sync: auto-sync from GURU-BEAST-ROG at 2026-07-16 10:22:46

Author: Mike Swanson
Machine: GURU-BEAST-ROG
Timestamp: 2026-07-16 10:22:46

clients/valleywide/session-logs/2026-07/2026-07-16-winter-orders-breach-check-remediation.md

@@ -73,3 +73,9 @@ Created Syncro ticket #32557 for Valley Wide Plastering Inc (customer 31694734)
 - Bot alerts: message_ids 1527360784940798073 (ticket create), 1527361632278286386 (billing)
 - Raw artifacts: /tmp/remediation-tool/5c53ae9f-7071-4248-b834-8685b646450f/user-breach/Orders_valleywideplastering_com/
 - Prior related log: clients/valleywide/reports/2026-06-29-offboarding-teresa-carpio.md
+
+## Update: 10:25 AZ — Tenant-wide sweep + ticket update
+
+Winter asked whether other mailboxes showed similar activity. Ran tenant-sweep.sh (30d, all 36 enabled users): device-join fingerprint (Auth Broker -> Intune Enrollment/Device Registration) appears ONLY on the orders@ 7/2 event — all other device registrations came from office IP 4.18.160.106 or known AZ IPs (7/14 DESKTOP-2R13CC4 by j-r@ = legit, office IP). Zero successful non-US sign-ins tenant-wide (658 rows, complete). Ongoing password spray, ALL FAILED: rose@ 74+ x 50053 lockouts (CA,CN,DE,JP,NG,NL,SE), estimating@ 6, guest jr@casarica.net 6, jesse@/ryan@/j-r@ 2 ea (50126/50053) — none reached MFA stage, no correct passwords. Failed-signin data capped at 999 rows (counts are floors). rose@ had zero successful sign-ins in 30d — spray got nothing.
+
+Posted customer-visible comment (id 424048380, email ON per Winter) to #32557 summarizing sweep results. Bot alert 1527364806699516016. Friction logged: comment POST response failed jq parse despite tr strip; comment had posted — GET-verify-first rule prevented a duplicate. Sweep artifacts: /tmp/remediation-tool/5c53ae9f-7071-4248-b834-8685b646450f/sweep/