Hackers exploited DNS records on legitimate school and government domains to promote illegal gambling websites through SEO This article explores exploit dns gambling. . Two unrelated operations were identified using domain shadowing, a technique that creates unauthorized hostnames without disrupting the institution's main website.
By placing gambling pages beneath established institutional domains, the operators aimed to exploit their reputation for search visibility and traffic acquisition.
Hackers Exploit DNS for Gambling (Source: Infoblox) The attack affected six Bangladeshi school domains, a Mexican educational domain, and a Kerala government subdomain. Researchers contacted a Telegram account suspected of belonging to Hidden Hawk, which claimed to offer backlink optimization, custom landing pages, and Google AMP pages, promising top Google search placement. The primary institutional websites remained accessible, but monitoring focused solely on website availability and application logs, potentially missing unauthorized DNS activity.
A separate actor altered NS records beneath maharashtra.gov.in, delegating subzones including gam, games, search, live, and dpboss to ClouDNS nameservers. Researchers observed similar activity involving online.esic.gov.in. Unlike individual CNAME additions, these delegations allowed the actor to manage records beneath affected subzones through an external DNS environment.
Infoblox research reveals that casino websites facilitate illegal gambling, consumer fraud, and malware command-and-control operations, which should not be confused with the activities described here.
