Hackers Abuse Indian Government Domains to Push Illegal Gambling Websites Through Google Search

Hackers have abused Indian government and educational domains to promote illegal gambling websites through Google Search, using unauthorized DNS changes to establish malicious subdomains while leaving legitimate websites operational.

Another delegated government subzones to third-party nameservers, enabling broader control over subordinate DNS records.

The technique, called domain shadowing, allows attackers to misuse an organization’s domain without modifying its primary website.

The initial access method remains unknown; stolen credentials, insider access, or compromised DNS providers are possibilities, not confirmed findings.

The Indian government campaign affected maharashtra.gov.in, where unauthorized NS records delegated subzones including gam, games, search, live, and dpboss to ClouDNS nameservers.

Researchers observed a similar delegation involving online.esic.gov.in.

Infoblox researchers identified two unrelated operations, exploiting institutional namespaces for search engine optimization. One, tracked as Hidden Hawk, mapped individual hostnames to externally hosted gambling pages.

Illegal Gambling Sites

Unlike individual DNS aliases, these delegations moved authoritative control of entire subzones outside the government’s DNS environment.

Attackers could subsequently create or modify subordinate records without repeatedly changing the parent zone.

A wildcard beneath gam.maharashtra.gov.in also allowed arbitrary subordinate names to resolve, supporting numerous gambling-related hostnames.

Records associated with the Maharashtra operation appeared from at least August 2025.

Content delivery initially used DigitalOcean and later included Amazon CloudFront and BunnyCDN. Machine-generated doorway pages targeted searches involving rummy, betting, lotteries, and satta matka.

The unauthorized delegations were no longer observed by mid-October 2026, suggesting remediation. Researchers did not attribute this operation to Hidden Hawk.

Hidden Hawk’s separate operation involved more than 850 observed entry points across eight institutional domains in Bangladesh, India, and Mexico, supporting over 30 gambling brands. Researchers described these figures as minimums.

Most malicious hostnames used CNAME records pointing to Cloudflare Pages. Hosting names frequently reproduced the victim hostname with periods replaced by hyphens, providing a recognizable infrastructure relationship.

Affected infrastructure included six Bangladeshi school domains, a Mexican educational domain, and suneethi.sjd.kerala.gov.in. The Kerala case was observed as remediated in July 2026.

During controlled Telegram conversations, researchers posing as a casino operator received offers covering backlink optimization, custom landing pages, and Google AMP pages.

The seller guaranteed prominent Google rankings, although that claim does not establish independently verified search performance. Researchers made no payment.

Both operations sought to exploit institutional credibility for search visibility and traffic acquisition. Because external platforms served the gambling content, routine monitoring of institutional homepages or application logs could miss the abuse.

The findings sit within a broader criminal gambling ecosystem. Related Infoblox research identified more than 1.7 million Chinese-language casino domains and distinguished gambling infrastructure from consumer scams and casino-themed malware command-and-control sites.

The financial incentive is substantial: Gaming Compliance International estimated global unregulated online wagering at $5.9 trillion in 2025, a measure of bets placed rather than operator revenue.

Defenders should audit authoritative zones for unexpected CNAMEs, external NS delegations, wildcard records, and unexplained hostname creation.

Certificate transparency and passive DNS evidence can help expose unfamiliar subdomains.

Response should remove unauthorized records, investigate account activity, rotate potentially compromised credentials, and enforce multifactor authentication.

Blocking entire legitimate government or school domains would create collateral disruption; controls should target malicious hostnames and associated infrastructure instead.

IOCs

Indicator	Notes
d9d9t8dndf89z[.]cloudfront[.]net	Actor-controlled content delivery
168[.]144[.]156[.]92	Earlier A record; observed as inactive
search-maharashtra-gov-in[.]b-cdn[.]net	BunnyCDN-hosted content
games-maharashtra-gov-in[.]b-cdn[.]net	BunnyCDN-hosted content

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.