# Storefront comparison: sources and method

Prepared on 26th October 2026 from the closed investigation. Captures and archive
files were reviewed on 24th October. This note supports
[the storefront article](https://sandfi.sh/blog/magalu-storefront-shared-backend).

## Recorded lookups and cart requests

The ten complete resolver responses came from one Supabase project,
`opsgyzuojnswtwlrqzoi`. Each returned hostname matched the captured storefront.
The table uses aliases for the exact returned tenant identifiers. The links
open stored network records, not the investigated storefronts.

Times below are UTC in October 2026. They date the resolver response. Each cart
request followed the resolver in the same capture. Repeat observations of
`novidadedasemana[.]com` and `obterrdescontoss-app[.]com` account for ten rows
across eight hostnames.

| Hostname | Tenant | Resolver response time | Stored lookup | Stored cart request |
|---|---|---|---|---|
| `descontosfimdeano[.]com` | A | 7th Oct 00:37:01.716486 | [Lookup](https://sandfi.sh/analyses/3559ad98-8571-41d2-93e7-cd8ef8f7b6c5?tab=network&request=956ae45e-6bcd-48e9-a276-0a0a0a9f98d6) | [Cart](https://sandfi.sh/analyses/3559ad98-8571-41d2-93e7-cd8ef8f7b6c5?tab=network&request=0801f38f-2498-4b30-8b82-fe5562904ed4) |
| `cupomexclusiivoo-app[.]com` | A | 11th Oct 08:09:37.655507 | [Lookup](https://sandfi.sh/analyses/7b828c70-9933-4bf4-aa0a-cd6a93615aa9?tab=network&request=89917c32-1db1-40ed-8451-f2055144023d) | No cart write observed |
| `novidadedasemana[.]com` | A | 17th Oct 06:44:57.224737 | [Lookup](https://sandfi.sh/analyses/785756a0-ca6b-4de7-94dc-06854f0a85e9?tab=network&request=d37157ef-d29b-4b86-ae4e-b57d29374876) | [Cart](https://sandfi.sh/analyses/785756a0-ca6b-4de7-94dc-06854f0a85e9?tab=network&request=7ad250f8-e496-4f53-a173-2013efedac22) |
| `novidadedasemana[.]com` | A | 20th Oct 16:22:56.627238 | [Lookup](https://sandfi.sh/analyses/9a649065-b700-43d4-8e1f-120c9fe7fa4f?tab=network&request=3694a990-8bbf-4097-bd14-bfda932ff3cc) | [Cart](https://sandfi.sh/analyses/9a649065-b700-43d4-8e1f-120c9fe7fa4f?tab=network&request=b7ae9463-5226-40c6-93b8-1def9a18c746) |
| `promoconfiiraoffftododiaa-app[.]com` | B | 14th Oct 12:14:29.393690 | [Lookup](https://sandfi.sh/analyses/8f8c2080-467e-441c-88ed-8e42f4cbe457?tab=network&request=97710202-a9d4-4956-999f-24ce4a41a08c) | [Cart](https://sandfi.sh/analyses/8f8c2080-467e-441c-88ed-8e42f4cbe457?tab=network&request=3a5b90d7-6806-4721-aeb3-335e17c29fe5) |
| `obterrdescontoss-app[.]com` | B | 19th Oct 06:47:35.874408 | [Lookup](https://sandfi.sh/analyses/f8c5e8e6-9d01-40a5-ab5f-2cede6f46015?tab=network&request=71940f30-e492-4f62-9787-3869ec5ac7b3) | [Cart](https://sandfi.sh/analyses/f8c5e8e6-9d01-40a5-ab5f-2cede6f46015?tab=network&request=430c9cae-ee0d-4f9f-8408-699285dc9070) |
| `obterrdescontoss-app[.]com` | B | 20th Oct 07:01:03.278835 | [Lookup](https://sandfi.sh/analyses/606ecdb9-1a5b-41ab-8c67-e2422efa5dca?tab=network&request=40f2004a-ac78-4065-9216-ef2a0d8b459f) | [Cart](https://sandfi.sh/analyses/606ecdb9-1a5b-41ab-8c67-e2422efa5dca?tab=network&request=090e0deb-46b6-4945-bbd7-f7ce64d319cd) |
| `osmelhores-descontos[.]com` | C | 16th Oct 20:07:44.569041 | [Lookup](https://sandfi.sh/analyses/4ff69990-0205-4fc7-8dd7-b451e0f19d16?tab=network&request=9272e09c-1a5a-4e88-8976-09fbba045deb) | [Cart](https://sandfi.sh/analyses/4ff69990-0205-4fc7-8dd7-b451e0f19d16?tab=network&request=32f0531b-779a-40f4-869b-942b3aa57d51) |
| `confiiraquiiofftodasemana[.]com` | D | 22nd Oct 16:57:18.578772 | [Lookup](https://sandfi.sh/analyses/ac8872c3-3b29-4299-b9d6-42f0a7c7822d?tab=network&request=547b8090-ff90-46de-9156-ad19204d14c7) | [Cart](https://sandfi.sh/analyses/ac8872c3-3b29-4299-b9d6-42f0a7c7822d?tab=network&request=d8aad71f-c351-4c69-b5f8-b1b985ff882b) |
| `retiradamagalu[.]com` | E | 22nd Oct 21:12:57.990371 | [Lookup](https://sandfi.sh/analyses/091d1228-b666-46e3-ba76-c558ef576ba9?tab=network&request=84daffa4-3e6f-4237-b3b9-0f5f06b87289) | [Cart](https://sandfi.sh/analyses/091d1228-b666-46e3-ba76-c558ef576ba9?tab=network&request=45a66485-5841-447a-9be6-d3e3f61afad1) |

The cart POSTs target `/rest/v1/cart_items`. All nine complete request bodies
contain `tenant_id`, `user_id`, `product_id`, and `quantity`. Each tenant value
equals the preceding lookup result. All nine responses have HTTP status 201.
This note exports field names and equality, not shopper values.

| Alias | Exact tenant identifier |
|---|---|
| A | `323fad74-f0bf-4828-9a11-6dbe414b4040` |
| B | `557ec0bc-ecf5-48eb-aa72-2b38695e1ad3` |
| C | `1ec19979-4b76-4d02-b053-5526b4fa85f9` |
| D | `35a43dc1-3860-4571-a970-4f4b9ec5e6a6` |
| E | `caea6c42-3299-41a8-a578-8556c893dffb` |

These are configuration identifiers. They do not count customers, operators,
completed purchases, or victims.

## Application and control files

The [22nd October application](https://sandfi.sh/analyses/091d1228-b666-46e3-ba76-c558ef576ba9?tab=network&request=d6e1a692-d89b-4a39-9264-fb8daecaf05c)
has 693,116 decoded UTF-8 bytes and SHA-256
`fdf1855fdc85901ae87369651ef0dd5af464a776f7006d2fe794d45dd60b8906`.

The [Promegaofers archive](https://urlquery.net/report/d5987e23-3422-4b9a-a9a9-6e3de279b6a8?tab=javascript)
dates from 8th October 2026. Script 8, `/assets/index-BVTCSt4v.js`, has 691,925
decoded bytes and SHA-256
`179f59c5263280f8c262f9c5191130def96dbb7a5b30fd59d83ef2c43574c5eb`.
It contains the exact shared image URL, but names project `vgwoegmybeincutmqyua`.
It lacks the original project identifier and resolver markers. Image bytes
were not retrieved. This tests the selected complete script, not every possible
component or historical version of that site.

Two URLQuery reports from 15th September preserve an earlier application:
[script 5 in report 8079be9a](https://urlquery.net/report/8079be9a-8110-4761-8e67-1df6ae6e477a?tab=javascript)
and [script 15 in report 1c3c9d78](https://urlquery.net/report/1c3c9d78-d35c-4e2e-a0c7-b70088f92a0d?tab=javascript).
Both match the [same-day Sandfish file](https://sandfi.sh/analyses/24d13dff-b3f2-44fd-baac-9086823f40da?tab=network&request=06276dd8-73aa-4108-bbae-0464560be148):
682,498 bytes, SHA-256
`0a00d1cf353aacb6940fbeeb7d5a60dc150434c350636046211a601ea9156752`.
The archive comparison decodes HTML character references and encodes the source
as UTF-8. It applies no whitespace or line-ending normalization. These earlier
files match each other, not the October file.

## Screenshot source

The product panel comes from [snapshot 882485e4](https://sandfi.sh/api/analyses/091d1228-b666-46e3-ba76-c558ef576ba9/page-snapshots/882485e4-e835-4cc2-83d4-4ae19677c8e4/screenshot),
captured on 22nd October 2026 at 21:13:02 UTC. It precedes the matching cart
request. The button label `Comprar` means Buy. The image illustrates the
product controls; the request records establish the backend relationship.

The original image was retrieved on 27th October and has SHA-256
`19b3d526634a4b5f0e2014af4bcf25bce738d3f33cacb98da27d3f67174a4306`.
The published crop starts at x=0, y=565 and measures 412 by 274 pixels. It
removes the header and blank product-image area. No entered values occur in
this crop. WebP encoding uses quality 86. The output SHA-256 is
`332c787513f8caa90b8ee865ebafea5edb38df5ddd97782e1cdd0b154d7f4800`.

## Figure construction

`request-sequence.svg` uses the final row's resolver and cart records. The cart
request time is 22nd October 2026, 21:13:04.974099 UTC. Four boxes show request
order. E replaces the tenant UUID. Shopper values and unrelated requests are
omitted. The figure is a diagram, not a screenshot or a new execution.

## Provenance

The retained investigation ledger is `brazil-2026-10-24-actor-cross-cohort.md`,
SHA-256 `c9310c9ef58f651f8927f040a7c573ef05f7e2cbec08971973b72d93a53649bb`.
The public archive links above identify the underlying evidence. This source
note selects the storefront findings and does not expand their scope.