Borrowed Reputation
How domain shadowing placed illegal gambling pages beneath school and government domains
Executive Summary
- We identified two unrelated operations that used domain shadowing to place illegal gambling content beneath legitimate school and government domains. In both cases, an unauthorized party appears to have gained access to DNS administration and created records that the original domain owners may not have noticed. Because the resulting hostnames sat within established institutional namespaces, they provided especially useful infrastructure for search-engine optimization (SEO) and traffic acquisition.
- The access method is unknown. Domain shadowing can follow credential theft, insider access, compromise of a registrar or DNS provider, or another breach of the domain-management environment. Once access exists, an actor can create hostnames using A, CNAME, NS, wildcard, or other DNS records without changing the organization’s primary website.
- The two implementations differed. The actor we track as Hidden Hawk added individual CNAME records that mapped institutional hostnames to gambling pages hosted largely on Cloudflare Pages. In a separate campaign exploiting an Indian government domain, an actor delegated entire subzones to third-party authoritative nameservers and used a wildcard, allowing many hostnames to be managed outside the victim’s DNS environment.
- The main risk for domain owners is unauthorized use of their namespace. DNS operators should monitor changes to authoritative zones, especially new subdomains, NS delegations, wildcards, and CNAMEs to unexpected hosting services, and should secure every account capable of changing DNS.
- We engaged with Hidden Hawk, who sells their services via Telegram, to gain a better understanding of their operation. In these conversations they guaranteed us our gambling site would have a top search ranking in Google, a bold claim for most cases, but that makes sense when the use of .gov and .edu domains are involved.
How Domain Shadowing Supports the Operation
Domain shadowing occurs when an unauthorized party creates DNS records beneath a legitimate domain while leaving the owner’s primary website and expected services intact. The new hostnames can therefore remain outside normal website monitoring and may persist until someone reviews the authoritative zone, observes unexpected subdomain activity, or identifies associated certificate or passive DNS evidence.
The two operations in this report used different record types, but the higher-level process was the same: unauthorized DNS access created new institutional hostnames; those hostnames resolved to infrastructure serving illegal gambling doorway pages; and the pages used the established reputation of school and government namespaces to support SEO, search visibility, and traffic delivery. This combination makes domain shadowing particularly valuable to operators selling search placement to gambling brands that cannot rely on conventional advertising or stable, openly branded infrastructure. See Figure 1 for an end-to-end description of how the threat actors use domain shadowing to promote their websites.
Unregulated and illegal gambling are extremely lucrative, with the unregulated industry estimated at nearly USD $6 trillion worldwide in 2025. Beyond the sheer amount of money, gambling is often connected to organized crime, phishing, and even remote access malware operations, as we recently reported. Criminal networks and groups like Vigorish Viper and sanctioned FUNNULL CDN operate massive affiliate networks that offer an opportunity for wealth.
In addition to the financial scope, the volume of domains involved with illegal gambling is also immense. In our report, How Money Laundering, Scams, and Espionage Hide in a Web Full of Casino Garbage, we identified more than 1.7 million Chinese-language gambling domains. Unable to compete through conventional advertising channels, gambling operators can turn to search engine optimization as a means of customer acquisition. By exploiting the trust and authority associated with institutional domains, they can boost search rankings, increase visibility, and reach potential users at scale.
We recently researched two different domain shadowing actors that both led to illegal gambling sites, but through different mechanisms. A summary of these two cases is shown in Table 1.
| Cases | Victim-side change | Resulting actor control | Content delivery |
|---|---|---|---|
| Hidden Hawk | Individual CNAME records added beneath institutional domains | One mapped hostname per victim-side record, generally pointing to externally hosted content | Mostly Cloudflare Pages |
| Actor targeting Maharashtra and ESIC | NS delegations for subzones, including a wildcard under gam.maharashtra.gov.in | Records beneath delegated subzones could be managed through the actor-controlled DNS environment; the wildcard allowed arbitrary names to resolve | DigitalOcean, then CloudFront and BunnyCDN |
Table 1. Two implementations of domain shadowing in government and educational TLDs. Both were used to promote illegal gambling through SEO operations.
Case 1: Hidden Hawk
Hidden Hawk appears to provide search-visibility infrastructure for illegal Indonesian gambling brands. We identified more than 30 brands associated with the operation and more than 850 observed entry points across eight institutional domains in Bangladesh, India, and Mexico. Research was ongoing at the time of writing, so these figures are minimums.
The actor added CNAME records beneath school and government domains. Most mapped the institutional hostname to a corresponding Cloudflare Pages hostname. The pages.dev name commonly reproduced the victim hostname with dots replaced by hyphens, as seen in Figure 2, allowing relationships between victim-side names and hosted pages to be reconstructed.
Figure 2. Screenshot of an Infoblox Dossier lookup of link[.]omacuan[.]amc[.]edu[.]et[.]raahs[.]edu[.]bd. The CNAME record points to link-omacuan-amc-edu-et-raahs-edu-bd[.]pages[.]dev. The hosting name is the school’s hostname with the dots replaced by hyphens.
Gambling prefixes are often reused, including casino names like Omacuan and terms like slot-gacor, and appear across unrelated institutions. For example, link-omacuan-amc-edu-et-raahs-edu-bd[.]pages[.]dev served the content shown in Figure 3 and was contained in the CNAME record for link[.]omacuan[.]amc[.]edu[.]et[.]raahs[.]edu[.]bd.
Figure 3. Screenshot of gambling content served from link-omacuan-amc-edu-et-raahs-edu-bd[.]pages[.]dev. Between July 6 and October 1, 2026, the same content was reachable under a Bangladeshi secondary school’s domain at link[.]omacuan[.]amc[.]edu[.]et[.]raahs[.]edu[.]bd, via a CNAME record.
The primary institutional websites remained available and did not need to host the gambling content. Because the malicious hostnames existed in DNS and led to externally hosted pages, an organization focused on its main website or application logs could miss the activity. Hidden Hawk has access to the DNS records of many institutions, and we do not know how they gained access: they could have acquired leaked credentials, positioned an insider within the registrar or DNS provider, or compromised one of these services. A summary of the infrastructure they control is in Table 2.
| Domain group | Observed scope | Status at time of research |
|---|---|---|
| Six Bangladesh school domains | Approximately 50 to more than 240 entries per domain | Some currently active |
| escuelanormallarrainzar.edu.mx | More than 50 entries | Active |
| suneethi.sjd.kerala.gov.in | One directly hosted case; some school CNAMEs pointed to it | Observed as remediated in July 2026 |
Table 2. The scale of infrastructure controlled by Hidden Hawk
The landing pages shared a small set of components, including actor-operated link-shortening and image-hosting infrastructure. The operation was not merely placing its own gambling content: it appeared to offer SEO infrastructure as a service to multiple illegal gambling brands. During controlled research, we contacted a Telegram account we believed to be operated by Hidden Hawk. Using a fabricated casino persona, researchers asked about SEO services. The account operator described backlink optimization and custom landing pages, including pages using Google AMP, and provided pricing in U.S. dollars and Indonesian rupiah together with Indonesian bank-payment details. The pitch aligned with the infrastructure and page construction observed during the investigation. No payment was made.
Case 2: Maharashtra and ESIC
A separate operation used unauthorized delegation of subzones beneath maharashtra.gov.in. Rather than adding only individual forwarding records in the victim’s zone, the actor delegated subzones including gam, games, search, live, and dpboss to ClouDNS nameservers. We observed a similar delegation for online.esic.gov.in. We have not attributed this activity to Hidden Hawk.
ClouDNS is a Bulgarian provider that offers free DNS service and is sometimes abused by threat actors.
Delegation changed where authoritative answers for those subzones were managed. Once the parent zone referred queries to the external nameservers, the actor could create and modify records beneath the delegated names without returning to the government’s DNS environment for each hostname. A wildcard under gam.maharashtra.gov.in further allowed arbitrary names beneath that subzone to resolve.
Gambling-related records appeared beneath the Maharashtra domain from at least August 2025. The operation later used DigitalOcean, Amazon CloudFront, and BunnyCDN for content delivery. The observed pages included machine-generated doorway content related to rummy, betting, lottery, and satta matka, such as the example in Figure 4. The delegations were no longer observed in mid-October 2026, and the compromise appeared to have been remediated.
Figure 4. Screenshot of gambling content accessed at free-bonus-no-deposit-betting-sites[.]dpboss[.]maharashtra[.]gov[.]in (July 2026)
What DNS Operators Should Monitor
Victim domains should not be blocked at the second-level domain. The affected schools and government organizations are legitimate institutions. Defensive action should focus on the unauthorized hostnames and actor-controlled infrastructure, together with remediation of the DNS account or delegation that enabled them. See Table 3.
| Observable | Recommended response |
|---|---|
| New or changed NS delegation | Validate against the approved DNS architecture. Remove unauthorized parent-zone records and review the account activity that created them. |
| Unexpected subdomain or burst of new names | Confirm the service owner and change record. Investigate names that have no documented operational purpose. |
| CNAME to an unexpected hosting service | Identify the application owner and verify the target. Review services such as pages.dev, netlify.app, workers.dev, CloudFront, and other external platforms in context rather than blocking them categorically. |
| Wildcard record | Require a documented need and review the target because a wildcard can make arbitrary hostnames resolve. |
| Certificate issued for an unfamiliar hostname | Correlate certificate-transparency observations with DNS changes and approved service inventories. |
| Unrecognized DNS change | Treat DNS-management credentials as potentially compromised, rotate them, enforce MFA, and review registrar and DNS-provider access logs. |
Table 3. Behavior that can indicate domain shadowing, and how defenders can respond.
Indicators
Victim-side domains are included for investigation and remediation context. Do not block legitimate institutional domains at the second-level domain.
Compromised institutional domains associated with Hidden Hawk
- raahs.edu.bd
- maishadihighschool.edu.bd
- dhabalsatihs.edu.bd
- sanguhs.edu.bd
- saaacademy.edu.bd
- wsbachs.edu.bd
- suneethi.sjd.kerala.gov.in
- escuelanormallarrainzar.edu.mx
Delegated Maharashtra and ESIC subdomains
- gam.maharashtra.gov.in
- games.maharashtra.gov.in
- search.maharashtra.gov.in
- live.maharashtra.gov.in
- dpboss.maharashtra.gov.in
- online.esic.gov.in
Hidden Hawk infrastructure
| Indicator | Notes |
|---|---|
| mikale[.]me | Link shortener |
| hinkale[.]me | Link shortener |
| imgmahasuhu[.]io | Image hosting |
| imghaxor[.]io | Image hosting |
| imgstore[.]io | Image hosting |
Maharashtra / ESIC infrastructure
| Indicator | Notes |
|---|---|
| d9d9t8dndf89z[.]cloudfront[.]net | Actor-controlled content delivery |
| 168[.]144[.]156[.]92 | Earlier A record; observed as inactive |
| search-maharashtra-gov-in[.]b-cdn[.]net | BunnyCDN-hosted content |
| games-maharashtra-gov-in[.]b-cdn[.]net | BunnyCDN-hosted content |
| maharashtra-gov-in[.]b-cdn[.]net | BunnyCDN-hosted content |
