INVESTIGACAO FORENSE 21/07 — PIX manual R$200k x2 para JF Consultorias
Conta debitada: Core account 2627 = conta institucional da propria MONETARIE SCD (dono user 2583 murilo@monetarie.com.br)
Autor: marco.brazil@monbank.net (pix-admin user_id 100; Core platform_admin f33ae4a7 "MARCO AURELIO MONTENEGRO BRAZIL", criado 2026-07-17, status pending_mfa_setup)
Host origem: 10.50.4.151 = EC2 i-0127c0d13bfc3e8a7 "monbank-vpn-interna-prod" (VPN interna MonBank)
Browser: Firefox 152 / Windows 10
Canal: tela envio manual pix-admin /transactions/new -> POST /api/v1/transactions (pipeline :api SEM plug de auth — gap)
19:48:59 LOGIN_FAILED 401
19:49:09 LOGIN OK marco.brazil@monbank.net uid100
19:52:01 CREATE TRANSACTION 201 R$200.000 -> JF ISPB 02038232 ag3315 cc554324 => LIQUIDADO (E46026562202607201952kmxwrabwzgd, msg 14753, TB DDA4C483..., settled 19:54:03 via camt.054)
19:56:21 VIEW PIX_KEY DICT 58269513000182
19:57:06 CREATE TRANSACTION 201 R$200.000 -> JF ISPB 05203605 ag1 cc554324 => REJEITADO (E460265622026072019562j7sk6c3u7y, msg 14785)

=== TEDs (SPB) — nao liquidaram ===
TED R$432.000 NumCtrlIF MON20260720957753618 STR0008 state=r1_rejected (BACEN rejeitou R1); debtor cc7686 ag1 core_account 2627 "MONBANK MONETARIE SOCIEDADE DE CREDITO DIR" -> JF ISPB 02038232 ag3315 cc554324; nu_op 46026562202607207848636; sent 2026-07-20 19:35:58Z (16:35 BRT); tela "Em analise manual"
TED R$738.000 NumCtrlIF MON20260720757109907 STR0008 state=failed; debtor cc526000050 ag001 core_account 2630 "Monetarie Soc de Credito Direto" -> JF ISPB 02038232; nu_op 46026562202607205275356; created 2026-07-20 19:25:15Z; tela "Criada"

=== AUTORIA ===
pix-admin monetarie_auth.audit_logs (IP 10.50.4.151, Firefox 152/Win10):
 19:48:59Z LOGIN_FAILED 401
 19:49:09Z LOGIN OK login=marco.brazil@monbank.net uid=100
 19:52:01Z CREATE TRANSACTION 201 R$200k #1 (liquidou)
 19:56:21Z VIEW PIX_KEY DICT JF 58269513000182
 19:57:06Z CREATE TRANSACTION 201 R$200k #2 (rejeitou)
10.50.4.151 = EC2 i-0127c0d13bfc3e8a7 "monbank-vpn-interna-prod"
Core platform_admin f33ae4a7 = marco.brazil@monbank.net "MARCO AURELIO MONTENEGRO BRAZIL" criado 2026-07-17 status pending_mfa_setup
Core platform_admin 044f7e23 = admin@monetarie.com "Gabriel Cardoso" (Chrome, SISBAJUD/tesouraria)
spb-admin acessado do mesmo 10.50.4.151 (Firefox /admin/messages + Chrome 150 /operator)
Conta debitada 2627 = conta institucional MONETARIE SCD (dono user 2583 murilo@monetarie.com.br)

=== CONTENCAO MED 2.0 ===
recovery BACEN id=94889900-4bf7-477e-9d51-c6a8e10530bd status=AWAITING_ANALYSIS reporter=46026562 maxHops=2 maxTransactions=5 hopWindow=PT2H minTx=0.01 situationType=FRAUDULENT_ACCESS
CorrelationId A20260721110334914460265620BFD75; POST dict.pi.rsfn.net.br 2026-07-21 14:03:07Z; succeeded_external

=== ORIGEM REAL (VPN Pritunl) ===
IP publico real Marco = 200.155.150.126 (Telium Telecomunicacoes Ltda CNPJ 07.272.054/0001-55 BR)
VPN user marco-brasil (Pritunl id 6a4ea090ef394bd940392c5c) org monbank-interno server monbank-prod; MFA otp+pin
log: 2026-07-20 17:27:02 200.155.150.126:18977 TLS auth deferred user marco-brasil; 2026-07-21 10:59:25 200.155.150.126:58881
Concentrador VPN = EC2 i-0127c0d13bfc3e8a7 monbank-vpn-interna-prod (Ubuntu/Pritunl) 10.50.4.151
GAP: backend/audit registra ALB (10.50.1.133/166) ou VPN box (10.50.4.151), nunca o IP publico real -> corrigir XFF+correlacao VPN
Admin Marco criado 2026-07-17 15:59:29 pending_mfa_setup (cadastro pelo time Monetarie)

=== CONTENCAO 2 (marcador de fraude) ===
fraud marker BACEN id=5ce23971-3942-4762-bd1d-aa0505946a31 status=REGISTERED fraudType=SCAMMER_ACCOUNT taxId=58269513000182 reporter=46026562 cid=A20260721111848240460265623F4530 2026-07-21 14:18:48Z
NOTA: participant no XML = reportante (46026562), NAO o ISPB da conta; passar o ISPB da conta da 400