Hijacking Trust: Domain Shadowing Abuses Government and School DNS

Domain shadowing occurs when someone with DNS or domain-management access creates malicious subdomains while leaving legitimate records intact. In the operations described by Infoblox, the methods included individual CNAME records and delegation of subzones to external authoritative nameservers. The main institutional website may continue working normally while unauthorized subdomains resolve to external pages.

1. Gain unauthorized access to DNS, registrar, or provider management; the initial access method remains unknown.
2. Add CNAME records pointing to external hosting, or delegate subzones using NS records.
3. Use wildcard records where available so multiple hostnames resolve.
4. Publish gambling landing pages or search-engine-optimization doorway content on external hosting or CDN infrastructure.
5. Exploit the perceived legitimacy of government or school domains to attract search traffic.

This is a high-level reconstruction from public reporting, not proof that every step occurred in every affected environment.

Possible DNS account compromise / unauthorized access → zone modification → CNAME records or NS delegation → hostnames resolve → external gambling pages → search traffic and visitors redirected to gambling operators.

Credential theft, insider access, or registrar/provider compromise remain hypotheses because the public reporting does not establish the initial access method.

The reported objective was gambling promotion and traffic acquisition, not demonstrated mass theft of institutional records. The primary asset abused was the institution’s domain reputation and namespace.

• Visitors may trust pages because the hostname appears beneath a familiar government or school domain.
• Unauthorized pages may expose visitors to deceptive promotions, scams, credential harvesting, or follow-on risks; these are plausible risks, not confirmed outcomes for every page.
• Institutions face reputational harm, unauthorized search-engine indexing, and potential future repurposing of the subdomains.

• At least August 2025: gambling-related records observed under subdomains of maharashtra.gov.in.
• 6 July–1 October 2026: a school-domain gambling page was observed through a CNAME-linked Cloudflare Pages hostname.
• Mid-October 2026: unauthorized Maharashtra/ESIC delegations were no longer observed, suggesting remediation.
• 26 October 2026: Infoblox published an investigation describing two unrelated operations, including more than 850 observed entry points associated with Hidden Hawk across eight institutional domains.
• 27 October 2026: further public reporting summarized DNS-record abuse.

Infoblox reported that Hidden Hawk offered gambling SEO services via Telegram and linked it to more than 30 gambling brands and more than 850 observed entry points across eight institutional domains in Bangladesh, India, and Mexico. These were minimum observed figures at publication.

The Maharashtra/ESIC operation was separate. The available evidence does not support attributing that operation to Hidden Hawk or naming a specific individual or state actor. Initial access remains unknown.

DNS is separate from the content served by an institution’s homepage. New CNAME records or delegated subzones can route new hostnames to external pages without changing the homepage. Homepage uptime checks and application logs may therefore miss the activity.

Monitor authoritative DNS zones, registrar/provider audit logs, new subdomains, unexpected CNAME targets, NS delegations, wildcard records, and certificates for unapproved hostnames.

• Protect registrar and DNS-provider accounts with MFA, unique credentials, limited administrators, and change approval.
• Alert on zone changes, new CNAME/A/AAAA records, NS delegations, wildcard records, and nameserver changes.
• Maintain an inventory of approved hostnames and delegated subdomains, including owners and business purpose.
• Review unfamiliar records and hosting destinations; validate before removing records to avoid outages.
• Use DNSSEC where appropriate, while remembering it does not stop an authorized or compromised administrator from publishing malicious records.
• Monitor certificate-transparency logs and search results; test subdomains, not just the homepage.
• Preserve DNS history and provider logs, remove unauthorized records, rotate credentials, review administrator access, and verify externally after remediation.
• Visitors should avoid entering credentials or payment details on suspicious pages and report questionable subdomains through official channels.

Domain shadowing can turn a trusted institutional namespace into a promotional channel while leaving the primary website apparently healthy. DNS administration deserves the same security attention as web and identity infrastructure.

• Infoblox — “Borrowed Reputation: How domain shadowing placed illegal gambling pages beneath school and government domains” (26 October 2026)
• CircleID — reporting on government and school DNS-record abuse (27 October 2026)
• MITRE ATT&CK T1584.001 — Compromise Infrastructure: Domains
• UK NCSC — DNS hijacking guidance