How gambling pages end up on government websites, and why you should never buy those links

The short answer

Hackers break into trusted websites, mostly government and university ones, and hide gambling pages or links inside them. Google trusts those domains, so the gambling pages rank. It is illegal, it is happening at scale, and it is the real source of many cheap "high-authority" links sold in this industry.

It is happening at home

This is not a faraway problem. On 19 October 2026, Malaysiakini reported that Malaysia's national language agency, Dewan Bahasa dan Pustaka, had been hit three ways at once: hidden gambling links in the site's code, a subdomain replaced by a gambling page, and a Google result that sent searchers to a casino while ordinary visitors saw the normal page.

The security firm Syntx, which calls the campaign "Tundra", told Malaysiakini it had confirmed:

• 83 compromised government and university hosts
• across 43 organisations, including 34 government agencies and seven universities
• with 17 still live at its last check

Syntx traces the activity back to at least August 2023, when the official halal portal was reportedly replaced with a gambling site. A separate investigation by The Fourth and Tirto.ID found more than 150 government websites in Malaysia and Indonesia showing gambling ads.

The same story on four continents

The methods vary. In the Thai-market campaign, attackers took over forgotten cloud DNS records, so they never had to break into the main site at all. In Brazil, Check Point Research found custom server modules that quietly redirected selected visitors. In Africa, Techpoint Africa's investigation found the break-ins needed little skill: outdated software, unpatched holes and exposed admin panels.

How the trick stays hidden

The technique underneath most of this is cloaking. Sucuri described a clean example in January 2026. A few lines of malicious code were added to the bottom of a normal file. When Googlebot asks for a page, the code fetches gambling content from the attacker's server and shows that. When you or I visit, we get the normal site.

That is why site owners often find out last. Everything looks fine in the browser. The spam only shows up in Google.

Sucuri's wider numbers show how common this has become. In its 2023 report, remote scans found gambling and casino spam on 87,201 websites, a 200% increase on the year before. About 39% of the infected sites it cleaned were running outdated software.

Why this matters if you buy links

Here is the uncomfortable part for our industry. When someone offers ".gov backlinks" or "edu authority placements" for a low price and cannot say how they got them, there is a good chance they are selling access to hacked sites.

Three reasons to stay away:

1. They do not last. Malaysia's cybersecurity agency told Malaysiakini that most of these incidents can be fixed quickly. You pay, the link vanishes.
2. Your brand is in the evidence. Investigators follow the links to see who benefits.
3. It is a crime. Not a Google policy problem. A crime.

A checklist if you run a website

These steps come from the Sucuri write-up and the DNS advice in the Thai-campaign report.

1. Search Google for your own domain plus words like "slot" or "casino". Look for pages you never made.
2. Use the URL Inspection tool in Google Search Console to see the page as Google sees it.
3. List every subdomain you own. Delete DNS records that point to cloud services you no longer use.
4. Update your CMS, plugins and themes.
5. Remove admin accounts you do not recognise, then change every password.
6. Watch for changes to core files and for connections to servers you do not know.

What we do not know

Who is behind each campaign is an assessment, not a proven fact. Reporters and researchers have pointed to scam centres in the Golden Triangle, a Chinese-speaking group, and an Indonesia-linked operation, depending on the campaign. None of the reports says how much money the pages made.