School and government DNS abused to promote illegal gambling
Original title: Hackers Hijack Government and School Subdomains to Promote Illegal Gambling Websites
Infoblox found two operations using CNAME aliases and nameserver delegations; it does not report malware or stolen data.
Infoblox’s October 26 report describes two domain-shadowing operations that added unauthorized DNS records under government and school domains in Bangladesh, India, and Mexico while the main sites kept working. Hidden Hawk pointed many school and government names, mostly via CNAME, at externally hosted Indonesian gambling pages. A separate, unattributed operation delegated Maharashtra government and ESIC subzones to ClouDNS, including a wildcard, with records seen from at least August 2025 until mid-October 2026. How DNS administration was first accessed is unknown.
Unconfirmed: Initial DNS access is unknown, and Infoblox has not attributed the Maharashtra operation to Hidden Hawk.
- One operation had more than 850 entry points across eight domains and over 30 gambling brands.
- Six Bangladeshi school domains carried about 50 to more than 240 entries each.
- A Kerala government case was observed remediated in July 2026; other infrastructure stayed active.
- Researchers contacted a Telegram account believed to be Hidden Hawk and made no payment.
- The second operation used DigitalOcean, Amazon CloudFront, and BunnyCDN for doorway pages.
Impact: Trusted institutional names pointed at unauthorized gambling content
- 1.Investigate unexpected CNAME targets, nameserver delegations, wildcards, and unfamiliar subdomain bursts.
- 2.Remove unauthorized records, review DNS-provider logs, rotate exposed credentials, and enforce multifactor authentication.
- 3.Do not block entire legitimate institutional domains; focus on unauthorized hostnames and attacker infrastructure.
- Threat actors
- Hidden Hawk
- Organizations
- Infoblox
- Countries
- BangladeshIndiaMexico
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | d9d9t8dndf89z.cloudfront.net | .]io Image-hosting infrastructure CloudFront infrastructure d9d9t8dndf89z[.]cloudfront[.]net Actor-controlled content delivery Historical IP address |
| domain | dhabalsatihs.edu.bd | hool domains raahs[.]edu[.]bd maishadihighschool[.]edu[.]bd dhabalsatihs[.]edu[.]bd sanguhs[.]edu[.]bd saaacademy[.]edu[.]bd wsbachs[.]edu[ |
| domain | dpboss.maharashtra.gov.in | arch[.]maharashtra[.]gov[.]in live[.]maharashtra[.]gov[.]in dpboss[.]maharashtra[.]gov[.]in Unauthorized external DNS delegations Delegated ESIC |
| domain | escuelanormallarrainzar.edu.mx | er affected institutions suneethi[.]sjd[.]kerala[.]gov[.]in escuelanormallarrainzar[.]edu[.]mx Kerala government and Mexican educational infrastructur |
| domain | free-bonus-no-deposit-betting-sites.dpboss.maharashtra.gov.in | are Pages CNAME destination Example government doorway page free-bonus-no-deposit-betting-sites[.]dpboss[.]maharashtra[.]gov[.]in Gambling page observed in July 2026 Note: IP addres |
| domain | games.maharashtra.gov.in | Delegated Maharashtra subzones gam[.]maharashtra[.]gov[.]in games[.]maharashtra[.]gov[.]in search[.]maharashtra[.]gov[.]in live[.]maharashtra[.] |
| domain | games-maharashtra-gov-in.b-cdn.net | yCDN infrastructure search-maharashtra-gov-in[.]b-cdn[.]net games-maharashtra-gov-in[.]b-cdn[.]net maharashtra-gov-in[.]b-cdn[.]net Gambling-content deliv |
| domain | gam.maharashtra.gov.in | n educational infrastructure Delegated Maharashtra subzones gam[.]maharashtra[.]gov[.]in games[.]maharashtra[.]gov[.]in search[.]maharashtra[. |
| domain | hinkale.me | delegation observed Hidden Hawk link shorteners mikale[.]me hinkale[.]me Actor-operated link-shortening infrastructure Hidden Hawk |
| domain | imghaxor.io | ing infrastructure Hidden Hawk image hosts imgmahasuhu[.]io imghaxor[.]io imgstore[.]io Image-hosting infrastructure CloudFront inf |
| domain | imgmahasuhu.io | ated link-shortening infrastructure Hidden Hawk image hosts imgmahasuhu[.]io imghaxor[.]io imgstore[.]io Image-hosting infrastructure |
| domain | imgstore.io | ture Hidden Hawk image hosts imgmahasuhu[.]io imghaxor[.]io imgstore[.]io Image-hosting infrastructure CloudFront infrastructure d9 |
| domain | link.omacuan.amc.edu.et.raahs.edu.bd | Gambling-content delivery Example hijacked school hostname link[.]omacuan[.]amc[.]edu[.]et[.]raahs[.]edu[.]bd Source-documented unauthorized hostname Corre |
| domain | link-omacuan-amc-edu-et-raahs-edu-bd.pages.dev | -documented unauthorized hostname Corresponding hosted page link-omacuan-amc-edu-et-raahs-edu-bd[.]pages[.]dev Cloudflare Pages CNAME destination Example government d |
| domain | live.maharashtra.gov.in | es[.]maharashtra[.]gov[.]in search[.]maharashtra[.]gov[.]in live[.]maharashtra[.]gov[.]in dpboss[.]maharashtra[.]gov[.]in Unauthorized external |
| domain | maharashtra-gov-in.b-cdn.net | gov-in[.]b-cdn[.]net games-maharashtra-gov-in[.]b-cdn[.]net maharashtra-gov-in[.]b-cdn[.]net Gambling-content delivery Example hijacked school hostn |
| domain | maishadihighschool.edu.bd | dicators Context Bangladesh school domains raahs[.]edu[.]bd maishadihighschool[.]edu[.]bd dhabalsatihs[.]edu[.]bd sanguhs[.]edu[.]bd saaacademy[. |
| domain | mikale.me | ar external delegation observed Hidden Hawk link shorteners mikale[.]me hinkale[.]me Actor-operated link-shortening infrastructur |
| domain | online.esic.gov.in | uthorized external DNS delegations Delegated ESIC subdomain online[.]esic[.]gov[.]in Similar external delegation observed Hidden Hawk link |
| domain | raahs.edu.bd | ource-reported indicators Context Bangladesh school domains raahs[.]edu[.]bd maishadihighschool[.]edu[.]bd dhabalsatihs[.]edu[.]bd s |
| domain | saaacademy.edu.bd | chool[.]edu[.]bd dhabalsatihs[.]edu[.]bd sanguhs[.]edu[.]bd saaacademy[.]edu[.]bd wsbachs[.]edu[.]bd Legitimate institutional domains ass |
| domain | sanguhs.edu.bd | [.]bd maishadihighschool[.]edu[.]bd dhabalsatihs[.]edu[.]bd sanguhs[.]edu[.]bd saaacademy[.]edu[.]bd wsbachs[.]edu[.]bd Legitimate ins |
| domain | search.maharashtra.gov.in | gam[.]maharashtra[.]gov[.]in games[.]maharashtra[.]gov[.]in search[.]maharashtra[.]gov[.]in live[.]maharashtra[.]gov[.]in dpboss[.]maharashtra[.] |
| domain | search-maharashtra-gov-in.b-cdn.net | ecord address; observed as inactive BunnyCDN infrastructure search-maharashtra-gov-in[.]b-cdn[.]net games-maharashtra-gov-in[.]b-cdn[.]net maharashtra-gov- |
| domain | suneethi.sjd.kerala.gov.in | iated with Hidden Hawk activity Other affected institutions suneethi[.]sjd[.]kerala[.]gov[.]in escuelanormallarrainzar[.]edu[.]mx Kerala governmen |
| domain | wsbachs.edu.bd | lsatihs[.]edu[.]bd sanguhs[.]edu[.]bd saaacademy[.]edu[.]bd wsbachs[.]edu[.]bd Legitimate institutional domains associated with Hidden |
| ipv4 | 168.144.156.92 | net Actor-controlled content delivery Historical IP address 168[.]144[.]156[.]92 Earlier A-record address; observed as inactive BunnyC |
From the original article
4 min read at cybersecuritynews.com
Hackers have abused government and school domains to promote illegal gambling websites, creating unauthorized subdomains while leaving the institutions’ main websites running normally. Two unrelated operations used changes to Domain Name System (DNS) records to place gambling pages beneath trusted institutional addresses, borrowing their reputation to attract visitors through search results.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.