An online gambling network, thought to be based in Indonesia, is accused of embedding casino pages within government websites across various African nations to enhance its visibility in Google search rankings.
A recent investigation by Techpoint Africa uncovered this operation across approximately 20 government websites in 16 African countries, including Nigeria, Egypt, Kenya, Uganda, Ghana, and South Africa.
Typically, Google tends to prioritize well-established government websites over newer commercial ones. Chris Nwobi, founder of Zend Cybersecurity Threat Labs, stated that the group’s tactic involved stealthily integrating gambling pages into these reputable sites, thereby allowing their casino brands to inherit some credibility.
“It’s akin to placing your advertisement on a government billboard,” Nwobi shared with Techpoint, explaining how the operation depended on the trust associated with official websites rather than employing traditional hacking methods for financial gain.
Illusion and Deception
The infiltration was often undetectable. Nwobi mentioned that Nigeria’s Federal High Court website appeared completely normal for average users, but those landing via Google searches related to gambling were redirected to casino content instead.
Evidence suggests that a gambling-related subdomain might have been operational on the court’s website since November 2024.
This scheme came into the spotlight in May when three Nigerian government websites were discovered hosting Indonesian gambling material. One page reportedly displayed a copyright notice for “SLOT88.”
By June, the activities had expanded to further Nigerian governmental agencies and additional websites in Egypt, Ghana, and Kenya, according to Nwobi.
The researcher traced connections back to Indonesia through source code associated with GitHub accounts active during Indonesian business hours, customer support numbers linked to Indonesia, and payment pages employing Indonesia’s QRIS national payment system.
This same framework was found to support fraudulent webpages mimicking brands such as PayPal, Amazon, and AT&T, indicating that the compromised government sites were used for various financially driven campaigns beyond just promoting gambling.
Nwobi stated that many of the compromised servers utilized outdated software, unpatched vulnerabilities, and exposed administrative panels, enabling hackers to gain access without resorting to particularly advanced techniques.
Boosting Search Rankings
The total revenue generated by the gambling operation remains unclear. Nwobi indicated to Techpoint that payments were routed through QRIS, Indonesia’s standardized national QR code payment system, into nominee accounts, making it difficult to ascertain earnings from publicly accessible data.
Given that online gambling is illegal in Indonesia, numerous operators pursue cross-border ventures using offshore infrastructure, intermediary payment networks, and enterprises registered across multiple jurisdictions to evade local authorities.
The indicators of Indonesian payment systems and support numbers imply that the gambling sites were primarily designed for Indonesian users, while the compromised African government websites were merely leveraged to enhance Google rankings.