cncbetbrazil[.]bet

This domain, cncbetbrazil.bet, is under active investigation for phishing activity targeting online gambling users in Brazil. Registered on February 21, 2026, through NiceNIC International Group Co., Limited, the domain currently resolves to IP address 172.67.137.141 and is protected by Cloudflare infrastructure, including HTTP/3 and Cloudflare Browser Insights. The page title, 'Cncbet online no Brasil,' suggests a focus on Brazilian users, though the exact content and mechanics of the phishing operation remain unconfirmed. Analysis indicates the domain is flagged by multiple security sources, including PhishDestroy and BLP-Malware, and appears on two security blocklists. It has also been referenced in 23 threat intelligence pulses on AlienVault OTX, signaling broader recognition within the security community. The domain's trust score is 0/100, reflecting high suspicion, though no detections were reported by the 95 vendors that scanned it. The absence of detections does not confirm safety, as phishing domains often evade initial scans through obfuscation or delayed malicious behavior. Defenders should treat this domain as high-risk due to its recent registration, use of Cloudflare for anonymization, and consistent flagging by security tools. The SSL certificate issued by Google Trust Services does not mitigate the risk, as legitimate certificates are commonly abused in phishing operations. Network-level blocking is recommended, along with monitoring for connections to the resolved IP (172.67.137.141) and associated infrastructure. Further analysis of the site's content and backend behavior is necessary to determine the specific phishing techniques employed, such as credential harvesting or fraudulent payment redirection.