Home / Resources / Open reports / Hacked government sites
Brand pages on hacked government and university sites
Google gets a page about a brand, and a person gets the normal site. We looked at 304 government and university sites in search results for 33 igaming and crypto brands. Data from August 6 to October 6, 2026.
government and university sites served Google a page about a brand that people did not get. This is cloaking
brands had at least one such site in their search results
of these sites were on the first page of Google for a brand search at least once
Google gets an app store page, and a person gets an error
- “brand app download”
- Poland
- 2026-08-10
- position 18
- m***.gov.af/crypto/…-free-download-for-android“Brand — Apps on Google Play”
Google200234 KBbrand name ×8
person40430 KBpage not found
A government site served Googlebot a 234 KB copy of an app store page with the brand name. A person got a 30 KB “page not found”. The difference is the proof, and we save Google's copy as evidence.
How the scheme works
| Step | What we saw |
|---|---|
| Someone gets access to a government or university site. They add pages in folders like /crypto/, /buy/ or /wiki/. | the same folders on unrelated sites |
| The pages target brand searches: app download, reviews, sign-up bonus, withdrawal. | 55 of 71 look like an app store page in Google |
| When Googlebot visits, the site returns a full page with the brand name. | 234 KB, brand name ×8 |
| When a person visits, the site returns an error, the normal site or a redirect. | 404, 30 KB |
| The page appears in Google for brand searches. | 41 sites on the first page |
| The site owner may remove the pages later. The search result with its date stays as evidence. | 17 sites returned an error to both when we checked |
Where these sites are
| Country | Sites found | Cloaking confirmed | Did not answer |
|---|---|---|---|
| Brazil | 82 | 24 | 21 |
| India | 67 | 20 | 33 |
| Philippines | 12 | 7 | 3 |
| Bangladesh | 12 | 6 | 3 |
| United States | 39 | 5 | 3 |
| Indonesia | 5 | 3 | 1 |
| Afghanistan | 10 | 2 | 3 |
| Vietnam | 5 | 1 | 1 |
| Egypt | 3 | 1 | 1 |
| South Korea | 1 | 1 | 0 |
| Ethiopia | 1 | 1 | 0 |
| 31 other countries | 67 | 0 | 13 |
| Total, 42 countries | 304 | 71 | 82 |
Brazil and India have the most such sites. Most of them belong to states and cities, not to the national government. In India, half of the sites did not respond at all.
It is deception only when Google sees more than people
Google gets more
We count a site only when Googlebot gets more content than a person. The extra content must be about a brand. Identical copies or a smaller copy for Google are not cloaking.
Bot protection is not deception
A justice department website returned an error to Googlebot and a normal page to a browser. This is protection from bots. This difference showed up on 8 sites, and we do not count it as cloaking.
Topic words are not proof
A state lottery site uses the word “jackpot” because it runs a legal game. Regulators and police appear for “scam” searches for a reason. We excluded 47 such sites.
No response is not “clean”
Through our proxy, 14 government sites in India and the Philippines looked dead. The proxy blocks government domains. One of them opened directly. We mark such sites “not checked”.
One toolkit, many brands
One site, many brands
36 sites appeared in Google for two or more brands. One state portal in India appeared for 7 brands. On 13 sites, we confirmed cloaking for two or more brands.
Fake app store pages
55 of the 71 sites appeared in Google with the title “Apps on Google Play”. The page copies an app store listing with a brand name.
One template, five folders
For one exchange, the same review template appeared in five different folders on unrelated sites. The titles were dated 2026 and 2027.
We notify the owner and the hosting provider of the hacked site. This is a report about a hack, so it needs no letter of authorization (LOA). We also remove the URL from Google search. Parasite pages & hacked sites →
How we collected the data
Sample
- 351 government and university sites from Google results for 33 igaming and crypto brands.
- 47 of them are regulators, police, lotteries and colleges with a similar name. We excluded them.
- We requested the other 304 pages twice: as Googlebot and as a normal browser. Then we counted mentions of the brand name in each copy.
- We save Google's copy of the page as evidence.
- This is a snapshot as of the dates we checked. Sites get cleaned and hacked again.
What is not included
- We could not get a response from 82 sites. Some of them block our proxy. They are “not checked”, not “clean”.
- For 99 sites, we could not decide. In most cases, neither copy had the brand name. We mark them “not determined”.
- 29 sites show the same page to everyone. Some are hacked, and some only share a name with a brand. This is not cloaking, so they are not in the 71.
- Our check changes only the browser name. A site that recognizes Google by its IP address can hide the difference.
- We count each site once, even if it carried pages for several brands.
- We do not name brands or sites.
Decloaking → · Method → · The same check for your brand, free →
See who's profiting from your brand
Send a request. Within 1 business day we'll show you who is making money off your name and what we can take down. Free.