Domain-Shadowing Operations Exploit School and Government Domains for Gambling SEO

Two unrelated domain-shadowing operations placed illegal gambling pages beneath legitimate school and government domains, exploiting institutional reputations to boost search visibility and acquire traffic, according to Infoblox. Hidden Hawk created unauthorized DNS CNAME records across eight institutional domains in Bangladesh, India, and Mexico, mostly directing hostnames to Cloudflare Pages. Researchers observed more than 850 entry points associated with over 30 gambling brands, including illegal Indonesian gambling services. Infoblox also engaged with the actor on Telegram, where it reportedly sells SEO services, including backlink optimization and custom landing pages.

A separate, unattributed operation delegated subzones beneath Maharashtra and ESIC government domains to external nameservers. A wildcard enabled arbitrary hostnames beneath gam.maharashtra.gov.in to resolve. In both operations, legitimate institutions’ primary websites could remain unaffected while unauthorized hostnames served externally hosted content. The initial DNS-access methods remain unknown; credential theft and compromised DNS-management accounts are possibilities, not confirmed intrusion methods. Defenders should monitor authoritative DNS changes, secure DNS-management accounts, remove unauthorized records and delegations, and block malicious hostnames rather than legitimate institutional domains wholesale.