---
id: "CMP-202611-kie6xi"
kind: "campaign"
aliases: []
title: "Fake betting sites copy brands banned in Brazil (Betano, Bullsbet, Pixbet and others) to phish bettors and push Android APKs after the 5 Oct 2026 betting ban (Unit 42)"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["brazil", "campaign", "early-warning", "phishing"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-04T18:26:38+00:00"
updated_at: "2026-11-04T18:27:55+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-04T18:26:38+00:00"}]
---

# Fake betting sites copy brands banned in Brazil (Betano, Bullsbet, Pixbet and others) to phish bettors and push Android APKs after the 5 Oct 2026 betting ban (Unit 42)

Palo Alto Unit 42 found more than 500 new lookalike and phishing domains registered in the 15 days before Brazil's betting ban took effect on 2026-10-05. They target betting brands that were previously blocked in Brazil and use cybersquatting, rotating TLDs and added words or numbers. Most domains registered in the week of the ban only show parked pages so far. Similar domains registered July-September 2026 host clones of betting portals and Google Play-style pages that push Android APK downloads. A 'BullsBet Casino' cluster serves gambling pages with safety wording, then redirects to pages that only load from Brazil. betano-br-casino[.]com mentions the ban and tells users their balances can be withdrawn, a lure aimed at bettors with money on banned sites. At risk: people in Brazil who bet or held balances on these brands. Confirmed victims and losses: unknown. What the APKs do: unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Match links, sender domains and DNS logs against these domains (Unit 42). Registered 2026-10-01: betano-br-casino[.]com, betfair-slots-brasil[.]com, betfury-crypto-casino-brasil[.]com, blaze-br-slots[.]com, brazino777-casino-brasil[.]com, bullsbet-app-brasil[.]com, bullsbet-br-app[.]com, bullsbet-br-betting[.]com, esportes-da-sorte-betting-brasil[.]com, h2bet-casino-brasil[.]com, novibet-br-app[.]com, pixbet-betting-brasil[.]com, superbet-br-betting[.]com. Registered 2026-10-02: bulls-bet[.]org, bullsbetcasino[.]com[.]br. Lures: 'BullsBet Casino' sites with safety wording, and messages or sites saying new casino bets are banned and your balance is available for withdrawal. Also look for a Google Play-style page offering a betting app as an APK download. Unit 42 lists only a sample; the rest of the 500+ domains are not published.

## Fix

Do not enter logins, card or Pix details, or ID documents on these sites, and do not install betting apps from APK links. Use only the operator's official, authorized site or the Play Store. If you entered details, change the password and contact your bank. Block the listed domains on DNS and in mail filters.

## Timeline

- 2026-11-04T18:26:38+00:00 analyst

## Documents

- [describes] @Unit42_Intel: Brazil's betting ban on 2026-10-05 triggered a proliferation of typosquatting an https://x.com/Unit42_Intel/status/2118037105041416253
- [describes] Unit 42: Brazil betting ban proliferates phishing sites https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-20-phishing-sites-proliferation-related-to-Brazil-betting-ban.txt

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_