Skip to content
NewA calmer, faster ZeroHour
StoryPhishing & fraudmedium

Infoblox finds gambling SEO abuse of government and school DNS

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Infoblox says two domain-shadowing operations used government and school DNS to promote illegal gambling; Maharashtra records were later removed.

Infoblox’s October 26 report describes two operations that added unauthorized DNS records under government and school domains in Bangladesh, India, and Mexico while the main sites kept working. It does not report malware or stolen data. Hidden Hawk used more than 850 entry points across eight domains, mostly CNAMEs to Cloudflare Pages, for more than 30 gambling brands. A separate, unattributed operation delegated Maharashtra and ESIC subzones, including a wildcard, to ClouDNS; records dated from at least August 2025 and were gone by mid-October 2026. How DNS access was obtained is unknown. A Kerala government hostname was remediated in July 2026.

Key facts
  • Hidden Hawk used over 850 entry points on eight domains for more than 30 brands.
  • Six Bangladeshi school domains held about 50 to more than 240 entries each.
  • Maharashtra subzones gam, games, search, live, and dpboss were delegated to ClouDNS.
  • A wildcard under gam.maharashtra.gov.in resolved arbitrary subordinate names.
  • Doorway content moved from DigitalOcean to CloudFront and BunnyCDN.
  • Researchers contacted a Telegram account believed to be Hidden Hawk and paid nothing.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 26, 2026Infoblox reports two government and school domain-shadowing operations. · Cyber Security News

What each outlet adds

beyond the shared facts
  • GBHackersNames Maharashtra subzones, wildcard, CDN shift, and non-attribution.
  • Cyber Security NewsOctober 26 report date, Bangladesh entry counts, and Telegram contact.
Threat actors
Hidden Hawk
Organizations
Infoblox
Countries
BangladeshIndiaMexico

Coverage

oldest first · one row per article · UTC
  1. · 2d ago GBHackersFirst report

    Attackers shadow Indian government domains to promote illegal gambling sites

    Infoblox says unauthorized NS delegations on maharashtra.gov.in and a separate Hidden Hawk operation abused school and government domains for SEO.

  2. · 2d ago Cyber Security News

    School and government DNS abused to promote illegal gambling

    Infoblox found two operations using CNAME aliases and nameserver delegations; it does not report malware or stolen data.