\n| Actor targeting Maharashtra and ESIC<\/td>\n | NS delegations for subzones, including a wildcard under gam.maharashtra.gov.in<\/td>\n | Records beneath delegated subzones could be managed through the actor-controlled DNS environment; the wildcard allowed arbitrary names to resolve<\/td>\n | DigitalOcean, then CloudFront and BunnyCDN<\/td>\n<\/tr>\n<\/table>\n Table 1. Two implementations of domain shadowing in government and educational TLDs. Both were used to promote illegal gambling through SEO operations.<\/p>\n Case 1: Hidden Hawk<\/h3>\nHidden Hawk appears to provide search-visibility infrastructure for illegal Indonesian gambling brands. We identified more than 30 brands associated with the operation and more than 850 observed entry points across eight institutional domains in Bangladesh, India, and Mexico. Research was ongoing at the time of writing, so these figures are minimums.<\/p>\n The actor added CNAME records beneath school and government domains. Most mapped the institutional hostname to a corresponding Cloudflare Pages hostname. The pages.dev name commonly reproduced the victim hostname with dots replaced by hyphens, as seen in Figure 2, allowing relationships between victim-side names and hosted pages to be reconstructed.<\/p>\n ![\"Figure](\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/borrowed-reputation-domain-shadowing-and-gambling-seo-image2.jpg\")
\n![\"Figure](\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/borrowed-reputation-domain-shadowing-and-gambling-seo-image2b.jpg\") <\/p>\n
Figure 2. Screenshot of an Infoblox Dossier lookup of link[.]omacuan[.]amc[.]edu[.]et[.]raahs[.]edu[.]bd. The CNAME record points to link-omacuan-amc-edu-et-raahs-edu-bd[.]pages[.]dev. The hosting name is the school\u2019s hostname with the dots replaced by hyphens.<\/p>\n Gambling prefixes are often reused, including casino names like Omacuan and terms like slot-gacor, and appear across unrelated institutions. For example, link-omacuan-amc-edu-et-raahs-edu-bd[.]pages[.]dev served the content shown in Figure 3 and was contained in the CNAME record for link[.]omacuan[.]amc[.]edu[.]et[.]raahs[.]edu[.]bd.<\/p>\n ![\"Figure](\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/borrowed-reputation-domain-shadowing-and-gambling-seo-image3.jpg\") <\/p>\n
Figure 3. Screenshot of gambling content served from link-omacuan-amc-edu-et-raahs-edu-bd[.]pages[.]dev. Between July 6 and October 1, 2026, the same content was reachable under a Bangladeshi secondary school\u2019s domain at link[.]omacuan[.]amc[.]edu[.]et[.]raahs[.]edu[.]bd, via a CNAME record.<\/p>\n The primary institutional websites remained available and did not need to host the gambling content. Because the malicious hostnames existed in DNS and led to externally hosted pages, an organization focused on its main website or application logs could miss the activity. Hidden Hawk has access to the DNS records of many institutions, and we do not know how they gained access: they could have acquired leaked credentials, positioned an insider within the registrar or DNS provider, or compromised one of these services. A summary of the infrastructure they control is in Table 2.<\/p>\n \n\n| Domain group<\/th>\n | Observed scope<\/th>\n | Status at time of research<\/th>\n<\/tr>\n | \n| Six Bangladesh school domains<\/td>\n | Approximately 50 to more than 240 entries per domain<\/td>\n | Some currently active<\/td>\n<\/tr>\n | \n| escuelanormallarrainzar.edu.mx<\/td>\n | More than 50 entries<\/td>\n | Active<\/td>\n<\/tr>\n | \n| suneethi.sjd.kerala.gov.in<\/td>\n | One directly hosted case; some school CNAMEs pointed to it<\/td>\n | Observed as remediated in July 2026<\/td>\n<\/tr>\n<\/table>\n Table 2. The scale of infrastructure controlled by Hidden Hawk<\/p>\n The landing pages shared a small set of components, including actor-operated link-shortening and image-hosting infrastructure. The operation was not merely placing its own gambling content: it appeared to offer SEO infrastructure as a service to multiple illegal gambling brands. During controlled research, we contacted a Telegram account we believed to be operated by Hidden Hawk. Using a fabricated casino persona, researchers asked about SEO services. The account operator described backlink optimization and custom landing pages, including pages using Google AMP, and provided pricing in U.S. dollars and Indonesian rupiah together with Indonesian bank-payment details. The pitch aligned with the infrastructure and page construction observed during the investigation. No payment was made.<\/p>\n Case 2: Maharashtra and ESIC<\/h3>\nA separate operation used unauthorized delegation of subzones beneath maharashtra.gov.in. Rather than adding only individual forwarding records in the victim\u2019s zone, the actor delegated subzones including gam, games, search, live, and dpboss to ClouDNS nameservers. We observed a similar delegation for online.esic.gov.in. We have not attributed this activity to Hidden Hawk.<\/p>\n ClouDNS is a Bulgarian provider that offers free DNS service and is sometimes abused by threat actors.<\/p>\n Delegation changed where authoritative answers for those subzones were managed. Once the parent zone referred queries to the external nameservers, the actor could create and modify records beneath the delegated names without returning to the government\u2019s DNS environment for each hostname. A wildcard under gam.maharashtra.gov.in further allowed arbitrary names beneath that subzone to resolve.<\/p>\n Gambling-related records appeared beneath the Maharashtra domain from at least August 2025. The operation later used DigitalOcean, Amazon CloudFront, and BunnyCDN for content delivery. The observed pages included machine-generated doorway content related to rummy, betting, lottery, and satta matka, such as the example in Figure 4. The delegations were no longer observed in mid-October 2026, and the compromise appeared to have been remediated.<\/p>\n ![\"Figure](\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/borrowed-reputation-domain-shadowing-and-gambling-seo-image4.jpg\") <\/p>\n
Figure 4. Screenshot of gambling content accessed at free-bonus-no-deposit-betting-sites[.]dpboss[.]maharashtra[.]gov[.]in (July 2026)<\/p>\n What DNS Operators Should Monitor<\/h3>\nVictim domains should not be blocked at the second-level domain. The affected schools and government organizations are legitimate institutions. Defensive action should focus on the unauthorized hostnames and actor-controlled infrastructure, together with remediation of the DNS account or delegation that enabled them. See Table 3.<\/p>\n \n\n| Observable<\/th>\n | Recommended response<\/th>\n<\/tr>\n | \n| New or changed NS delegation<\/td>\n | Validate against the approved DNS architecture. Remove unauthorized parent-zone records and review the account activity that created them.<\/td>\n<\/tr>\n | \n| Unexpected subdomain or burst of new names<\/td>\n | Confirm the service owner and change record. Investigate names that have no documented operational purpose.<\/td>\n<\/tr>\n | \n| CNAME to an unexpected hosting service<\/td>\n | Identify the application owner and verify the target. Review services such as pages.dev, netlify.app, workers.dev, CloudFront, and other external platforms in context rather than blocking them categorically.<\/td>\n<\/tr>\n | \n| Wildcard record<\/td>\n | Require a documented need and review the target because a wildcard can make arbitrary hostnames resolve.<\/td>\n<\/tr>\n | \n| Certificate issued for an unfamiliar hostname<\/td>\n | Correlate certificate-transparency observations with DNS changes and approved service inventories.<\/td>\n<\/tr>\n | \n| Unrecognized DNS change<\/td>\n | Treat DNS-management credentials as potentially compromised, rotate them, enforce MFA, and review registrar and DNS-provider access logs.<\/td>\n<\/tr>\n<\/table>\n Table 3. Behavior that can indicate domain shadowing, and how defenders can respond.<\/p>\n Indicators<\/h3>\nVictim-side domains are included for investigation and remediation context. Do not block legitimate institutional domains at the second-level domain.<\/p>\n Compromised institutional domains associated with Hidden Hawk<\/strong><\/p>\n | | |
![\"Figure](\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/borrowed-reputation-domain-shadowing-and-gambling-seo-image1.jpg\")
<\/p>\n