CloudSEK Maps IPL Betting Scams, Deepfake Promotions and Compromised Government Sites
Summary
CloudSEK’s investigation found more than 1,200 domains promoting illegal IPL betting, operators rejecting thousands of withdrawals, and an underground ecosystem using deepfakes, money mules, compromised government sites and fake loan apps.
Key points
- CloudSEK identified more than 1,200 domains promoting illegal betting platforms targeting IPL fans.
- An accessed admin panel managed more than 25 betting sites; records showed over 9,300 rejected withdrawal requests from May 2025 to May 2026, with potential losses estimated at ₹4.65 crore.
- Researchers found business-registered accounts used to receive and move betting deposits, and recruitment of money mules through messaging platforms.
- AI-generated deepfakes of public figures were used to promote betting tipsters and platforms through social media and Telegram.
- Attackers exploited vulnerabilities in Indian government websites to inject betting links and manipulate search rankings.
- Fake loan apps targeting people who lose money may collect sensitive device data and use threats or manipulated images to coerce repayment.
- The article advises avoiding betting tipster referral links and suspicious loan apps, and reporting threats or losses to cybercrime authorities.
Article Details
- Attack Vectors
- Illegal betting platforms use affiliate referral links and tipper channels to attract depositing users.
- AI-generated deepfake videos impersonating cricketers, news anchors, and celebrities promote betting platforms and prediction channels.
- Attackers exploit vulnerabilities in government websites and inject backlinks to illegal betting platforms or phishing content to manipulate search rankings and redirect visitors.
- Bulk unsolicited SMS messages promote betting platforms and tipper channels, sometimes using sender ID spoofing.
- Fake loan apps request access to contacts, photos, call logs, messages, and location data, then use personal data and manipulated images to intimidate borrowers.
- Money mules receive and forward betting deposits and withdrawals through rented or coerced bank accounts.
- Defensive Notes
- Do not trust tipsters or channels claiming guaranteed match predictions, and treat personal betting referral links as a warning sign.
- Assume celebrity or sports-person betting endorsements on Instagram or Telegram may be fabricated.
- Avoid loan apps promoted through social-media ads, particularly apps requesting access to contacts, photos, or call logs.
- Do not click links in unsolicited betting-promotional SMS messages; report senders to TRAI's DND service.
- Document betting deposits and rejected withdrawals and report the matter to a local cybercrime cell.
- People recruited as money mules should stop and seek legal advice; report loan-app threats to a local cybercrime cell or cybercrime.gov.in.
MITRE ATT&CK
T1566.003 · Spearphishing via ServiceUnsolicited bulk SMS messages promote betting platforms and tipper channels.T1583 · Acquire InfrastructureOperators use clone scripts to stand up new illegal betting platforms, but the article does not identify a specific ATT&CK sub-technique.T1584 · Compromise InfrastructureAttackers exploit vulnerabilities in government websites and inject betting or phishing backlinks into their source code; the article does not identify a specific ATT&CK sub-technique.T1598 · Phishing for InformationLead-generation operators use targeted Meta Ads and Google Ads to direct cricket fans to betting sites or tipper funnels.T1621 · Multi-Factor Authentication Request GenerationFake loan-app operators threaten to expose victims' personal data to coerce repayment.T1656 · ImpersonationDeepfake videos impersonate public figures to endorse betting platforms and prediction channels.