A sprawling fraud network that has hosted hundreds of thousands of gambling sites for 14 years is now believed to be a dual operation, potentially tied to a nation-state, aiming at government and private-sector targets in the United States and Europe.
Security researchers note that while previous reports focused on individual components, the overall infrastructure is far larger and more sophisticated than earlier estimates, with links to WordPress and PHP app compromises, backdoors, and mass subdomain hijacking that enable covert activity.
The operation has rolled out 328,000 domains, comprising about 236,000 owned addresses and roughly 90,000 commandeered from legitimate sites, along with nearly 1,481 hijacked subdomains. The scale and longevity — 14 years of development and maintenance — suggest substantial resource investment and organisation.
Most of the gambling content targets Indonesian-speaking users, a market constrained by local law, while the attackers rely on Cloudflare to host sites and on major cloud providers such as AWS, Azure, and GitHub to host hijacked subdomains and content.
Malanta researchers say the network’s breadth and stealth indicate more than a purely financially motivated operation. They describe a state-level level of tradecraft aimed at reaching a broad range of targets in manufacturing, transport, healthcare, government, and education, while continuing to monetize through illicit gambling content. While attribution to a specific government remains unproven, the evidence points to a sophisticated espionage-adjacent operation hidden behind a scalable gambling network.
