---
title: Attaxion | Threat research - 2026 Brazil Elections
---

[Skip to content](https://launch.attaxion.com/threat-research-2026-brazil-elections#main-content)

![](https://launch.attaxion.com/hs-fs/hubfs/Main-Logo-White-Background.png?width=180&height=180&name=Main-Logo-White-Background.png)

Open main navigation

Close main navigation

- [Contact us](https://launch.attaxion.com/threat-research-2026-brazil-elections#contact)

[Contact us](https://launch.attaxion.com/threat-research-2026-brazil-elections#contact)

  Threat research

# Brazil Election Domains 2026

## 138 official sites. 792 active look-alikes. How to tell them apart.

With Brazil's 4 October 2026 general election in focus, Attaxion researchers mapped the unofficial domains built on the names of the electoral court, the candidates and the election itself, and compared their infrastructure with the official sites they imitate.

### What the investigation uncovered

→ Nearly 1,000 look-alike domains registered around one major election development, peaking as campaigning began

→  Near copies of official addresses, including an electoral court look-alike that asks visitors for their CPF

→  DNS, hosting and registration patterns that separate look-alikes from the real sites

Research window

January 2025–October 2026

Data sources

DNS, WHOIS, IP & threat signals

Researcher

Alexandre François

As featured in

[![TELETIME](https://launch.attaxion.com/hubfs/teletimenews_logo.jpeg)](https://teletime.com.br/08/10/2026/bets-usam-eleicao-brasil/) [![Metrópoles](https://launch.attaxion.com/hubfs/metropoles_logo.jpg)](https://www.metropoles.com/colunas/tacio-lorran/site-usa-nome-de-lula-2026-para-levar-apostadores-ao-polymarket) [![NIC.br](https://launch.attaxion.com/hubfs/nic.br%20logo.png)](https://nic.br/noticia/na-midia/paginas-web-de-i-bets-i-usam-nomes-da-eleicao-e-seguem-acessiveis-no-brasil/)

### Download the full report

Get the complete investigation, evidence, methodology, and observables.

 

Key findings

## One election. Close to a thousand look-alikes.

Trusted names attract impersonation. Mapping the domains built on them, and the infrastructure behind each one, shows which ones deserve a closer look.

954

### Unofficial domains found

Registered since January 2025 on election-related names. 792 of them had live DNS records when checked.

27

### Official addresses imitated

The closest copies were built directly on real domains' names, including the electoral court's.

153

### Domains with warning signs

19.3% of active look-alikes had a flagged IP, a malicious-domain prediction or a link to a bulk registration.

26.8%

### Share an IP with an official site

212 look-alikes sit on the same address as a real site, so hosting alone can't tell them apart.

Why it matters

## Sites that look alike are not built alike.

Official sites had far more behind them: 44.2% ran more than five subdomains, against 9.3% of active look-alikes. The full report shows how subdomains, DNS records, hosting and registration patterns help separate the real sites from the imitations, a method that applies to any brand people trust.

[Download the full report](https://launch.attaxion.com/threat-research-2026-brazil-elections#threat-research-form)

[![](https://launch.attaxion.com/hs-fs/hubfs/Main-Logo-White-Background.png?width=180&height=180&name=Main-Logo-White-Background.png)](http://attaxion.com)

www.attaxion.com

Copyright © 2026, Attaxion LLC