Howard Enos 52e625f102 report: Cascades Tucson phishing sweep - deleted 14 phish across 7 users ...

Triggered by John Trozzi reporting a spoof email. Single-user check
confirmed him clean (reported, not compromised). Tenant-wide sweep
found a sustained ~1 month campaign from 4 external IPs (UA/US/DE/AT
- deltahost + ColoCrossing) plus a compromised-M365-tenant relay
vector. Deleted 14 messages (Groups A+B) per Mike's explicit
authorization. Preserved legitimate HR thread (HRPYDBRUN xlsx) and
user outbound forwards as evidence.

Recommendations in report: DMARC p=quarantine/reject for
cascadestucson.com (biggest leverage), TABL IP blocks, zoom.nl
URL block, Defender impersonation protection.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-04-20 09:39:22 -07:00

.claude

chore: add Ollama Tier 0 routing — delegate low-stakes work to local models

2026-04-19 18:55:50 -07:00

api

Add TickTick integration, MCP server, and dev project tracking

2026-03-31 10:08:53 -07:00

clients

report: Cascades Tucson phishing sweep - deleted 14 phish across 7 users

2026-04-20 09:39:22 -07:00

docs

Reorganize repo: compartmentalize scripts by client/project

2026-03-20 17:15:07 -07:00

fleet

Add show notes HTML for March 28 broadcast and OC-Mac diagnostic

2026-03-29 16:58:51 -07:00

infrastructure

Reorganize repo: compartmentalize scripts by client/project

2026-03-20 17:15:07 -07:00

mcp-servers

Add TickTick integration, MCP server, and dev project tracking

2026-03-31 10:08:53 -07:00

migrations

Add TickTick integration, MCP server, and dev project tracking

2026-03-31 10:08:53 -07:00

projects

sync: auto-sync from DESKTOP-0O8A1RL at 2026-04-20 08:05:31

2026-04-20 08:05:34 -07:00

scripts

Session 2026-03-30: SOPS vault, SC-Syncro sync, Syncro scripts

2026-03-30 19:38:38 -07:00

session-logs

session: Mac GuruRMM agent deployment + Grabb & Durando user provisioning started

2026-04-20 08:04:27 -07:00

temp

sync: auto-sync from Mikes-MacBook-Air.local at 2026-04-19 19:34:27

2026-04-19 19:34:27 -07:00

Test Datasheets

AD2 session 2026-03-27/28/29: Test datasheet pipeline rebuild

2026-03-29 17:48:37 -07:00

tests

feat: Major directory reorganization and cleanup

2026-01-18 20:42:28 -07:00

tmp

scc: NWTOC v5.0 - fix test exe deployment, session log

2026-03-16 18:55:48 -07:00

tools

Add session import tool + fix audit gaps (GrepAI, Ollama, MCP, settings)

2026-04-16 19:21:01 -07:00

.env.example

Complete Phase 6: MSP Work Tracking with Context Recall System

2026-01-17 06:00:26 -07:00

.gitignore

sync: auto-sync from ACG-TECH03L at 2026-04-18 14:28:21

2026-04-18 14:34:04 -07:00

.gitmodules

fix: Restore .gitmodules for gururmm submodule

2026-04-19 08:30:51 -07:00

.mcp.json.example

feat: Add Sequential Thinking to Code Review + Frontend Validation

2026-01-17 16:23:52 -07:00

ai-misconceptions-reading-list.md

sync: Auto-sync from ACG-M-L5090 at 2026-02-09

2026-02-09 20:24:03 -07:00

alembic.ini

sync: Auto-sync from Mikes-MacBook-Air.local at 2026-03-09 08:14:13

2026-03-09 08:14:13 -07:00

ANALYSIS_COMPLETE.md

feat: Complete DOS update system with test data routing fix

2026-01-19 12:49:54 -07:00

AUTOCODER_INTEGRATION.md

feat: Add Sequential Thinking to Code Review + Frontend Validation

2026-01-17 16:23:52 -07:00

BEHAVIORAL_RULES_INTEGRATION_SUMMARY.md

feat: Complete DOS update system with test data routing fix

2026-01-19 12:49:54 -07:00

CATALOG_CLIENTS.md

sync: Auto-sync from ACG-M-L5090 at 2026-01-26 16:45:54

2026-02-01 16:23:47 -07:00

CATALOG_PROJECTS.md

sync: Auto-sync from ACG-M-L5090 at 2026-01-26 16:45:54

2026-02-01 16:23:47 -07:00

CATALOG_SESSION_LOGS.md

sync: Auto-sync from ACG-M-L5090 at 2026-01-26 16:45:54

2026-02-01 16:23:47 -07:00

CATALOG_SHARED_DATA.md

sync: Auto-sync from ACG-M-L5090 at 2026-01-26 16:45:54

2026-02-01 16:23:47 -07:00

CATALOG_SOLUTIONS.md

sync: Auto-sync from ACG-M-L5090 at 2026-01-26 16:45:54

2026-02-01 16:23:47 -07:00

CLIENT_DIRECTORY.md

sync: Auto-sync from ACG-M-L5090 at 2026-01-26 16:45:54

2026-02-01 16:23:47 -07:00

CONTEXT_RECOVERY_PROMPT.md

fix: Remove all emojis from documentation for cross-platform compliance

2026-01-20 16:21:06 -07:00

CONTEXT.md

Add CONTEXT.md files for automatic context recovery

2026-04-14 20:45:46 -07:00

CREDENTIAL_AUDIT_2026-01-24.md

sync: Auto-sync from ACG-M-L5090 at 2026-01-26 16:45:54

2026-02-01 16:23:47 -07:00

CREDENTIAL_GAP_ANALYSIS.md

sync: Auto-sync from ACG-M-L5090 at 2026-01-26 16:45:54

2026-02-01 16:23:47 -07:00

credentials.md

credentials.md: add Uranus entry, note IP reuse on Saturn

2026-04-16 09:07:43 -07:00

DEPLOYMENT_CHECKLIST.txt

feat: Complete DOS update system with test data routing fix

2026-01-19 12:49:54 -07:00

DEPLOYMENT_GUIDE.md

feat: Complete DOS update system with test data routing fix

2026-01-19 12:49:54 -07:00

DOS_FIX_INDEX.txt

feat: Complete DOS update system with test data routing fix

2026-01-19 12:49:54 -07:00

FILE_DEPENDENCIES.md

Add deployment safeguards to prevent code mismatch issues

2026-01-18 15:13:47 -07:00

GREPAI_OPTIMIZATION_GUIDE.md

sync: Auto-sync from ACG-M-L5090 at 2026-01-22 19:22:24

2026-01-22 19:23:16 -07:00

GREPAI_OPTIMIZATION_SUMMARY.md

sync: Auto-sync from ACG-M-L5090 at 2026-01-22 19:22:24

2026-01-22 19:23:16 -07:00

GREPAI_SYNC_STRATEGY.md

docs: Add Mac sync guide and grepai sync strategy

2026-01-22 19:06:45 -07:00

GURURMM_API_ACCESS.md

docs: Add comprehensive project documentation from claude-projects scan

2026-01-22 09:58:32 -07:00

IMPORT_COMPLETE_REPORT.md

sync: Auto-sync from ACG-M-L5090 at 2026-01-26 16:45:54

2026-02-01 16:23:47 -07:00

IMPORT_VERIFICATION.md

sync: Auto-sync from ACG-M-L5090 at 2026-01-26 16:45:54

2026-02-01 16:23:47 -07:00

INITIAL_DATA.md

fix: Remove all emojis from documentation for cross-platform compliance

2026-01-20 16:21:06 -07:00

MAC_SYNC_PROMPT.md

docs: Add Mac sync guide and grepai sync strategy

2026-01-22 19:06:45 -07:00

MCP_INSTALLATION_SUMMARY.md

feat: Add Sequential Thinking to Code Review + Frontend Validation

2026-01-17 16:23:52 -07:00

MCP_SERVERS.md

docs: Add comprehensive project documentation from claude-projects scan

2026-01-22 09:58:32 -07:00

NEW_MACHINE_SETUP.md

Switch Gitea remotes from SSH to HTTPS for reliable access

2026-03-13 06:10:29 -07:00

ORGANIZATION_SETUP_COMPLETE.md

Complete project organization: move all DOS files to projects/dataforth-dos, create client folders, update Claude config

2026-01-20 16:03:00 -07:00

package-retrieved.json

docs: Document Dataforth test database system and troubleshooting

2026-01-21 16:38:54 -07:00

PHASE1_QUICK_SUMMARY.txt

Complete Phase 6: MSP Work Tracking with Context Recall System

2026-01-17 06:00:26 -07:00

PHASE3_TEST_REPORT.md

fix: Remove all emojis from documentation for cross-platform compliance

2026-01-20 16:21:06 -07:00

PROJECT_DIRECTORY.md

sync: Auto-sync from ACG-M-L5090 at 2026-01-26 16:45:54

2026-02-01 16:23:47 -07:00

PROJECT_ORGANIZATION.md

Complete project organization: move all DOS files to projects/dataforth-dos, create client folders, update Claude config

2026-01-20 16:03:00 -07:00

PROJECTS_INDEX.md

docs: Add comprehensive project documentation from claude-projects scan

2026-01-22 09:58:32 -07:00

QUICKSTART-retrieved.md

docs: Document Dataforth test database system and troubleshooting

2026-01-21 16:38:54 -07:00

requirements.txt

sync: Auto-sync from Mikes-MacBook-Air.local at 2026-03-09 08:14:13

2026-03-09 08:14:13 -07:00

save_session_context.json

[Config] Add coding guidelines and code-fixer agent

2026-01-17 12:51:43 -07:00

SESSION_NOTES-retrieved.md

docs: Document Dataforth test database system and troubleshooting

2026-01-21 16:38:54 -07:00

session-context.json

Remove conversation context/recall system from ClaudeTools

2026-01-18 19:10:41 -07:00

START_HERE.md

fix: Remove all emojis from documentation for cross-platform compliance

2026-01-20 16:21:06 -07:00

UPDATE_WORKFLOW.md

feat: Complete DOS update system with test data routing fix

2026-01-19 12:49:54 -07:00

VPN_QUICK_SETUP.md

feat: Add AD2 WinRM automation and modernize sync infrastructure

2026-01-19 14:28:24 -07:00

WORKITEMS.md

sync: auto-sync from DESKTOP-0O8A1RL at 2026-04-18 08:06:57

2026-04-18 08:06:59 -07:00

Description

Custom Claude Code behaviors and workflows - Multi-mode operation system

3.2 GiB

Languages

Python 27.8%

QuickBASIC 15.5%

PowerShell 15.1%

JavaScript 12.5%

omnetpp-msg 11.6%

Other 17.5%