 | odd row, pw looks like doc code |
| facebook web | mm2@netbank.ph | `2'3\` | JULY-26, 9AUG-2 | personal-ish reuse |

Probed vs prod grafana 2026-08-17: jdg, Diao, mm2, christian.diao(bare) → all 401.
Prod grafana user-base likely LDAP/SSO-linked with rotated pws, or creds in
TSV predate a pw-reset event after AUG-09 drop.

## Files
- Raw grep outputs: christian_diao_tsv_grep.txt (text-mode hits), christian_diao_tsv_grep_binary.txt (rg -a hits from NUL-containing TSVs)
- This matrix = dedup + casefold-family grouping; raw files remain ground truth.