A page belonging to km.chpc.ac.th, a website using Thailand’s academic-institution domain suffix, ended up doing something its administrators almost certainly never intended: ranking highly in Google search results for casino-related terms, and quietly funneling visitors who clicked on it into an illegal online gambling operation. Fraud-detection firm ADEX uncovered the scheme not by scanning for hacked websites directly, but by following a trail of suspicious advertising traffic back to its source.

No single fake step — just a chain of real ones

What makes this campaign notable isn’t a particularly novel piece of malware or a sophisticated new cloaking technique. According to ADEX, attackers compromised the Thai institution’s site and planted a casino-themed page on it — content with no connection to the college’s actual purpose. Because the underlying domain was a legitimate, aged academic site with whatever search authority that comes with, Google’s crawlers indexed and ranked the planted page well.

From there, the scheme relied on a redirect chain rather than outright deception at any single step. A user searching for gambling-related terms would see the compromised college page ranking near the top of results. Clicking it didn’t take them straight to a casino — instead, they were routed through what appeared to be an ordinary Google search results page, and only from there redirected onward to the actual illegal gambling site. As ADEX put it, describing the mechanics of the fraud: “No part of the chain was fabricated… Only the combination produced the violation.” Each individual hop looked legitimate in isolation; it was the sequence, engineered end to end by the attackers, that constituted the fraud.

Caught by following the money, not the malware

ADEX’s traffic-monitoring team wasn’t specifically hunting for compromised educational websites when it found the scheme. The discovery came while the firm was investigating an advertiser whose ad traffic was, unexpectedly, being routed through what looked like a generic Google search page rather than landing directly on the advertiser’s intended page. Pulling that thread back revealed the compromised college site sitting at the top of the chain — a reminder that some of the clearest signals of this kind of fraud show up in traffic and referral data long before anyone notices the compromised page itself.

One hacked page in a much larger pattern

The Thai college case is a single data point in what appears to be a substantial, ongoing problem across the region and beyond. Thai authorities have reported roughly 30 million gambling-related URLs spread across some 1,000 public-sector websites domestically. Indonesia, dealing with a similar wave, has blocked 683 government and educational sites found to be carrying gambling content. And the problem isn’t confined to opportunistic, one-off hacks: investigators have identified an underground marketplace specifically selling ready-made access to more than 15,000 already-compromised .gov, .edu, and other country-code domains — infrastructure attackers can rent or buy specifically because search engines and users already trust those domains more than a freshly registered one.

Why .gov and .edu sites are such attractive targets

Government and academic domains carry two things attackers specifically want: inherited trust with search engines, built up over years of legitimate backlinks and traffic, and often minimal day-to-day monitoring, since many such sites are maintained by small, under-resourced IT teams juggling far more than security. A single forgotten subdomain, an outdated content management system plugin, or reused administrative credentials can be enough of an opening, and once in, attackers gain access to a domain’s accumulated search ranking essentially for free.

What website operators — especially in government and education — should do

• Maintain a current inventory of every subdomain and legacy site under your organization’s domains; forgotten or rarely-updated subdomains are disproportionately likely to be the entry point.
• Periodically search your own domains the way an attacker or a curious user would — including gambling, pharmaceutical and other spam-adjacent keyword combinations — rather than assuming indexing issues would surface on their own.
• Re-check previously approved advertising or affiliate campaigns on a recurring basis, since redirect chains can be modified by an attacker at any point after initial approval, silently turning a clean campaign malicious.
• Treat unexplained spikes or anomalies in search-referred traffic to unfamiliar pages on your own domain as a compromise indicator worth investigating immediately, not routine analytics noise.
• Apply the same patching, credential hygiene and monitoring standards to secondary or departmental sites as to primary institutional domains — attackers don’t care which subdomain gets them the SEO trust they’re after.

For the institution itself, the damage extends beyond a single defaced page: search engines that detect this kind of abuse can penalize the entire domain’s ranking, and a college whose site was quietly laundering gambling traffic has a reputational cleanup job on top of a technical one.