Case 019 — Third Eye Activator: Brazilian Supplement Scam
AtomicAt VSL Funnel · Fake Social Proof · Fake Doctor · CartPanda Checkout

The AtomicAt funnel JavaScript exposes a plaintext page descriptor that was never meant to be visible to visitors. The string "pageName":"🟠 IG - PAGINA DE VENDA CNN - THIRD EYE ACTIVATOR" appears in the first script block of LkuvYh0444359.js, served from BunnyCDN at path /pv/js/.

"PAGINA DE VENDA" is Portuguese for "Sales Page". The operator is Brazilian, building funnels in Portuguese for a product sold in USD to English-speaking markets. "IG" confirms Instagram as the paid acquisition channel. "CNN" is appended to the internal label — a reference to CNN-style fake news advertorials used as the Instagram ad creative, a known dark pattern for health supplement funnels. CNN branding is not present on the live page but the internal label reveals the ad format.

The JWT-encoded mcp_token in the entry URL was decoded and contains the operator's AtomicAt publisher ID (pid: 5268768) and subscriber tracking ID (sid: 1401923890). The token has an exp field set to 1790201670 (2026-08-24) — it was issued as expired but the server does not validate expiry server-side: the page still loads and delivers full content.

The "558 Watching now" counter displayed prominently on the funnel page is not a real viewer count. The AtomicAt JavaScript initializes the counter from a data-min / data-max HTML attribute pair and then randomizes it every 0–3 seconds using a PRNG function. The counter drifts by ±5 to ±7 per tick, staying bounded between 400 and 700 — values chosen to appear plausibly real without being verifiably false.

This is a documented dark pattern called manufactured social proof. No server-side user count exists. No WebSocket or SSE connection is opened. The number is computed locally in the visitor's browser and means nothing.

The funnel's purchase buttons are hidden using the CSS class .atomicat-delay and only revealed once the Converteai Video Sales Letter has been watched for 2,790 seconds — 46 minutes and 30 seconds. This is controlled by the variable delaySeconds = 2790 in the AtomicAt player integration script.

The VSL player is hosted by Converteai (a Brazilian VSL-as-a-service platform), using CloudFront distribution in eu-central-1 / eu-west-1 — EU-region served. The video stream is an HLS M3U8 at cdn.converteai.net/de140fdb-281f-47cb-847f-0ad61ba607e8/6a0e115f3882ab3cd0666f43/main.m3u8.

This technique is a textbook sunk-cost psychological trap. After investing 46 minutes listening to the VSL narrative about fluoride, pineal glands, and "what the government tried to hide", the viewer is emotionally primed. The buy button appearing at exactly that moment is not coincidental — it is the designed conversion trigger. The choice state is also persisted to localStorage under key alreadyElsDisplayed2790, meaning returning visitors bypass the gate on subsequent visits.

Third Eye Activator makes eight distinct medical and health-adjacent claims on the funnel page, none of which are authorized under EU Regulation 1924/2006 (the EU Health Claims Register) and none backed by clinical evidence. The claims include disease-modification framing ("Undo decades of fluoride damage"), physiological claims ("Hormones balanced, fat melting away"), and paranormal claims ("Feel what's about to happen before it actually happens", "Spot a lie before they even open their mouth").

The operator uses the pseudonym "Dr Phill" as the meta author field (<meta name="author" content="Dr Phill">) — a deliberate phonetic near-match to the public figure Dr. Phil McGraw, calculated to trigger medical credibility associations. No medical credentials, no license number, no country of practice is cited anywhere on the page.

No FDA disclaimer ("These statements have not been evaluated by the Food and Drug Administration") was found anywhere in the 52KB HTML document. For EU-targeted consumers, no disclaimer referencing EFSA evaluation or Regulation 1924/2006 compliance is present either.

Every layer of the Third Eye Activator operation is built on Brazilian SaaS platforms. The funnel builder, VSL host, analytics platform, and payment processor are all Brazilian-operated services. This creates a scenario where an EU consumer, seeing what appears to be an English-language health product, is actually transacting through a Brazilian payment chain with no EU consumer protection mechanisms in the flow.

The checkout domain bottlesthirdeyeactivator.com was registered on 2026-04-28 — 39 days before unlockyourthirdeye.fun (2026-06-06). This indicates the checkout infrastructure was prepared before the funnel domain, suggesting a reusable checkout setup supporting multiple concurrent funnels. CartPanda's checkout headers expose the visitor's precise geolocation (city, lat/lon, postal code, region, timezone) — collected server-side before the consumer has agreed to any purchase.

While this operation does not involve malware or active C2, it exhibits structured deception techniques that map to the MITRE ATT&CK framework's social engineering and initial access categories. The combination of fake social proof, a 46-minute psychological conditioning loop, a fabricated medical authority persona, and unsupported health claims constitutes a coordinated consumer fraud operation.

EU regulatory exposure is significant: the funnel is accessible from EU countries, processed through an EU Cloudflare edge (FR1 CDN node), and the Converteai VSL is served from AWS eu-central-1. EU consumer protection directives apply regardless of the operator's Brazilian location.

Frame-by-frame analysis of the 59-minute Converteai VSL stream (888 HLS segments, publicly accessible at cdn.converteai.net/de140fdb.../6a0e115f.../video_0.m3u8) confirms the video is not original content. It is an AI-edited compilation built from three source types: (1) stolen real Joe Rogan Experience footage, (2) footage of an unidentified JRE guest used without consent, and (3) AI-generated cinematic b-roll injected to support the conspiracy narrative.

Segment 15 (~01:00 runtime): Joe Rogan himself is visible in the lower half of a split-screen — bald, headphones, white shirt, seated at the JRE mic. The red neon "ROGAN" lettering from the JRE studio set is visible behind him. A brain MRI with pineal gland highlighted occupies the top half. The AI-dubbed voiceover says "does look identical" — implying Rogan is discussing the pineal gland supplement. He is not. His audio has been removed and replaced.

Segments 1, 6, 8, 9 (~00:02 – 00:36 runtime): A gray-haired male JRE guest appears repeatedly as the apparent "neuroscience authority." The JRE studio is unmistakable: red acoustic panels, Shure SM7B-style boom mic, professional headphones. This guest's original speech has been stripped and replaced with an AI voice selling "Third Eye Activator." Their face and credibility are being exploited without consent.

Segment 7 (~00:28 runtime): A visually distinct AI-generated scene depicts an actor wearing a "CIA" badge — teal color grading, cinematic staging, stylized props. This is AI video generation (HeyGen / Sora / Runway-class tool), not real footage. It supports the VSL narrative that "an insider at the CIA" discovered the pineal gland secret. This AI fabrication is presented seamlessly alongside the stolen real JRE footage — blurring the line between real and fabricated for viewers.

The original JRE audio throughout the entire VSL has been replaced. The replacement voice uses consistent AI speech synthesis characteristics: no breath normalization artifacts, flat dynamic range within paragraphs, and identical cadence across topic shifts. Audio analysis of segment 0 (WAV decode: 44.1kHz stereo, 3.989s) showed 0% pure silence windows — consistent with AI TTS output which fills silence with low-level noise rather than true silence.