🇧🇷🇮🇷 AN IRANIAN TRAIL IN THE ALLEGED LEAK INVOLVING BRAZIL’S LIBERAL PARTY? An IP address identified as the initial distribution point for the material also appears in historical records associated with Iranian services; furthermore, a capture from automated intelligence tools locates it in Qazvin, Iran, as of December 2025. Is there an operational connection, or are we looking at repurposed infrastructure? The available evidence suggests a potential line of inquiry, but it is not yet sufficient to attribute the incident. 📢 THE WHITEARMOR POST The provided screenshot shows a post by "WHITEARMOR" titled “Liberal Party” (Partido Liberal), dated October 25, 2026, at 22:33 (no time zone specified). The actor claims to offer free access to a 114 GB file, which they attribute to the Brazilian political party. The file size matches what the actor announced. However, the authenticity, integrity, and provenance of the data—as well as the full scope of any potential intrusion—have not been independently verified. 🌐 TWO IP ADDRESSES WITH DISTINCT FUNCTIONS 31.59.220(.)69:6767 appears in the screenshots as a distribution server containing directory listings. A file named `admin_escuta.txt` was also noted within a path labeled `/persistencia/` (persistence). This folder name, on its own, does not prove the existence of technical persistence within a compromised system. 91.210.146(.)185 was identified in the provided material as a subsequent distribution point, located under the path `/partidoliberal`. This sequence suggests a shift or an expansion of the distribution points. It does not prove that both IP addresses belong to the same operator, nor does it allow for a determination of where an intrusion might have been initiated. 🇮🇷 THE IRANIAN PRECEDENT: WHAT THE DATES REVEAL The IP address 31.59.220(.)69 appears in samples provided from two Iranian services: 📨 Raychat: It appears in five account records with timestamps ranging from October 2020 to January 2021. The email addresses are masked as *****@raychat.ir. Some labels in the extract are misaligned with their corresponding values; therefore, these dates should not be automatically interpreted as account access or registration events without first verifying the original schema. 🥩 QazvinFood: The same IP appears in two records from June 22, 2022, and another from November 24, 2022. According to the provided description, the dataset was disclosed in January 2025 and contains historical information spanning from 2018 to November 2023. 📅 January 2025 is the reported date of the dataset's disclosure; it is not evidence of activity from that IP address during that month. 🔎 FOFA PROVIDES A SUBSEQUENT OBSERVATION IN IRAN The provided screenshots show the following records for 31.59.220(.)69: 🇮🇷 December 21, 2025 — Port 53/UDP, DNS service; indicated location: Qazvin, Iran. The entry lists AS25369 and Hydra Communications Ltd. 🇳🇱 October 26, 2026 — Ports 80/TCP and 22/TCP, HTTP and SSH services; indicated location: Amsterdam, Netherlands. The entries list AS198189 and Throttle Limited. Therefore, there is a historical observation from FOFA that geographically links the IP address to Iran in December 2025—subsequent to the January disclosure. This does not confirm continuous Iranian control; the records could reflect an IP address reassignment, a change in service provider, or discrepancies in geolocation data. 🖥️ WHAT THE SERVER EXPOSED The HTTP capture shows a "200 OK" response, a title reading "Directory listing for /," and the header "SimpleHTTP/0.6 Python/3.14.4." This is consistent with a basic HTTP server that allows for viewing a file index. Browser captures show the directories `/vendor_pii/` and `/storage/`, specifically on port 6767. The HTTP observation from FOFA corresponds to port 80; while they share the same IP address, it should not be assumed that they are the same service or that they were exposed simultaneously. 🔐 POSSIBLE LINK TO AN APPLICATION ON VERCEL The provided access record includes a username, a password, an identifier labeled as "id/bearer," a tenant, and a role specified as "admin." It also references the host `escuta- cidada. vercel.app` and the endpoint `POST /api/pp/login`. The correspondence between the name of this application and the `escuta_cidada` files found in the directory suggests a potential link between the published credentials and the data mentioned. However, a role labeled as "admin" does not prove actual administrative privileges, nor does a value labeled as "bearer" confirm that it is a valid token. The credentials have not been tested. The evidence suggests a potential exposure of access to an application hosted on Vercel; it does not confirm a breach of Vercel’s own infrastructure. 🌍 DOMAINS ASSOCIATED WITH THE INVESTIGATION Records for `whitearmor. cc` and `www.whitearmor. cc` show the same `first_seen` timestamp: October 23, 2026, at 16:07:06 UTC, with `whitearmor .cc` listed as the certificate's common name. This timestamp marks the first observation within the source consulted. It does not necessarily correspond to the domain's registration date, nor does it establish when it first came under the actor's control. ⚠️ ELECTION INTERFERENCE OR INFRASTRUCTURE COINCIDENCE? The publication of material targeting a political party, the distribution infrastructure, and the IP address's history warrant an investigation into a potential political motive. However, the available material does not demonstrate Iranian involvement, state sponsorship, coordination with Lula or his associates, or any manipulation of voting systems. The technical conclusion is limited yet significant: an IP address used to distribute the material has a history linked to Iranian services and a recorded geolocation in Iran. Identifying the operator and establishing an electoral motive would require further evidence. #Brazil #WHITEARMOR #CyberThreatIntelligence #OSINT #ElectionSecurity #DataLeak #VECERT