Illegal Gambling Syndicate Hijacked 20 African Government Websites to Boost Google Rankings

An online gambling network believed to be operating from Indonesia allegedly hid casino pages inside government websites across Africa to boost its visibility in Google search results.

According to an investigation by Techpoint Africa, the operation has been identified on about 20 government websites spanning 16 African countries, including Nigeria, Egypt, Kenya, Uganda, Ghana, and South Africa.

Generally, Google assigns greater authority to established government websites than to newly created commercial domains. According to Zend Cybersecurity Threat Labs founder Chris Nwobi, the syndicate’s strategy was to quietly insert gambling pages into those trusted sites so their casino brands inherited some of their credibility.

“It’s like putting your ad on a government billboard,” Nwobi told Techpoint, describing how the operation relied on the reputation of official websites rather than traditional hacking for financial theft.

Smoke and Mirrors

The hack was often invisible. Nwobi said Nigeria’s Federal High Court website appeared completely normal to everyday visitors, but users arriving through Google searches related to gambling were instead shown casino content.

Records suggest a gambling-related subdomain may have existed on the court’s website as far back as November 2024.

The scheme first came to light in May after three Nigerian government websites were found to host Indonesian gambling content. One page reportedly displayed a “SLOT88” copyright notice.

By June, the activity had spread to additional Nigerian government agencies as well as websites in Egypt, Ghana and Kenya, according to Nwobi.

The researcher linked the syndicate to Indonesia through source code linked to GitHub accounts active during Indonesian working hours, customer-support telephone numbers with Indonesian connections, and payment pages using Indonesia’s QRIS national payment system.

The same infrastructure had been used to host fake webpages impersonating brands including PayPal, Amazon and AT&T, suggesting the compromised government websites were being exploited for multiple financially motivated campaigns rather than gambling promotion alone.

According to Nwobi, many of the affected servers contained outdated software, unpatched vulnerabilities, and internet-exposed administration panels, allowing attackers to gain access without deploying particularly sophisticated techniques.

SEO Boost

It’s unclear how much revenue the gambling operation generated. Nwobi told Techpoint that payments flowed through QRIS, Indonesia’s standardized national QR code payment system, into nominee accounts, making it impossible to calculate earnings from publicly available information.

Because online gambling is illegal in Indonesia, many operators run cross-border businesses using offshore infrastructure, intermediary payment networks, and companies registered in multiple jurisdictions to stay beyond the reach of domestic authorities.

The Indonesian payment system and support numbers suggest the gambling sites were built for Indonesian rather than African users, while the compromised African government websites were simply used to boost Google rankings.