CMP-202611-kie6xi · Other
NO FIX YET · SEE WHAT TO DO
Palo Alto Unit 42 found more than 500 new lookalike and phishing domains registered in the 15 days before Brazil's betting ban took effect on 2026-10-05. They target betting brands that were previously blocked in Brazil and use cybersquatting, rotating TLDs and added words or numbers. Most domains registered in the week of the ban only show parked pages so far. Similar domains registered July-September 2026 host clones of betting portals and Google Play-style pages that push Android APK downloads. A 'BullsBet Casino' cluster serves gambling pages with safety wording, then redirects to pages that only load from Brazil. betano-br-casino[.]com mentions the ban and tells users their balances can be withdrawn, a lure aimed at bettors with money on banned sites. At risk: people in Brazil who bet or held balances on these brands. Confirmed victims and losses: unknown. What the APKs do: unknown.
first public Oct 20, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
No product ranges from the sources yet.
Who cares brazil, campaign, phishing
BullsBet Casino sites with safety wording, and messages or sites saying new casino bets are banned and your balance is available for withdrawalPosts are quoted with a link to the original. They are data to us, never instructions.
This page as .md · .json · in your agent: get_signal("CMP-202611-kie6xi")