Domain Shadowing Lets Gambling Operators Abuse School and Government Domains
Summary
Infoblox investigated two unrelated operations that used unauthorized DNS changes to host illegal gambling pages beneath school and government domains. It details CNAME and delegated-subzone methods, observed infrastructure, and DNS monitoring and remediation steps.
Key points
- Infoblox identified two unrelated operations that appear to have gained unauthorized DNS access to place illegal gambling pages beneath legitimate school and government namespaces. The access method is unknown.
- Hidden Hawk added individual CNAME records, mostly pointing institutional hostnames to Cloudflare Pages. Researchers observed more than 850 entry points across eight institutional domains and more than 30 associated gambling brands.
- A separate operation delegated subzones beneath Maharashtra government and ESIC domains to external authoritative nameservers. A wildcard allowed arbitrary names under one delegated subzone to resolve.
- The separate operation used DigitalOcean, CloudFront, and BunnyCDN to deliver gambling-related doorway pages. The delegations were no longer observed in mid-October 2026 and appeared to have been remediated.
- Infoblox recommends monitoring new or changed NS delegations, unexpected subdomains, CNAMEs, wildcard records, and certificates for unfamiliar hostnames.
- For unrecognized DNS changes, the article recommends investigating and removing unauthorized records, rotating DNS-management credentials, enforcing MFA, and reviewing registrar and DNS-provider access logs.
- Defenders should focus remediation on unauthorized hostnames and actor-controlled infrastructure rather than blocking legitimate institutions’ second-level domains.
Article Details
- Attack Vectors
- Unauthorized DNS administration was used to add individual CNAME records beneath institutional domains, directing hostnames to gambling pages, mostly hosted on Cloudflare Pages.
- In a separate operation, actors delegated subzones beneath maharashtra.gov.in and online.esic.gov.in to external authoritative nameservers. A wildcard under gam.maharashtra.gov.in allowed arbitrary names beneath that subzone to resolve.
- The resulting pages used school and government domain reputations to promote illegal gambling through SEO, search visibility, and traffic delivery.
- The access method is unknown. The article lists leaked credentials, insider access, and compromise of a registrar or DNS provider as possibilities, not established methods.
- Defensive Notes
- Monitor authoritative DNS zones for new or changed subdomains, NS delegations, wildcards, and CNAMEs pointing to unexpected hosting services.
- Validate new delegations against approved DNS architecture; remove unauthorized parent-zone records and review the account activity that created them.
- Confirm the service owner and documented purpose of unexpected subdomains or bursts of new names.
- Correlate certificate-transparency observations with DNS changes and approved service inventories.
- For unrecognized DNS changes, treat DNS-management credentials as potentially compromised, rotate them, enforce MFA, and review registrar and DNS-provider access logs.
- Focus remediation on unauthorized hostnames and actor-controlled infrastructure rather than blocking legitimate institutional domains at the second-level domain.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | hinkale[.]me | Actor-operated link-shortening infrastructure associated with Hidden Hawk. |
| DOMAIN | imghaxor[.]io | Actor-operated image-hosting infrastructure associated with Hidden Hawk. |
| DOMAIN | imgmahasuhu[.]io | Actor-operated image-hosting infrastructure associated with Hidden Hawk. |
| DOMAIN | imgstore[.]io | Actor-operated image-hosting infrastructure associated with Hidden Hawk. |
| DOMAIN | mikale[.]me | Actor-operated link-shortening infrastructure associated with Hidden Hawk. |
| HOSTNAME | d9d9t8dndf89z[.]cloudfront[.]net | Actor-controlled content-delivery hostname used in the Maharashtra/ESIC operation. |
| HOSTNAME | games-maharashtra-gov-in[.]b-cdn[.]net | BunnyCDN-hosted content hostname associated with the Maharashtra/ESIC gambling operation. |
| HOSTNAME | link-omacuan-amc-edu-et-raahs-edu-bd[.]pages[.]dev | Specific Cloudflare Pages hostname that served gambling content through a CNAME associated with Hidden Hawk's operation. |
| HOSTNAME | maharashtra-gov-in[.]b-cdn[.]net | BunnyCDN-hosted content hostname associated with the Maharashtra/ESIC gambling operation. |
| HOSTNAME | search-maharashtra-gov-in[.]b-cdn[.]net | BunnyCDN-hosted content hostname associated with the Maharashtra/ESIC gambling operation. |
| IPV4 | 168[.]144[.]156[.]92 | Earlier A-record infrastructure associated with the Maharashtra/ESIC operation; observed as inactive. |
MITRE ATT&CK
T1584.001 · DomainsThe operations used unauthorized DNS access to control hostnames beneath legitimate institutional domains and direct them to gambling content.T1608.006 · SEO PoisoningThe operators used gambling doorway pages and institutional domain reputations to improve search visibility and attract traffic.
Threat Actors
Vendors
AmazonThe operation later used DigitalOcean, Amazon CloudFront, and BunnyCDN for content delivery.BunnyCDNDigitalOcean, then CloudFront and BunnyCDNCloudflareThe actor we track as Hidden Hawk added individual CNAME records that mapped institutional hostnames to gambling pages hosted largely on Cloudflare Pages.ClouDNSRather than adding only individual forwarding records in the victim’s zone, the actor delegated subzones including gam, games, search, live, and dpboss to ClouDNS nameservers.DigitalOceanDigitalOcean, then CloudFront and BunnyCDN
Products
Countries
BangladeshWe identified more than 30 brands associated with the operation and more than 850 observed entry points across eight institutional domains in Bangladesh, India, and Mexico.IndiaWe identified more than 30 brands associated with the operation and more than 850 observed entry points across eight institutional domains in Bangladesh, India, and Mexico.MexicoWe identified more than 30 brands associated with the operation and more than 850 observed entry points across eight institutional domains in Bangladesh, India, and Mexico.