Two unrelated threat operations exploited domain shadowing techniques to insert illegal gambling content under legitimate educational and government domains in Bangladesh, India, and Mexico. Attackers gained unauthorized DNS administration access, creating CNAME records and delegating subzones to third-party nameservers, leveraging institutional domain reputations for search engine optimization. The campaigns affected over 850 entry points across eight domains, primarily hosting gambling pages on Cloudflare Pages. These operations served illegal gambling content targeting Indonesian and Indian markets, exploiting institutional trust to boost search rankings and traffic while leaving primary websites intact and potentially unnoticed by domain owners.
