---
title: Hunt: Brazil's Oct 5 betting ban set off a wave of lookalike betting domains, with clone portals pushing Android APKs | ctxsec
url: https://ctxsec.com/items/hunt-unit42-brazil-betting-ban-typosquat-phishing-domains
description: "Unit 42 found more than 500 new domains registered in the 15 days before Brazil's Oct 5, 2026 betting ban, imitating betting brands previously blocked in Brazil (Betano, Bullsbet, Pixbet, Superbet, Blaze and others). They use cybersquatting, TLD rotation and added suffixes. Most registered the week of the ban are parked, so they may be opportunistic. Older lookalikes registered July to September host cloned betting portals and fake Google Play pages pushing Android APKs, some geo-blocked to Brazil. One site cites the ban and tells users their balances can be withdrawn."
status: "confirmed research (Unit 42 timely threat intel, posted Nov 4)"
published: 2026-11-04
---

> Unit 42 found more than 500 new domains registered in the 15 days before Brazil's Oct 5, 2026 betting ban, imitating betting brands previously blocked in Brazil (Betano, Bullsbet, Pixbet, Superbet, Blaze and others). They use cybersquatting, TLD rotation and added suffixes. Most registered the week of the ban are parked, so they may be opportunistic. Older lookalikes registered July to September host cloned betting portals and fake Google Play pages pushing Android APKs, some geo-blocked to Brazil. One site cites the ban and tells users their balances can be withdrawn.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-unit42-brazil-betting-ban-typosquat-phishing-domains.md)

confirmed research (Unit 42 timely threat intel, posted Nov 4)

2026-11-04

### Hunt: Brazil's Oct 5 betting ban set off a wave of lookalike betting domains, with clone portals pushing Android APKs

- **Examples:** `betano-br-casino[.]com`, `bullsbet-app-brasil[.]com`, `pixbet-betting-brasil[.]com`, `superbet-br-betting[.]com`, `bulls-bet[.]org`, `bullsbetcasino[.]com[.]br`. Unit 42's file has the full list.
- **Hunt:** in DNS and proxy logs, look for betting-brand names plus `-br`, `-brasil`, `-app` or `-casino` on recently registered domains, and for APK downloads from non-store hosts on Brazilian mobile fleets.

Sources: [Unit 42 timely threat intel: Brazil betting ban proliferates phishing sites](https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-20-phishing-sites-proliferation-related-to-Brazil-betting-ban.txt) · [Unit 42 on X (Nov 4)](https://x.com/Unit42_Intel/status/2118037105041416253)