Date: 10/27/2026
Severity: Critical
Summary
Researchers identified Hidden Hawk, an operation abusing domain shadowing to promote illegal Indonesian gambling brands through compromised school and government subdomains across Bangladesh, India, and Mexico. The actor uses unauthorized DNS CNAME records to direct institutional hostnames to gambling pages, primarily hosted on Cloudflare Pages, leveraging trusted domain reputations for SEO manipulation and increased search visibility. Infoblox engaged with Hidden Hawk through Telegram, where the actor reportedly sells SEO services, including backlink optimization and custom landing pages. Although the initial access method remains unknown, domain shadowing can follow credential theft or compromise of DNS management accounts.
Indicators of Compromise (IOC) List
Domain/Urls | raahs.edu.bd maishadihighschool.edu.bd dhabalsatihs.edu.bd sanguhs.edu.bd saaacademy.edu.bd wsbachs.edu.bd suneethi.sjd.kerala.gov.in escuelanormallarrainzar.edu.mx gam.maharashtra.gov.in games.maharashtra.gov.in search.maharashtra.gov.in live.maharashtra.gov.in dpboss.maharashtra.gov.in online.esic.gov.in mikale.me hinkale.me imgmahasuhu.io imghaxor.io imgstore.io d9d9t8dndf89z.cloudfront.net search-maharashtra-gov-in.b-cdn.net games-maharashtra-gov-in.b-cdn.ne maharashtra-gov-in.b-cdn.net |
IP Address | 168.144.156.92 |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "dhabalsatihs.edu.bd" or url like "dhabalsatihs.edu.bd" or siteurl like "dhabalsatihs.edu.bd" or domainname like "games-maharashtra-gov-in.b-cdn.ne" or url like "games-maharashtra-gov-in.b-cdn.ne" or siteurl like "games-maharashtra-gov-in.b-cdn.ne" or domainname like "imghaxor.io" or url like "imghaxor.io" or siteurl like "imghaxor.io" or domainname like "mikale.me" or url like "mikale.me" or siteurl like "mikale.me" or domainname like "raahs.edu.bd" or url like "raahs.edu.bd" or siteurl like "raahs.edu.bd" or domainname like "maishadihighschool.edu.bd" or url like "maishadihighschool.edu.bd" or siteurl like "maishadihighschool.edu.bd" or domainname like "saaacademy.edu.bd" or url like "saaacademy.edu.bd" or siteurl like "saaacademy.edu.bd" or domainname like "hinkale.me" or url like "hinkale.me" or siteurl like "hinkale.me" or domainname like "maharashtra-gov-in.b-cdn.net" or url like "maharashtra-gov-in.b-cdn.net" or siteurl like "maharashtra-gov-in.b-cdn.net" or domainname like "imgstore.io" or url like "imgstore.io" or siteurl like "imgstore.io" or domainname like "d9d9t8dndf89z.cloudfront.net" or url like "d9d9t8dndf89z.cloudfront.net" or siteurl like "d9d9t8dndf89z.cloudfront.net" or domainname like "imgmahasuhu.io" or url like "imgmahasuhu.io" or siteurl like "imgmahasuhu.io" or domainname like "escuelanormallarrainzar.edu.mx" or url like "escuelanormallarrainzar.edu.mx" or siteurl like "escuelanormallarrainzar.edu.mx" or domainname like "gam.maharashtra.gov.in" or url like "gam.maharashtra.gov.in" or siteurl like "gam.maharashtra.gov.in" or domainname like "games.maharashtra.gov.in" or url like "games.maharashtra.gov.in" or siteurl like "games.maharashtra.gov.in" or domainname like "suneethi.sjd.kerala.gov.in" or url like "suneethi.sjd.kerala.gov.in" or siteurl like "suneethi.sjd.kerala.gov.in" or domainname like "online.esic.gov.in" or url like "online.esic.gov.in" or siteurl like "online.esic.gov.in" or domainname like "wsbachs.edu.bd" or url like "wsbachs.edu.bd" or siteurl like "wsbachs.edu.bd" or domainname like "search.maharashtra.gov.in" or url like "search.maharashtra.gov.in" or siteurl like "search.maharashtra.gov.in" or domainname like "live.maharashtra.gov.in" or url like "live.maharashtra.gov.in" or siteurl like "live.maharashtra.gov.in" or domainname like "sanguhs.edu.bd" or url like "sanguhs.edu.bd" or siteurl like "sanguhs.edu.bd" or domainname like "dpboss.maharashtra.gov.in" or url like "dpboss.maharashtra.gov.in" or siteurl like "dpboss.maharashtra.gov.in" or domainname like "search-maharashtra-gov-in.b-cdn.net" or url like "search-maharashtra-gov-in.b-cdn.net" or siteurl like "search-maharashtra-gov-in.b-cdn.net" |
Detection Query 2 : | dstipaddress IN ("168.144.156.92") or srcipaddress IN ("168.144.156.92") |
Reference:
Borrowed Reputation: Domain Shadowing and Gambling SEO