Hackers have been exploiting government and educational domain names in countries like Bangladesh, India, and Mexico to host illegal gambling sites. These attacks involve setting up unauthorized subdomains that redirect users to gambling content—while leaving main institutional websites appearing untouched and operational.
How the Abuses Work
The abuse hinges on DNS manipulation. In one set of operations, unknown threat actors created CNAME records under official domains—especially schools and government entities—that pointed toward gambling content hosted on external platforms. These CNAME targets were often Cloudflare Pages, not servers belonging to the institutions themselves. In many instances, attackers fashioned hostnames that resemble the real domain, replacing dots with hyphens to obscure the connection. One secondary school in Bangladesh had gambling content visible from July 6 through October 1, 2026. Multiple school domains in Bangladesh had dozens to over 240 hijacked entries apiece, while a Mexican domain had more than 50 incidents. A Kerala government subdomain was directly hosting gambling content—and it also received CNAME connections from school domains. Researchers observed that the Kerala hijack was partially fixed as of July 2026.
A separate operation targeted parts of the Maharashtra government infrastructure and an ESIC subdomain in India. Here, attackers didn’t merely add records—they inserted unauthorized nameserver delegations using ClouDNS. This move allowed them to control entire subzones outside the government’s official DNS environment. Wildcard DNS records under these delegated zones made it possible for almost any arbitrary hostname to resolve to an attacker-owned resource. The affected infrastructure was linked to gambling-related doorway pages covering betting, rummy, satta matka, and lotteries, delivered via popular CDNs like DigitalOcean, Amazon CloudFront, and BunnyCDN. This operation dates back to at least August 2025; signs suggest it was cleaned up by mid-October 2026.
Impacts & Risk Indicators
Despite the gravity of the abuse, there’s no confirmed case of malware distribution or direct data theft so far. The main damage is reputational—trusted government or school websites unknowingly funneling web traffic to gambling pages, especially through search engine visibility. Detection is also difficult because the main institutional sites continue to function as expected, concealing the malicious subdomains. Security teams are urged to monitor several signs: unexpected CNAME entries, DNS delegations that bypass usual infrastructure, and wildcard records pointing to external nameservers. Certificate transparency logs and registrar records can also offer clues.
Examples of compromised domains include several Bangladeshi school sites (e.g. raahs.edu.bd, wsbachs.edu.bd), Kerala government domains, and Maharashtra government subzones like gam.maharashtra.gov.in and esic.gov.in. Attackers also leveraged link shortening and image hosting services as part of the infrastructure.
To respond to these abuses, institutions should identify and remove unauthorized DNS records, review logs with their registrar and DNS provider to trace how access was gained, rotate any exposed credentials, and enforce multifactor authentication. Blocking the entire institutional domain is not advised because it could disrupt legitimate services. Instead, focus efforts on removing attacker-controlled hostnames and managed infrastructure.
These findings come from a report published October 26, 2026, by researchers who around that time were continuing investigations into what they call “domain shadowing”—an attack method allowing bad actors to hide illicit content under legitimate digital properties without altering main website appearances.
Why this matters: When state or school domains are hijacked like this, it undermines public trust, can mislead citizens, and potentially draws in traffic that could expose people to legal or financial risks. For cybersecurity teams, the takeaway isn’t just more monitoring—it’s taking a hard look at how DNS permissions, delegation, and account access are structured. What to watch: signs of external nameserver delegation, sudden surges in unfamiliar subdomains, and any external hosting tied to institutional DNS entries. Remediation should be swift and surgical, not draconian.
What to Keep an Eye On
- Unexplained DNS record changes—especially CNAMEs pointing to external services.
- New or unauthorized nameserver delegations, particularly to third parties.
- Wildcard DNS records under government or school domains.
- Certificate transparency mismatches or unapproved certificate issuance.
- Gateways or subdomains suddenly returning gambling or doorway-content when searched.
As state institutions digitize, their DNS infrastructure becomes part of their attack surface. Ensuring that every change—from registrar controls to subdomain configuration—is audited could make all the difference in preventing abuse like this.
Closing analysis: This trend in domain shadowing signals an evolution in how illicit actors approach visibility and trust. Instead of phishing or malware, they are leveraging the legitimacy of government and school domains to gain search engine advantage. The long-term risk is not just reputational—it’s a potential for legal action, regulatory scrutiny, and erosion of trust in public institutions. Going forward, governments globally must prioritize DNS governance and harden the bottlenecks attackers seem to be exploiting.
