Attackers shadow Indian government domains to promote illegal gambling sites
Original title: Hackers Abuse Indian Government Domains to Push Illegal Gambling Websites Through Google Search
Infoblox says unauthorized NS delegations on maharashtra.gov.in and a separate Hidden Hawk operation abused school and government domains for SEO.
Infoblox says attackers changed DNS on Indian government and education domains so malicious subdomains served illegal gambling pages while the main sites stayed up. On maharashtra.gov.in, unauthorized NS records delegated subzones including gam, games, search, live, and dpboss to ClouDNS; a similar delegation hit online.esic.gov.in. A separate operation, Hidden Hawk, used more than 850 entry points across eight domains in Bangladesh, India, and Mexico. Maharashtra records dated from at least August 2025 and were gone by mid-October 2026; how access was gained is unknown.
Unconfirmed: Initial access is unconfirmed; stolen credentials, insiders, or a compromised DNS provider are only possibilities.
- A wildcard under gam.maharashtra.gov.in let arbitrary subordinate names resolve.
- Content moved from DigitalOcean to Amazon CloudFront and BunnyCDN.
- Hidden Hawk mostly used CNAMEs to Cloudflare Pages for over 30 gambling brands.
- The Kerala hostname suneethi.sjd.kerala.gov.in was remediated in July 2026.
- Researchers did not attribute the Maharashtra delegations to Hidden Hawk.
Impact: Government and school domains used to host gambling SEO pages
- 1.Audit zones for unexpected CNAMEs, external NS delegations, wildcards, and new hostnames.
- 2.Remove unauthorized records, review account activity, and rotate potentially compromised credentials.
- 3.Enforce multifactor authentication and block malicious hostnames rather than whole legitimate domains.
- Threat actors
- Hidden Hawk
- Organizations
- Infoblox
- Countries
- IndiaBangladeshMexico
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | d9d9t8dndf89z.cloudfront.net | and associated infrastructure instead. IOCs Indicator Notes d9d9t8dndf89z[.]cloudfront[.]net Actor-controlled content delivery 168[.]144[.]156[.]92 |
| domain | free-bonus-no-deposit-betting-sites.dpboss.maharashtra.gov.in | res as minimums. Screenshot of gambling content accessed at free-bonus-no-deposit-betting-sites[.]dpboss[.]maharashtra[.]gov[.]in (Source : Infoblox). Most malicious hostnames used |
| domain | games-maharashtra-gov-in.b-cdn.net | ch-maharashtra-gov-in[.]b-cdn[.]net BunnyCDN-hosted content games-maharashtra-gov-in[.]b-cdn[.]net BunnyCDN-hosted content Note: IP addresses and domains |
| domain | gam.maharashtra.gov.in | out repeatedly changing the parent zone. A wildcard beneath gam.maharashtra.gov.in also allowed arbitrary subordinate names to resolve, suppor |
| domain | online.esic.gov.in | ervers. Researchers observed a similar delegation involving online.esic.gov.in. How Domain Shadowing Supports the Operation (Source : Info |
| domain | search-maharashtra-gov-in.b-cdn.net | 168[.]144[.]156[.]92 Earlier A record; observed as inactive search-maharashtra-gov-in[.]b-cdn[.]net BunnyCDN-hosted content games-maharashtra-gov-in[.]b-cd |
| domain | suneethi.sjd.kerala.gov.in | ngladeshi school domains, a Mexican educational domain, and suneethi.sjd.kerala.gov.in. The Kerala case was observed as remediated in July 2026. D |
| ipv4 | 168.144.156.92 | ndf89z[.]cloudfront[.]net Actor-controlled content delivery 168[.]144[.]156[.]92 Earlier A record; observed as inactive search-maharas |
From the original article
3 min read at gbhackers.com
Hackers have abused Indian government and educational domains to promote illegal gambling websites through Google Search, using unauthorized DNS changes to establish malicious subdomains while leaving legitimate websites operational. Another delegated government subzones to third-party nameservers, enabling broader control over subordinate DNS records.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.