Research details domain shadowing used to place gambling pages under school and government domains
Summary
Infoblox researchers describe two operations that used unauthorized DNS changes to place illegal gambling pages beneath school and government domains, using CNAME mappings or delegated subzones. The access method remains unknown; one operation’s delegations were later,
Key points
- Two unrelated operations used DNS changes to place gambling pages beneath institutional domains while leaving primary websites available.
- Hidden Hawk used CNAME records; researchers observed more than 850 entry points across eight institutional domains and more than 30 gambling brands, minimum figures at the time of writing.
- A separate operation delegated subzones beneath Maharashtra and ESIC domains to external nameservers; a wildcard enabled arbitrary hostnames under one subzone to resolve.
- The access method is unknown. Credential theft, insider access, or compromise of a registrar or DNS provider are possibilities raised in the report.
- Maharashtra delegations were no longer observed in mid-October 2026, and the compromise appeared to have been remediated.
- The researchers recommend monitoring authoritative DNS changes, including new subdomains, NS delegations, wildcards, and unexpected CNAMEs, and securing accounts that can change DNS.
Article Details
- Attack Vectors
- An unauthorized party appears to have accessed DNS administration and added records beneath legitimate school and government domains; the method of access is unknown.
- Hidden Hawk added individual CNAME records that mapped institutional hostnames to gambling pages hosted mostly on Cloudflare Pages.
- A separate operation delegated subzones beneath maharashtra.gov.in and online.esic.gov.in to ClouDNS nameservers; a wildcard beneath gam.maharashtra.gov.in allowed arbitrary hostnames to resolve.
- The resulting gambling doorway pages used institutional domain reputation to support SEO, search visibility, and traffic acquisition.
- Defensive Notes
- Monitor authoritative DNS zones for unexpected subdomains, NS delegations, wildcards, and CNAME records pointing to unexpected hosting services.
- Secure every account capable of changing DNS and investigate or remediate unauthorized DNS access, delegations, and hostnames.
- Focus defensive action on unauthorized hostnames and actor-controlled infrastructure; do not block legitimate institutional domains at the second-level domain.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | dpboss[.]maharashtra[.]gov[.]in | Delegated government subzone containing the reported gambling doorway page. |
| DOMAIN | free-bonus-no-deposit-betting-sites[.]dpboss[.]maharashtra[.]gov[.]in | Specific compromised government-domain hostname serving gambling content. |
| DOMAIN | gam[.]maharashtra[.]gov[.]in | Government subzone delegated to external nameservers and configured with a wildcard for the operation's gambling infrastructure. |
| DOMAIN | games[.]maharashtra[.]gov[.]in | Government subzone the article reports was delegated to external nameservers for the gambling operation. |
| DOMAIN | link-omacuan-amc-edu-et-raahs-edu-bd[.]pages[.]dev | Specific Cloudflare Pages hostname serving the gambling content mapped from the compromised school hostname. |
| DOMAIN | link[.]omacuan[.]amc[.]edu[.]et[.]raahs[.]edu[.]bd | Compromised school-domain hostname that resolved to gambling content through an unauthorized CNAME record. |
| DOMAIN | live[.]maharashtra[.]gov[.]in | Government subzone the article reports was delegated to external nameservers for the gambling operation. |
| DOMAIN | online[.]esic[.]gov[.]in | Government subzone reported as similarly delegated to external nameservers in the operation. |
| DOMAIN | search[.]maharashtra[.]gov[.]in | Government subzone the article reports was delegated to external nameservers for the gambling operation. |
MITRE ATT&CK
T1565.001 · Stored Data ManipulationThe operations added or changed DNS records, including CNAMEs, NS delegations, and a wildcard, to direct institutional subdomains to gambling content.T1608.006 · SEO PoisoningThe operators used gambling doorway pages beneath established institutional domains to improve search visibility and acquire traffic through SEO.
Threat Actors
Vendors
AmazonThe operation later used DigitalOcean, Amazon CloudFront, and BunnyCDN for content delivery.BunnyCDNDNS environment; the wildcard allowed arbitrary names to resolve DigitalOcean, then CloudFront and BunnyCDNCloudflareThe actor we track as Hidden Hawk added individual CNAME records that mapped institutional hostnames to gambling pages hosted largely on Cloudflare Pages.ClouDNSRather than adding only individual forwarding records in the victim’s zone, the actor delegated subzones including gam, games, search, live, and dpboss to ClouDNS nameservers.DigitalOceanmanaged through the actor-controlled DNS environment; the wildcard allowed arbitrary names to resolve DigitalOcean, then CloudFront and BunnyCDN
Products
Amazon CloudFrontactor-controlled DNS environment; the wildcard allowed arbitrary names to resolve DigitalOcean, then CloudFront and BunnyCDNCloudflare PagesThe actor we track as Hidden Hawk added individual CNAME records that mapped institutional hostnames to gambling pages hosted largely on Cloudflare Pages.
Countries
BangladeshWe identified more than 30 brands associated with the operation and more than 850 observed entry points across eight institutional domains in Bangladesh, India, and Mexico.IndiaWe identified more than 30 brands associated with the operation and more than 850 observed entry points across eight institutional domains in Bangladesh, India, and Mexico.MexicoWe identified more than 30 brands associated with the operation and more than 850 observed entry points across eight institutional domains in Bangladesh, India, and Mexico.