A school website can look perfectly normal while a different address under the same domain serves an illegal casino. In research published on October 26, Infoblox describes two operations that created gambling pages beneath legitimate educational and government domains by changing DNS records, leaving the institutions’ main sites available.
One operation, tracked as Hidden Hawk, had more than 850 observed entry points across eight institutional domains and links to more than 30 Indonesian gambling brands. Those are infrastructure observations, not a count of people defrauded. The second operation handed control of whole government subzones to outside nameservers. Infoblox has not attributed it to Hidden Hawk.
The school address led somewhere else
Hidden Hawk’s basic move was to add a CNAME: a DNS record that makes one hostname an alias for another. A gambling-related name under a school’s real domain pointed to a page on an outside hosting service, usually Cloudflare Pages. The school’s web server did not need to store the casino page.
A particularly revealing detail connected the two sides. The external pages[.]dev hostname often copied the institutional hostname, replacing its dots with hyphens. That gave investigators a way to trace which hosted page belonged to which unauthorized school address.
In one documented example, gambling content was reachable beneath a Bangladeshi secondary school’s domain between July 6 and October 1. The report also identifies affected institutional domains in Mexico and India. Some entries remained active during the research; the Indian case in that group had been observed as remediated in July.
This is domain shadowing: unauthorized names are added beneath a legitimate domain while its expected services continue working. An administrator checking only the home page or the main website’s access logs could miss pages delivered entirely by someone else’s infrastructure.
The report does not establish how the operators obtained DNS access. Stolen credentials, an insider, or a compromise of a registrar or DNS provider are possible routes, rather than findings proven in these cases. A working home page does not resolve that question.
The sales pitch matched the infrastructure
Infoblox researchers contacted a Telegram account they believed was operated by Hidden Hawk, posing as a casino business. The operator offered backlink optimization and custom landing pages, quoted prices in dollars and Indonesian rupiah, and supplied bank-payment details. The researchers made no payment.
The exchange matters because it connects the scattered hostnames to an apparent service sold to multiple gambling brands. It is different from discovering one unwanted casino page on one school site. The operator also promised top placement in Google; that was a sales claim, not a verified ranking result or a guarantee that institutional domains defeat search defenses.
Google’s published spam policies identify doorway pages and unauthorized injected content as abuse that can lead to reduced visibility or removal from results. An institutional address is neither approval from the institution nor an endorsement from a search engine.
A second actor delegated the whole neighborhood
The separate Maharashtra and ESIC case used a broader DNS change. Unauthorized NS records delegated subzones beneath government domains to external ClouDNS nameservers. Once a parent zone delegates a subzone, those nameservers answer for names inside it. The operator could change those records without making a fresh change in the government’s parent zone each time.
A wildcard beneath gam[.]maharashtra[.]gov[.]in let arbitrary names in that subzone resolve. The observed content included doorway pages about rummy, betting, lotteries and satta matka. Delivery moved through DigitalOcean, CloudFront and BunnyCDN infrastructure.
Infoblox observed gambling-related records there from at least August 2025. The delegations were no longer observed by mid-October 2026, and the compromise appeared to have been remediated. Today’s development is the published investigation, not a claim that the government domains were first compromised today or that those delegations remain active.
The check belongs in the DNS account
For a school, business or public body, cleaning the main website alone would miss the control point described here. Compare the authoritative DNS zone with the approved service inventory: investigate unfamiliar CNAME targets, new NS delegations, wildcard records and sudden groups of subdomains. A legitimate use of Cloudflare Pages or another hosting provider is not itself an indicator of compromise.
If a change is unauthorized, remove the relevant parent-zone record or delegation and review the account that created it. Rotate exposed DNS-management credentials, enforce MFA, and check registrar and provider access logs. Certificate-transparency records for unfamiliar hostnames can help identify changes that normal website monitoring missed.
For visitors, a casino appearing beneath an education or government address is a reason to question the page, not to trust a deposit request. A Gridinsoft reputation check of the complete hostname can add context without opening it, but does not certify a casino or guarantee a withdrawal. The fake crypto casino guide explains the separate payment and withdrawal traps.
Defenders should target unauthorized hostnames and actor-controlled infrastructure, rather than blocking the legitimate institutions’ entire domains. The distinction from the earlier PeckBirdy casino investigation is also useful: this report establishes misuse of DNS and institutional identity, without establishing malware execution on every visitor’s device.
References
- Infoblox Threat Intel. Borrowed Reputation: Domain Shadowing and Gambling SEO. October 26, 2026.
- Google Search Central. Spam policies for Google web search. Doorway abuse and hacked content; accessed October 26, 2026.
