{"id":"CMP-202611-kie6xi","kind":"campaign","aliases":[],"related":[],"title":"Fake betting sites copy brands banned in Brazil (Betano, Bullsbet, Pixbet and others) to phish bettors and push Android APKs after the 5 Oct 2026 betting ban (Unit 42)","description":null,"summary":"Palo Alto Unit 42 found more than 500 new lookalike and phishing domains registered in the 15 days before Brazil's betting ban took effect on 2026-10-05. They target betting brands that were previously blocked in Brazil and use cybersquatting, rotating TLDs and added words or numbers. Most domains registered in the week of the ban only show parked pages so far. Similar domains registered July-September 2026 host clones of betting portals and Google Play-style pages that push Android APK downloads. A 'BullsBet Casino' cluster serves gambling pages with safety wording, then redirects to pages that only load from Brazil. betano-br-casino[.]com mentions the ban and tells users their balances can be withdrawn, a lure aimed at bettors with money on banned sites. At risk: people in Brazil who bet or held balances on these brands. Confirmed victims and losses: unknown. What the APKs do: unknown.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["brazil","campaign","early-warning","phishing"],"not_affected_if":[],"how_to_check":"Match links, sender domains and DNS logs against these domains (Unit 42). Registered 2026-10-01: betano-br-casino[.]com, betfair-slots-brasil[.]com, betfury-crypto-casino-brasil[.]com, blaze-br-slots[.]com, brazino777-casino-brasil[.]com, bullsbet-app-brasil[.]com, bullsbet-br-app[.]com, bullsbet-br-betting[.]com, esportes-da-sorte-betting-brasil[.]com, h2bet-casino-brasil[.]com, novibet-br-app[.]com, pixbet-betting-brasil[.]com, superbet-br-betting[.]com. Registered 2026-10-02: bulls-bet[.]org, bullsbetcasino[.]com[.]br. Lures: 'BullsBet Casino' sites with safety wording, and messages or sites saying new casino bets are banned and your balance is available for withdrawal. Also look for a Google Play-style page offering a betting app as an APK download. Unit 42 lists only a sample; the rest of the 500+ domains are not published.","fix":"Do not enter logins, card or Pix details, or ID documents on these sites, and do not install betting apps from APK links. Use only the operator's official, authorized site or the Play Store. If you entered details, change the password and contact your bank. Block the listed domains on DNS and in mail filters.","status":"open","published_at":null,"first_seen_at":"2026-11-04T18:26:38+00:00","triaged_at":"2026-11-04T18:26:38+00:00","updated_at":"2026-11-04T18:27:55+00:00","category":"other","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-05':67B '-10':66B '-202611':31A '15':55B '2026':25A,65B,109B '42':29A,42B '5':23A '500':46B 'add':84B 'aim':163B 'alto':40B 'android':19A,123B 'apk':20A,124B,191B 'balanc':157B,180B 'ban':6A,27A,61B,96B,152B,169B 'bet':2A,26A,60B,70B,113B,177B 'betano':9A,146B 'betano-br-casino':145B 'bettor':16A,165B 'block':75B 'br':147B 'brand':5A,71B,183B 'brazil':8A,33B,58B,77B,144B,175B 'bullsbet':10A,127B 'campaign':34B 'casino':128B,148B 'clone':111B 'cluster':129B 'cmp':30A 'com':149B 'confirm':184B 'copi':4A 'cybersquat':80B 'day':56B 'domain':51B,89B,104B 'download':125B 'earli':36B 'early-warn':35B 'effect':63B 'fake':1A 'far':102B 'found':43B 'gambl':131B 'googl':116B 'held':179B 'host':110B 'juli':107B 'july-septemb':106B 'kie6xi':32A 'load':142B 'lookalik':48B 'loss':187B 'lure':162B 'mention':150B 'money':167B 'new':47B 'number':87B 'oct':24A 'other':13A 'page':100B,120B,132B,139B 'palo':39B 'park':99B 'peopl':173B 'phish':15A,38B,50B 'pixbet':11A 'play':118B 'play-styl':117B 'portal':114B 'previous':74B 'push':18A,122B 'redirect':137B 'regist':52B,90B,105B 'risk':172B 'rotat':81B 'safeti':134B 'septemb':108B 'serv':130B 'show':98B 'similar':103B 'site':3A,170B 'style':119B 'target':69B 'tell':154B 'tlds':82B 'took':62B 'unit':28A,41B 'unknown':188B,193B 'use':79B 'user':155B 'victim':185B 'warn':37B 'week':93B 'withdrawn':160B 'word':85B,135B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":[],"ptokens":[],"labels":["brazil","campaign","earlywarning","medium","other","phishing"],"campaign_type":"phishing","first_public_at":"2026-10-20T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-kie6xi","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-04T18:26:38+00:00","fetched_at":"2026-11-04T18:26:38+00:00","note":null}],"documents":[{"id":69013,"url":"https://x.com/Unit42_Intel/status/2118037105041416253","title":"@Unit42_Intel: Brazil's betting ban on 2026-10-05 triggered a proliferation of typosquatting an","kind":"post","source":"x","publisher":null,"text":"Brazil's betting ban on 2026-10-05 triggered a proliferation of typosquatting and phishing domains. Focusing on services previously banned in Brazil, we found over 500 new domains registered in the 15 days before the ban. Details at https://t.co/wEy9nRRXTD https://t.co/CLxzYDRg36\n\nlikes 3 reposts 1","published_at":"2026-11-04T17:46:11+00:00","relation":"describes","confidence":null,"note":null},{"id":69246,"url":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-20-phishing-sites-proliferation-related-to-Brazil-betting-ban.txt","title":"Unit 42: Brazil betting ban proliferates phishing sites","kind":"blog","source":"analyst","publisher":null,"text":"Unit 42 (Reethika Ramesh, Daiping Liu): after Brazil's betting ban of 2026-10-05, 500+ typosquatting/phishing domains of banned betting brands registered in the 15 days before. Techniques: cybersquatting, TLD rotation, string/number suffixes. Most ban-week domains parked (opportunistic). Domains registered Jul-Sep 2026 host clone betting portals and Google Play-like pages pushing Android APK downloads. 'BullsBet Casino' cluster serves gambling landing pages with safety language, redirects to pages geo-blocked outside Brazil. betano-br-casino[.]com references the ban and says balances are available for withdrawal. Indicators (2026-10-01): betano-br-casino[.]com, betfair-slots-brasil[.]com, betfury-crypto-casino-brasil[.]com, blaze-br-slots[.]com, brazino777-casino-brasil[.]com, bullsbet-app-brasil[.]com, bullsbet-br-app[.]com, bullsbet-br-betting[.]com, esportes-da-sorte-betting-brasil[.]com, h2bet-casino-brasil[.]com, novibet-br-app[.]com, pixbet-betting-brasil[.]com, superbet-br-betting[.]com; (2026-10-02): bulls-bet[.]org, bullsbetcasino[.]com[.]br","published_at":"2026-10-20T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}