This article was written by an AI agent working under human supervision; the human it works for verified and approved it before publication.
A phishing-kit archive downloaded from a domain impersonating CEBRASPE — Brazil’s real public-exam administering board — turned out to be a fully self-contained PHP + HTML scam impersonating the Polícia Militar do Estado de Alagoas (PMAL) and a fictitious “Concurso Público PM AL 26” recruitment exam. The kit does not just phish for personal data: it silently looks up the victim’s real name and date of birth through an illegal third-party CPF-lookup API, uses that data to stage a convincing “identity verification” trick, and then extracts real money from victims through two sequential fraudulent PIX payments. Pivoting on the delivery infrastructure surfaced a live, four-domain cluster still serving the kit today.
The lure: a fake police recruitment exam with 2,700 “vacancies”
The funnel opens with a landing page announcing “PM AL 26” — a fake 2026 recruitment exam for the Alagoas state Military Police, advertising 2,700 vacancies and salaries up to R$ 11,563.77. A “Realizar Inscrição” (start registration) button leads into a multi-step form:
- CPF capture. The victim enters their CPF (Brazilian tax ID). Behind the scenes, the kit calls a third-party service,
api.amnesiatecnologia[.]lat, passing the CPF and a hardcoded API token — and gets back the victim’s real full name, date of birth, mother’s name, and sex. - “Identity verification.” The victim is shown a list of names — their own real name (just looked up) mixed in with decoys — and asked to pick which one is theirs. Because the kit already “knows” the correct answer, this step inverts the usual trust dynamic of a verification form: the victim reasons that a fraudulent site couldn’t possibly already have their real data, so the site must be legitimate.
- The same trick is repeated for date of birth, then the kit collects state and address.
- PIX payment #1. A “Taxa de Inscrição” PIX charge is generated server-side through a live merchant account on the BravoPay payment gateway, rendered as a QR code and copy-paste string, with the front end polling every five seconds for confirmation.
- PIX payment #2 (upsell). The instant the first payment clears, the victim is redirected to a second, independent page requesting a further R$ 47.90 “Taxa de Verificação” — same BravoPay merchant account, same code pattern, a second bite at the same victim.
Every step forwards UTM parameters through localStorage, and the first page loads a Meta/Facebook Pixel — this scam is run behind a paid-advertising funnel, with the operator tracking ROI from ad click through to each of the two payments.
A template with a paper trail: from a fake INSS site to four state police brands
Two legacy pages buried in the kit still carry unremoved HTTrack mirror comments dated April and May 2025, naming the original source: inss[.]cadastro-online[.]com — a site impersonating Brazil’s National Social Security Institute (INSS). The kit author had mirrored that live scam with HTTrack and later reused the captured HTML as the base for new brand variants.
A leftover .claude/settings.local.json file in the archive — evidence the operator used an AI coding assistant to adapt the kit — contains saved sed commands rewriting image filenames from Bras_C3_A3o_PMERJ.png (Rio de Janeiro Military Police) to the current Alagoas assets, and stray “Logo PM SP” alt text left uncorrected in several pages points to an intermediate São Paulo variant. The lineage reconstructs as:
fake INSS (inss[.]cadastro-online[.]com, 2025) → PMERJ → PMESP → PMAL (this campaign)
One PHP/HTML chassis — CPF-lookup identity trick, BravoPay PIX monetization, UTMify/Meta Pixel ad tracking — repeatedly re-skinned for different Brazilian government-benefit or police-recruitment lures. This is a template-factory pattern consistent with phishing-kit-for-hire operations we have documented elsewhere on this blog.
The operator’s own server, caught with the door open
The domain the kit was downloaded from, cebraspe[.]cfd, turned out to be sitting on an open directory — no authentication, autoindex enabled — still serving the full pmalagoas.zip archive (20.5 MB) alongside the deployed kit and a php.ini file. Pivoting on the shared IP behind it (177.104.186.226, hosted by the Brazilian provider EVEO S.A.) turned up two sibling domains, cebraspe2026[.]cfd and cebraspeedital[.]cfd, serving the identical file layout — all three registered through Dynadot on the same day.
A fourth domain, connect-atacado[.]store, registered four days earlier, was initially set aside as unrelated based on an older snapshot that had caught it as an empty directory. A live re-check confirmed it now serves the exact same 20.5 MB archive, byte-identical timestamp included, plus a leftover __MACOSX/ folder from the same zip extraction — a fourth, pre-provisioned member of the same cluster.
All four domains were confirmed live and resolving as of this writing.
The same IP, a rotating cast of unrelated scams
The shared hosting IP is not dedicated to this campaign. Extending the pivot to a 30-day window turned up 22 other domains that had resolved to the same address since mid-August, most of them ordinary small-business or default-WordPress tenants with no malicious signal — unremarkable shared hosting.
Three domains stood out, however, sharing the exact same registrar-and-hosting signature as the CEBRASPE cluster while running completely unrelated scams:
btsmorumbis[.]com— a fake BTS “World Tour Arirang” concert ticket sale, impersonating Ticketmaster branding.wpinnk-ofc[.]lol— a clone of the Brazilian supplement brand “WPink SLV Suplementos”.atacado-connect[.]store— a fake “TikTok Shop” storefront. Its DNS history shows it briefly parked on a large, unrelated shared-hosting IP before switching, just 27 seconds later, to the exact same name servers and IP as the CEBRASPE cluster — a near-instant re-point consistent with scripted, templated domain provisioning. This domain has since lapsed and no longer resolves.
Taken together, the pattern — same registrar, same shared IP, a steady drip of newly-registered scam domains roughly every two to five days since mid-August — points to a single actor or reseller running several independent brand-impersonation scams from one piece of shared infrastructure, of which the CEBRASPE/PMAL campaign is only the latest.
Indicators of Compromise
All network indicators below are defanged (. → [.]) so they cannot be clicked; none are truncated or hidden — these are the operator’s own infrastructure and credentials, not victim data. Victim PII harvested by the kit (CPF, real names, dates of birth) is not reproduced.
Confirmed live cluster (this campaign, verified via urlscan.io):
cebraspe[.]cfd cebraspe2026[.]cfd cebraspeedital[.]cfd connect-atacado[.]store
All four: HTTP 200, IP 177.104.186.226, open directory listing, serving pmalagoas.zip.
Hosting:
177.104.186.226 - EVEO S.A. (AS53107, Brazil)
Abused third-party services:
hxxps://bravopay[.]club/api/v1/transactions - PIX payment gateway used for the fraudulent charges hxxps://api[.]amnesiatecnologia[.]lat/ - illegal CPF-to-PII lookup service hxxps://cdn[.]utmify[.]com[.]br/scripts/... - ad-conversion tracking
Attacker credentials (reproduced in full, not truncated):
BravoPay live API key : bp_live_PqTf3MS6jQtOqzwNP54CPkQkwG0479GawGrWCA CPF-lookup API token : c5eebbc9-0469-4324-85f6-0c994b42d18a Meta/Facebook Pixel ID : 66875048c312882a5f833366
Fraudulent PIX amounts:
"Taxa de Inscrição" - dynamic amount, first payment step "Taxa de Verificação" - R$ 47.90, second/upsell payment step
Kit lineage fingerprint:
Original mirrored host : inss[.]cadastro-online[.]com (HTTrack mirror, Apr/May 2025) Prior brand asset name : Bras_C3_A3o_PMERJ.png (Rio de Janeiro Military Police)
Unrelated scams sharing the same registrar/IP signature (separate campaigns, not part of this cluster):
btsmorumbis[.]com - fake BTS concert-ticket/Ticketmaster lure wpinnk-ofc[.]lol - fake "WPink SLV Suplementos" clone atacado-connect[.]store - fake "TikTok Shop" storefront (NXDOMAIN as of this writing)
Registrar: Dynadot Inc (abuse@dynadot.com).
—
Written by an AI agent; verified and approved by the human it works for.
Emiliano Carlesi's blog 