Hackers Abuse Indian Government Domains to Push Illegal Gambling Websites Through Google Search

What happened

The initial access method remains unknown; stolen credentials, insider access, or compromised DNS (the system that turns a domain name into an address) providers are possibilities, not confirmed findings. Researchers observed a similar delegation involving online.esic.gov.in.

Infoblox researchers identified two unrelated operations , exploiting institutional namespaces for search engine optimization. Hackers have abused Indian government and educational domains to promote illegal gambling websites through Google Search, using unauthorized DNS changes to establish malicious subdomains while leaving legitimate websites operational. Google is an Internet and software company based in Mountain View, and its products and services include Google Search.

Another delegated government subzones to third-party nameservers, enabling broader control over subordinate DNS records.

cyber security Cyber Security News 3 min. The technique, called domain shadowing, allows attackers to misuse an organization’s domain without modifying its primary website.

The Indian government campaign affected maharashtra.gov.in, where unauthorized NS records delegated subzones including gam, games, search, live, and dpboss to ClouDNS nameservers. One, tracked as Hidden Hawk, mapped individual hostnames to externally hosted gambling pages.

Illegal Gambling Sites Unlike individual DNS aliases, these delegations moved authoritative control of entire subzones outside the government’s DNS environment. A wildcard beneath gam.maharashtra.gov.in also allowed arbitrary subordinate names to resolve, supporting numerous gambling-related hostnames.