– A concerning trend has resurfaced in India’s cybersecurity landscape, with several government subdomains being hijacked to promote offshore betting platforms and illegal online gambling. This subdomain hijacking incident, coupled with SEO poisoning, allows cybercriminals to manipulate search engine results and lure unsuspecting users into clicking on malicious links.
What is Subdomain Hijacking and SEO Poisoning?
Subdomain hijacking is a cyberattack where an attacker gains control of unused or misconfigured subdomains, often belonging to trusted institutions like government websites. The attackers then redirect these subdomains to malicious servers, injecting them with harmful content, including links to illegal activities like gambling and betting platforms.
SEO poisoning amplifies the threat by manipulating search engine results to rank the hijacked pages higher for popular searches related to gambling. As a result, unsuspecting individuals searching for gaming content may be redirected to these fraudulent subdomains, believing they are legitimate due to their .gov.in extension.
Compromised Government Domains
The attack targeted several Indian state and central government portals, including:
- Maharashtra Directorate General of Police Services (dgps.maharashtra.gov.in)
- Nuapada district portal, Odisha (nuapada.odisha.gov.in)
- Rajasthan Electricity Regulatory Commission (rerc.rajasthan.gov.in)
- Bihar online services portal (rconline.bihar.gov.in)
- Assam ICT portal (ict-ssa.assam.gov.in)
- University Grants Commission (old domain) (ugc.gov.in)
These hijacked subdomains had been abandoned or misconfigured, leaving them vulnerable to exploitation. The attackers took advantage of this by pointing the subdomains to their malicious servers, where they embedded content promoting betting, casino games, and other illegal online gambling services.
Impact on Public Trust and Cybersecurity Risks
The hijacking of .gov.in subdomains has serious repercussions on both public trust and cybersecurity. Many internet users inherently trust government domains for reliable and legitimate information. With these compromised subdomains still appearing high in search engine rankings, users are unknowingly exposed to fraudulent and illegal platforms that may lead to financial loss or personal data theft.
Experts highlight that subdomain hijacking often happens when old hosting configurations or third-party services like GitHub Pages or AWS are not properly decommissioned. Attackers exploit these “dangling” DNS records to claim control over the associated resources and use them for malicious purposes.
A Persistent Issue with No Visible Action
This is not the first time such an incident has occurred. The issue was first reported two years ago by G2G, and The Economic Times followed up on it last year. Despite multiple warnings, the problem continues, with no significant action taken by authorities.
As of now, no official response has been issued by the government regarding the current hijacking incidents, raising concerns over the lack of accountability and oversight in safeguarding the nation’s digital infrastructure.
A Call for Immediate Action
Experts emphasize the need for a comprehensive audit of all .gov.in domains to ensure they are secure and free from vulnerabilities. Timely DNS clean-up and the automated monitoring of government digital assets are essential to prevent further abuses of this nature. Until these systems are put in place, the hijacked subdomains remain an open invitation for cybercriminal misuse, further eroding public trust in India’s digital governance.
The Need for Stronger Digital Security Protocols
This incident underscores the importance of cybersecurity in protecting government digital assets. As India’s digital infrastructure continues to expand, robust measures must be taken to ensure that such vulnerabilities do not persist. In the face of evolving cyberattacks, stronger monitoring systems, better domain management practices, and enhanced security protocols are vital in protecting the interests of Indian citizens and safeguarding the integrity of government-run platforms.