Hunt: Brazil's Oct 5 betting ban set off a wave of lookalike betting domains, with clone portals pushing Android APKs
- Examples:
betano-br-casino[.]com,bullsbet-app-brasil[.]com,pixbet-betting-brasil[.]com,superbet-br-betting[.]com,bulls-bet[.]org,bullsbetcasino[.]com[.]br. Unit 42's file has the full list. - Hunt: in DNS and proxy logs, look for betting-brand names plus
-br,-brasil,-appor-casinoon recently registered domains, and for APK downloads from non-store hosts on Brazilian mobile fleets.
Sources: Unit 42 timely threat intel: Brazil betting ban proliferates phishing sites · Unit 42 on X (Nov 4)