Borrowed Reputation: Domain Shadowing and Gambling SEO
Infoblox, Monday, October 26th, 2026
Infoblox details two domain shadowing operations that hid illegal gambling SEO content under school and government domains.
Infoblox Threat Intel describes two unrelated operations that placed illegal gambling content under legitimate school and government domains by creating DNS records without altering the organizations' main websites.
A group called Hidden Hawk added CNAME records under institutional domains in Bangladesh, India, and Mexico, mostly pointing to Cloudflare Pages, and sells this SEO infrastructure to several gambling brands.
A second operation delegated subzones under Indian government domains to a third-party DNS provider and used wildcards so arbitrary hostnames would resolve.
Infoblox advises monitoring NS delegations, wildcards, and unexpected CNAMEs, and securing DNS-management credentials with MFA.