The debt-relief page offers an agreement reference with a peculiar ending: two empty fields. Its code builds the reference in the browser, then tries to divide eight characters into more fields than they can fill.
That small defect connects pages impersonating Desenrola Brasil, a government debt-relief programme. The same function appears in different captured pages and in public source code. Another copy keeps the broken reference as fixed text, even though it no longer performs the calculation. The error helps us follow what was reused as the pages changed.
Eight characters, two empty fields
The pages ask for a CPF, Brazil's individual taxpayer identifier. A function
called codeFromCPF uses that input to make the agreement reference. For this
value, the page does not wait for a lender to return an agreement number.
The function calculates a short sequence of letters and digits, then pads it to eight characters. Next, it tries to divide that text into four fields. The first field takes five characters. The second gets the remaining three. Nothing is left for the third or fourth, but the code still adds their separators.
The opening screen, 24th October 2026, 11:14:50 UTC, cropped before data entry. The diagram explains its source code, not a completed browser interaction. X characters illustrate field lengths. Screenshot and diagram sources.
The reference can change when the supplied CPF changes, yet it always has this broken shape. We established that from the preserved function, without submitting a CPF. It explains how the page can produce a reference on its own; it does not establish what its separate lookup or payment services do.
The same function in different pages
The pages at brdesenrola[.]site, desenrolaacesso[.]xyz, and
portaldenoticias[.]sbs contain the same 281-byte function. We compared
those bytes directly. The complete pages differ, but the code that generates
their agreement reference is identical.
That gives the comparison a firmer basis than the shared debt-relief promise. The connection is in the implementation, including the mistake it repeats. Other parts of the pages can change while this small piece remains intact.
A search for Desenrola source also found the function in a public GitHub repository. We checked the file associated with a push that GitHub recorded on 8th October 2026. It contains the same function as the retained page source. This places matching code in a dated repository record before the selected 21st–24th October captures.
The video provides a second connection. The repository's file inventory lists a video with the same size and content-derived Git identifier as the complete video retained by Sandfish. This comparison uses saved video bytes and repository metadata, rather than a fresh download of the repository video.
Together, these matches show that the reused material was obtainable as public source. They do not identify its original author or show that the captured sites copied from this particular repository. Public availability makes software copying a concrete explanation for the relationship.
A copy keeps the error without the function
A second repository preserves the malformed reference with a simpler implementation.
Its saved version of script.js has no codeFromCPF function.
Instead, four messages contain the fixed reference X1JI4-7KN--. Names and CPF
fields remain variable, but the agreement reference is ordinary text.
The same two empty fields are still there. So are the R$68.92 offer and the claim of a 99% agreement discount. The surrounding content remains related even though the reference no longer depends on the calculation.
This is not another exact function match. Someone could have reconstructed the page from rendered content or used another source copy. The files do not tell us which route produced this version.
What they do show is that the malformed reference can survive independently of the code that calculates it. It has become part of the copied presentation.
What the defect lets us follow
The agreement reference connects these pages at the software level. In one comparison, the function itself matches. In another, related content retains the error through a different implementation. Both are more informative than a shared logo, but they describe different forms of reuse.
The broken reference therefore explains two things: how the page creates its apparent agreement reference, and how that detail persists in other copies. It does not identify who ran the sites or received their payments. The useful finding is that even a small defect can remain recognizable as the surrounding page changes.
Source notes
The comparison ledger supplies source links, exact digests, and the retained GitHub event fields. The compact 281-byte functions match without normalization. Separate formatted variants require the comparisons stated there.
The calculation produces an unsigned 32-bit number and converts it to base 36, which uses digits and letters. That value needs at most seven characters; padding makes eight. The four output fields therefore have lengths 5, 3, 0, and 0.
The matching video has 3,992,950 bytes. Its calculated Git object digest and size equal the pinned repository tree's record. The repository video was not downloaded. We retrieved the repository records on 24th October 2026; their recorded push time is distinct from that retrieval and Git-controlled author dates. Later research captures support artifact comparisons and do not enter attack-arrival counts.