body { font-family: Arial, Helvetica, sans-serif; line-height: 1.6; color: #111; margin: 20px; max-width: 900px; }
h1, h2 { color: #0b3b68; }
figure { margin: 1em 0; }
figcaption { font-size: 0.9em; color: #555; }
table { border-collapse: collapse; width: 100%; margin: 1em 0; }
th, td { border: 1px solid #ccc; padding: 8px; text-align: left; vertical-align: top; }
th { background: #f2f7fb; }
code { background: #f6f8fa; padding: 2px 4px; border-radius: 3px; font-size: 0.95em; }
.center { text-align: center; }
.note { font-size: 0.95em; color: #333; }
.cta { font-weight: bold; text-align: center; margin-top: 1.5em; }

Hackers Abuse Government and School Domains to Host Illegal Gambling Pages

Attackers have been adding unauthorized DNS records beneath legitimate government and school domains to host illegal gambling pages, while leaving the institutions’ primary websites functioning normally.

Infoblox researchers identified two separate operations that manipulated Domain Name System (DNS) records to place gambling content under trusted institutional addresses, leveraging the institutions’ reputations to attract traffic from search results.

The activity affected organizations in Bangladesh, India and Mexico. One operation involved more than 850 observed entry points across eight institutional domains and linked to over 30 gambling brands. These numbers describe observed infrastructure rather than confirmed victims or infections; Infoblox characterizes them as minimum counts because the investigation was ongoing when the report was published.

Infoblox published its findings in a report on domain shadowing dated October 26, 2026. The research documents DNS abuse used to promote illegal gambling, not the discovery of a new malware family. How the attackers first gained access to DNS administration remains unknown.

How the attackers placed gambling pages under trusted domains

Domain shadowing lets attackers add unauthorized DNS records beneath a legitimate domain without changing the site that visitors normally see. Unlike previously reported subdomain hijacking that abused abandoned cloud resources, these two operations appear to have involved unauthorized access to DNS administration, a distinction that affects how investigators seek the initial compromise.

Infoblox describes one actor as “Hidden Hawk.” That actor appears to sell search visibility to illegal Indonesian gambling brands by creating numerous subdomain aliases.

In Hidden Hawk’s campaigns, the actor added CNAME records beneath school and government domains. Most of these CNAMEs pointed to gambling pages hosted externally on Cloudflare Pages rather than to the institutions’ own servers. The external hostnames frequently mirrored the institutional hostnames but replaced dots with hyphens, a pattern that helped researchers map each hijacked address to its externally hosted page.

For example, researchers observed gambling content available beneath a Bangladeshi secondary school domain between July 6 and October 1, 2026. Because the institutions’ main websites remained operational, simple website checks could miss the abuse: six Bangladeshi school domains carried roughly 50 to more than 240 unauthorized entries each, and a Mexican educational domain had over 50 such entries. A Kerala government subdomain also directly hosted gambling content and received some CNAME connections from schools; Infoblox observed the Kerala case as remediated in July 2026, although other infrastructure persisted.

During controlled research, Infoblox contacted a Telegram account believed to be associated with Hidden Hawk using a fabricated casino identity. The operator offered services such as backlink optimization, custom landing pages and Google AMP pages, provided payment details, and guaranteed top Google rankings. Researchers did not make any payments; the sales pitch aligned with the infrastructure Infoblox observed.

Unauthorized DNS delegations gave attackers broader control

The second operation targeted Maharashtra government infrastructure and an ESIC subdomain in India. Instead of creating many individual aliases, attackers created unauthorized nameserver delegations that transferred control of particular DNS subzones to external nameservers hosted at ClouDNS. Infoblox did not attribute this second operation to Hidden Hawk.

A wildcard record in the delegated subzone expanded attacker control by allowing arbitrary names beneath the delegated zone to resolve. Gambling-related records associated with these delegations appeared as early as August 2025. The content was delivered via DigitalOcean, Amazon CloudFront, and BunnyCDN, and consisted of machine-generated doorway pages promoting rummy, sports betting, lotteries and satta matka.

By mid-October 2026 those unauthorized delegations had disappeared, which suggests remediation. Infoblox’s findings add to broader concerns about gambling-related infrastructure on legitimate domains, though it is important to note that similarly styled casino pages have been used in other campaigns for different purposes, including covert espionage.

In this investigation, the documented objective was search visibility and traffic acquisition. The evidence does not show that visitors were served malware or that the operations exfiltrated institutional data.

Recommendations for defenders

Defenders should monitor authoritative DNS changes rather than relying solely on homepage checks. Look for unexpected CNAME targets, new nameserver delegations, unexplained wildcard records, and sudden bursts of unfamiliar subdomains. Compare certificate-transparency observations with approved services and DNS change records.

When unauthorized DNS changes are discovered, organizations should remove the offending records, review registrar and DNS-provider logs, rotate any exposed credentials, and enforce multifactor authentication on relevant accounts. Infoblox warns against blanket blocking of entire legitimate domains. Incident response should focus on the unauthorized hostnames and the attacker-controlled infrastructure while addressing the account access or delegations that enabled the abuse. Shared hosting platforms that appear in investigations also require contextual analysis rather than blanket blocking.

Indicators of compromise (IoCs)

Note: IP addresses and domains above are intentionally defanged (for example, [.]) to prevent accidental resolution or hyperlinking. Re-fang them only within controlled threat-intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stop incidents quickly. Integrate threat intelligence from 16K SOCs.