A promise of financial relief opens the journey: renegotiate debts with discounts of up to 99%. The page uses the Desenrola Brasil name and offers a button to get started. Behind that presentation, the implemented flow requests the visitor's CPF (Brazilian individual taxpayer identifier), provides for a personal-data lookup through an external service and directs the visitor to an automated conversation with a supposed representative of the program.
That journey leads to a PIX payment request for R$ 68,92.
Between October 25 and 26, I recorded five hostnames responding with HTTP 200 and titles related to Desenrola Brasil. Examining their resources made it possible to reconstruct the site's intended sequence without submitting forms or completing payments. That distinction defines the scope of this investigation: I documented web availability and client-side logic, not a completed financial transaction.
This investigation identifies a specific set of pages available on those dates and describes how they combine presentation, personal data, simulated assistance and a payment request.
Five Pages and a Shared Technical Foundation
The hostnames recorded as available were:
- desenrolahoje[.]shop
- contaemdiahojedesconto[.]shop
- descontoshojequitar[.]shop
- novodescontofacil[.]shop
- desenrola-brasil-d8c8032026[.]netlify[.]app
The four .shop domains resolved to 88.80.17.232, associated in the investigation with AS33837, PRQ. The Netlify hostname resolved to AWS infrastructure used by that service.
The examined resources included CSS, JavaScript and images whose SHA-256 hashes matched historical records from the case. These matches identify identical files and establish links between the material served by the pages. They do not, on their own, determine whether there is a single operator, a template distributed among third parties or a copy of an earlier implementation.
The shared IP address provides another technical link, although it does not prove common ownership or responsibility on the part of the hosting provider. An HTTP 200 response also does not guarantee that all subsequent steps worked: it establishes that the servers delivered content during the check.
CPF as the Entry Point to a Personalized Interaction
The “ACESSAR AGORA” button leads to /findex/. The /findex/index-1 variant was also recorded on the Netlify hostname.
The form identified as cpfForm is configured to query api[.]amnesiatecnologia[.]lat using the entered CPF and a fixed token included in the client. The token value is omitted from this publication.
If the response contains the name expected by the code, the application saves the name, CPF and date of birth in localStorage under the keys site.nome, site.cpf and site.nasc. It then constructs a redirect to /chat/ that includes the CPF and name in the URL and preserves UTM campaign parameters.
This sequence explains how the page could turn an identifier entered by a visitor into an apparently personalized conversation. Recognizing the visitor's name can reinforce the credibility of a fake assistance service, although it does not establish that a legitimate debt inquiry is taking place.
No CPFs were submitted to the service during this investigation. The API's response, the origin of its data and the accuracy of any information it might return were therefore not verified. What is documented is the integration provided for in the code.
Personal identity data also becomes part of the navigation: the design places the CPF and name in the destination address and retains them in the browser. This exposure warrants attention because of their potential presence in browsing histories and logs; it does not demonstrate that every tracking system loaded by the page received those data.
Simulated Assistance Leading to a Payment Request
The /chat/ route requires a CPF and name, obtained from the URL or local storage. When they are missing, it displays an incomplete-data notice and announces a return to the start page.
With those values available, the code starts a simulated conversation with the “Leticia” avatar, presented as “Atendente do Programa Desenrola Brasil”. The page title is “Desenrola Brasil — Atendimento”.
The sequence combines the program's visual identity, automated messages and an agreement code derived deterministically from the CPF. This last element can create an impression of personalization, but its local generation does not establish that a negotiation with a creditor has taken place or that a valid agreement exists.
The configured PIX amount is R$ 68,92. The page loads a library for rendering QR codes and the pix_service.js file, which contains the integration intended to request the transaction.
The finding describes an implemented capability. No test PIX payment request was generated, and no victim was observed completing the journey.
An External Gateway at the Transaction Stage
The PixService class references api-gateway[.]techbynet[.]com. Its createTransaction method prepares a POST request to /api/user/transactions and provides for authentication through the x-api-key header. The code also references the string AtivoB2B/1.0 as a User-Agent; its presence in the file does not mean it was observed being transmitted by the browser.
The public documentation identified at docs[.]techbynet[.]com describes that endpoint. Its examples mention SomosSimpay as a downstream provider in the processing chain.
These elements show how the application intends to separate the visitor-facing page from transaction creation. They do not establish which account would receive the money, which provider would process a specific payment or whether the request would be accepted.
Nor was it established that the page operators had exclusive control of the gateway or the personal-data API. A reference from a site under investigation does not demonstrate that the referenced service knowingly participated in the scheme.
Marketing Tracking and the Appearance of a Business
The pages included references to Google Analytics, the utmify pixel, and scripts or destinations at nuescalador[.]info and subdomains of lovable[.]app. The recorded identifiers include G-XXNP83W053 and pixel 6a5d71a4a5544029c22493bf.
These values can be used to compare pages and track implementation changes. They become more useful when they match alongside other elements, such as identical files, routes and content. In isolation, they do not conclusively identify a person or make all infrastructure on a shared platform malicious.
The page footers displayed CNPJ 67.940.187/0001-84 and the registered company name CLARA CHALITA SERVICOS DE MARKETING DIRETO LTDA. The observation is limited to their appearance in the content: it was not verified that the company had authorized that use or operated the sites. Copying a business identity can also be part of a deceptive presentation.
Implications for Fraud Prevention
For someone seeking to renegotiate a debt, a personalized conversation is not a guarantee of authenticity. A page that knows a name, presents a supposed agreement and displays a QR code may still be unrelated to the program and the creditor. Verification should use official channels obtained independently, not links provided by the page under investigation itself.
For banks, fraud teams, SOCs and CTI teams, the case calls for considering the signals together: impersonation of a public program, CPF collection, external identity lookup, simulated assistance and a payment request.
Domains, hashes and tracking identifiers provide comparison points for detecting replicas. Transaction records and beneficiary identification would be needed to move from a chain specified in code to a reconstruction of the actual flow of funds.
Shared infrastructure requires precision. A conclusion about one landing page should not be extended to all users of Netlify, AWS, an analytics platform or a gateway. Analysis must retain the context, date and observed role of each indicator.
Method and Sample Scope
The investigation covers October 25 and 26, 2026. It used DNS queries, low-impact HTTP requests and a review of client-side content and resources. There was no exploitation, form submission or payment.
The five hostnames constitute the available sample at that point in time, not a measurement of the operation's total size. Other names in the initial set did not resolve or did not respond during the check; that result does not demonstrate a permanent shutdown.
Actual retrieval of personal data, transaction creation and PIX settlement were not confirmed. No victims, losses, ultimate beneficiaries or responsible actor were identified either.
The central result is a documented technical chain: available pages that reuse resources and whose code connects a promise of debt renegotiation with personal data, simulated assistance and a payment request. Continuity of the same operator over time remains unproven.
Sources and Materials
The case evidence comes from the author's own investigation described in this article.
Domains are defanged to prevent accidental access. Tokens, keys and personal parameters are excluded.
Authorship
Ezequiel Jorge La Terra
Cyber Threat Intelligence LATAM
ORCID 0009-0008-1677-4218
How to Cite
La Terra, E. J. (2026). Desenrola Brasil: investigation into an active campaign. Cyber Threat Intelligence LATAM.
Case Summary
Country: Brazil.
Method: impersonation of a public program and a PIX payment request.
Observation dates: October 25 and 26, 2026.
Available sample: five hostnames.
Configured amount: R$ 68,92.
Attribution: not established.
Payments and settlement: not verified.