---
title: Hunt: the Brazilian Magecart group behind the Convertr skim posts pipe-delimited card records to short .is domains; check self-hosted Plausible for /storybook hits and a modified tracker | ctxsec
url: https://ctxsec.com/items/hunt-convertr-magecart-1x0-is-plausible-storybook
description: ""
status: "threat research (Sansec IOCs, Oct 26-27)"
published: 2026-10-27
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-convertr-magecart-1x0-is-plausible-storybook.md)

threat research (Sansec IOCs, Oct 26-27)

2026-10-27

### Hunt: the Brazilian Magecart group behind the Convertr skim posts pipe-delimited card records to short .is domains; check self-hosted Plausible for /storybook hits and a modified tracker

From Sansec's analysis of the [Convertr skim](/items/convertr-plausible-tracker-magecart-skimmer-brazil-oct-24):

1. **Network:** POSTs to `https://1x0.is/ws` (also `/ws/<base64>`) sent with `mode: "no-cors"` and `keepalive`. Earlier exfiltration domains of the same group: `snf.is`, `anl.is`, `nmn.is`, `eqp.is`, `shy.is`, `blz.is`, `tray.is`, `xwv.is`, `kk.land`, `kof.one`, `xsox.diy`, `miorl.net`, `fasthook.app`, `antiddos-protection.net`, plus some Discord webhooks.
2. **Payload shape:** a base64 record of `card|month|year|CVV|CPF|name|tag`, ending in a short victim tag (`ctr` for Convertr). Older builds post to PHP endpoints with Portuguese names such as `cartao.php` and `pagamento.php`, and some variants swap the PIX QR code for the attacker's own.
3. **File and strings:** the infected file was `/js/script.pageview-props.tagged-events.js` (SHA-256 `ee4618d24737eff785e5a267b55903d5ef6ff7ecbeb099347a67fee77734d7f7` on Oct 26). In scripts, look for `indexOf('checkout.convertr')` and `String.fromCharCode(...)` followed by `(0,eval)` appended after legitimate code.
4. **If you self-host Plausible CE:** upgrade to 3.2.1 or later, search access logs for requests to `/storybook`, and compare `priv/tracker/js/` against the official release. If you find hits, rebuild the server and rotate its secrets. Any third-party script served from your own infrastructure onto checkout pages deserves file-integrity monitoring and a CSP `connect-src` allowlist.

Sources: [Sansec: Notorious Brazilian Magecart group hijacks Convertr checkouts via Plausible analytics (Oct 26, updated Oct 27)](https://sansec.io/research/convertr-plausible-supply-chain-attack)