Online gambling in Indonesia is a billion-dollar illegal industry.

Data from the Indonesian Financial Transaction Reports and Analysis Centre (INTRAC/PPATK) shows that online gambling in Indonesia generated Rp286.84 trillion in fund circulation, equivalent to about US$16 billion, in 2025.

Among Indonesia's population of approximately 280 million, about 1 in every 23 people deposited money into an online gambling platform. Addictive game mechanics and systems designed in favor of operators turn promises of quick returns into repeated losses.

Online gambling operators in Indonesia and other countries, including Thailand, Cambodia, and China, compete for Indonesian users. From October 2024, when Indonesia's current government took office, through July 2026, the Ministry of Communication and Digital Affairs acted against approximately 3.7 million items of gambling content across social media and websites while law enforcement carried out arrests and related operations.

Enforcement and competition have pushed operators toward Black Hat SEO and SEO Cloaking for more sustainable advertising and operations. They hack vulnerable websites, inject gambling pages designed to rank for selected queries, show search-optimized content to crawlers, and redirect visitors to domains under their control.

Cybercrime-as-a-Service and Online Gambling Marketing

The author was involved in incident response and technical analysis for several high-profile Indonesian institutions whose websites were hacked to promote online gambling. Despite promoting different brands, the attackers used similar tactics, techniques, and procedures (TTPs), suggesting the use of Cybercrime-as-a-Service for illegal online marketing.

Indonesian government and public institution websites have been frequent hacking targets for two decades.

Historically, hackers used their access mainly for web defacement and occasionally for more serious objectives such as data theft. In recent years, demand for online gambling promotion has created more opportunities to monetize that access by turning hacked websites into marketing infrastructure.

In these campaigns, attackers use hacked websites to promote gambling content through Search Engine Optimization (SEO).

SEO itself influences how content is discovered and positioned in search results. Because the website's SEO is manipulated without authorization using unconventional techniques, this activity is categorized as Black Hat SEO.

As recently as July 2026, Indonesian police arrested a hacker accused of using Black Hat SEO on websites in Indonesia and other countries to promote online gambling and earning hundreds of millions of rupiah. Similar groups have also been arrested previously, some of which earned billions of rupiah.

The relatively high profits encourage many Indonesian hackers to launch hacking campaigns and offer these promotional services to online gambling operators, or at least sell access to hacked websites to other affiliated hackers.

Research by Malanta exposed a massive cybercrime infrastructure supporting Indonesian gambling operations. It documented tactics including subdomain hijacking, website exploitation, and Android malware distribution. The hacked domains were not limited to Indonesia. Attackers abused any domains they could control.

This research focuses on website exploitation and SEO Cloaking, which have become increasingly common. It provides insight into how attackers quietly use trusted domains, particularly hacked Indonesian websites, to increase traffic to illegal online gambling platforms.

Scale in Indonesia

Reliable historical data on the number of affected Indonesian websites is difficult to obtain. Government reporting for .go.id has not consistently distinguished unique domains or websites from individual URLs.

A public copy of a 2024 internal memo from the Ministry of Communication and Digital Affairs recorded 28,719 gambling-injected URLs on government websites. Multiple injected URLs can belong to a single domain, so this figure does not represent the number of unique affected .go.id websites.

At the time of writing (August 2026), a quick analysis using SerpApi and an AI-assisted workflow still identified at least 1,485 distinct .go.id websites and at least 1,000 websites using other Indonesian high-level domains whose indexed results contained keywords related to gambling promotion, even after a large-scale cleanup by the government.

The author has not investigated every result, so these figures should not be treated as the total number of victims. However, hundreds of the results have been confirmed as valid.

The combined count is likely a lower bound and may grow as more affected websites are discovered or newly hacked.

SEO Cloaking

SEO Cloaking is a Black Hat SEO technique that serves search crawlers different content from what other visitors receive. When a request matches Googlebot or another crawler, the hacked website returns HTML containing targeted marketing keywords.

In these campaigns, injected pages target queries such as slot, gac*r, and specific gambling brand names for indexing by the crawler. Gambling brands can therefore appear in search results under trusted domains without exposing the advertisement to every visitor.

The use of hacked websites to inject illegal marketing material has existed since the early years of search engines. SEO Cloaking itself has been used increasingly over the past five years.

In 2022, Wiz documented related cloaking and redirection campaigns across East Asian websites, including campaigns promoting gambling.

Over the past several years, SEO Cloaking for online gambling has drawn growing interest in Black Hat SEO and underground hacking forums, including discussions focused on the Indonesian market.

Trusted domains such as .go.id can rank prominently for users in Indonesia. Hackers can charge per website, delivered traffic, or placement duration. They may also sell monthly placements across collections of hacked domains.

Compared with obvious web defacement or visible page and keyword injection, SEO Cloaking is harder to detect. It can remain active longer and generate more profit for hackers and illegal gambling operators.

AMP Abuse

Manipulating search engine results alone is not enough for hackers. They also need a mechanism that presents users with a clearer advertisement. To ensure that only users who click the manipulated search result see the advertisement, hackers use AMP.

AMP, originally Accelerated Mobile Pages, allows a website owner to provide a separate HTML version that a search engine such as Google can reference and display instead of the original page. Despite the word Mobile in its original name, AMP can also be served to desktop users.

When injecting code into a website page, attackers can add or replace its AMP version with a page hosted at an external URL they control. After reindexing, the search engine stores the hacker's AMP page as a reference, with the gambling advertisement embedded in its content. When the search result appears and is clicked, that referenced page is displayed.

Notably, in many cases hackers configured AMP only for mobile view. Desktop users who click the same search result still visit the normal web page without AMP. This further reduces suspicion when administrators or security analysts inspect the search result only from a desktop view.

Attack Chain

The cases reveal a recurring attack chain. Attackers hack the web application, establish persistence, expand access to the server, and attempt to reach other systems.

The sequence below combines findings across multiple incidents. No single victim necessarily experienced every stage or method.

• Initial access. Many victims exposed vulnerabilities that were easily exploited, including through automated scanning. In cases handled by the author, attackers exploited vulnerable WordPress installations and insecure file-upload functions in internally developed PHP applications. Across the wider campaign, the author also observed reused credentials, access retained from earlier hacks, access to web shells sold in underground forums, and entry through other affected systems.
• Application persistence. After gaining command execution, for the WordPress victim, attackers created WordPress-specific backdoors using WordPress library code while avoiding suspicious PHP functions such as eval or system. The backdoors provided access to the administration panel without directly logging in with a user account. Attackers also installed obfuscated web shells disguised as legitimate files to manage files and execute commands on the server. Payloads were loaded in stages or concealed inside other files to pass basic scanner checks.
• Remote control. When access extended to the server, attackers deployed a Remote Access Trojan (RAT) based on GSocket and launched it through .bashrc, Cron, or systemd. Multiple execution paths restored access when one mechanism was removed. Disguised process names and outbound communication over TCP port 443 made the activity resemble normal system activity.
• Privilege escalation. When applicable, attackers performed privilege escalation. In one case, a fake sudo wrapper stole the password of a local user with privileged access and allowed the attacker to become root. Other potential escalation paths included vulnerable system scripts running as root and unpatched Linux kernels.
• Lateral movement. Whenever possible, attackers tried to reach other victims from a server they already controlled. Observed paths in cases handled by the author included the use of sensitive SSH private keys, filesystem access as another user on the server, access to other websites hosted on the same server, and cloud or server-management API keys.
• Evidence tampering. Attackers deleted local log entries and malicious files, often while administrators were less likely to observe the activity. They also backdated mtime to make malicious files resemble older legitimate files.
• Actions on objectives. Attackers injected SEO code into application files processed by the main request flow. The code identified Googlebot and other crawlers through the requester's User-Agent, then served crafted HTML that placed gambling content in search results and directed search clicks to a gambling advertisement through AMP.

This chain explains why removing the injected advertisement alone is insufficient. Recovery must verify application code, administrative credentials, local accounts, scheduled execution, running binaries, privileged changes, connected systems, and logs stored outside the affected server.

In one victim, the author found an unusual indicator that the hacker could execute shell commands through the QEMU Guest Agent. This suggested potential access through the hosting provider's virtualization infrastructure rather than the victim VM alone. The author could not confirm how the provider-side access was obtained because they had neither access nor authorization to investigate the hosting environment. The author notified the hosting provider of the finding.

Action on Objectives

SEO Code Injection

Attackers performed SEO code injection to place hacked websites in search results for gambling queries and direct search users to advertisements controlled by the operator.

The injection generally avoided changing the main index file.

On WordPress-based websites, attackers often used Must Use Plugins under /mu-plugins, active themes, plugins, or WordPress core files. On other PHP websites, they modified shared includes, application components, or framework files loaded with each request. Some injections were distributed across multiple files, making complete removal harder.

The injected PHP checked the visitor's User-Agent to detect Googlebot and other crawlers. Filtered requests received different HTML containing the AMP configuration. Meanwhile, visitors whose User-Agent was not detected as a crawler received the original, unmodified content.

The HTML served to crawlers often did not reside in the PHP code itself, but in a separate file or at an external URL controlled by the hackers.

The author found no samples of crawler checks that validated the source IP against Googlebot ranges or performed similar network checks.

The attackers may not have considered IP validation necessary or may have avoided it because Googlebot addresses change. Future variants may still add this validation to restrict payload delivery and make dynamic analysis harder.

The overall mechanism produces the flow intended by the hackers.

• Users searching Google for terms such as slot, gac*r, or specific gambling brands would find a hacked website based on the content served to the crawler.
• Searches for terms genuinely relevant to the website remain unmanipulated and return the original website.
• Opening a manipulated search result can take the visitor to the referenced AMP page containing the gambling advertisement instead of the original page.
• Direct access to the website continues to show the original page without any injected content.

Online Gambling Advertisement

The actual gambling advertisement content resides on the AMP page.

Hackers use AMP as both the advertisement and landing page and can change it dynamically by linking to another online gambling domain when the government blocks the current domain or another brand needs a similar service.

The AMP pages often used festive content and attractive promotional images that were clearly AI-generated, with prominent links directing visitors to the operator's main gambling domain.

Importantly, the author found that many AMP pages were hosted on Cloudflare Pages, possibly because it offered free and flexible deployment, including free pages.dev subdomains.

Google Search Console Takeover

Google Search Console can be used to view information about a website and its performance in Google Search. If attackers gain access, they can review indexed queries, impressions, and clicks, request indexing, and confirm that SEO Cloaking and AMP pages are working as intended.

Attackers can verify themselves as site owners by placing a unique verification file on the hacked website or injecting a Google site-verification meta tag into its HTML. Once verified, attackers can access the Google Search Console property for the hacked website.

Search performance metrics also have commercial value. Cybercrime-as-a-Service providers can report the traffic and keyword performance to their clients, justify service fees, and negotiate higher payments.

Hacked Websites as Advertising Engines

The large number of hacked websites serving keywords selected by online gambling operators has created an advertising engine and traffic funnel for them.

Search data from one victim alone recorded 4.5 million impressions and 150,000 clicks from gambling-related queries during approximately three months of compromise in 2026.

The author analyzed the ten most common general gambling keywords recorded in Google Search Console data from hacked websites. These keywords did not contain any specific online gambling brand or website name.

Across Indonesia, these keywords rose sharply in 2025. The increase may indicate a large wave of hacks that year. Users could enter these terms in Google and find multiple hacked websites that served as routes to online gambling websites.

Their popularity fell sharply in 2026. Further analysis showed that many results for general keywords were censored or no longer displayed by Google. This may indicate that Google and the Indonesian government had worked together to restrict searches using general gambling keywords.

The relatively flat trend from 2020 to 2024 does not mean search activity was absent or limited. Search interest in 2025 was several dozen times higher.

With general keywords increasingly restricted, online gambling operators rely more heavily on the specific website or brand names they use.

Online gambling operators use brand names such as GAC*R***, SLOT***, and ***BET. They spread these names across YouTube, Instagram, Facebook, and TikTok through hundreds or thousands of spam accounts, dedicated advertising accounts, and paid influencers.

Once users recognize a brand, they can search for it on Google and encounter multiple hacked websites positioned for the same keyword.

The availability of multiple AMP pages as landing pages also gives online gambling operators the flexibility to use many domains at once. As long as users search for the appropriate brand keyword and open the corresponding AMP page, the domain name itself becomes irrelevant.

Brand-specific keywords provide a more effective path to gambling-related search results. Google can heavily filter results for general gambling terms following government requests, while identifying and restricting every individual brand is more difficult. With retained access to hacked websites or control of indexed AMP pages, hackers can replace an old brand with another when enforcement action or a decline in traffic weakens the original brand.

Detection and Recovery Opportunity

Site owners should register their domains in Google Search Console, confirm ownership, and review the users and owners listed under Settings. This provides a baseline for monitoring SEO integrity.

Some SEO Cloaking activity may not target Google, but Google Search Console should still be the primary tool for reviewing the website's search integrity.

Suspicious queries, such as online gambling queries appearing in Insights or Search results performance, can indicate a hack even when the website appears normal. The Test Live URL feature in Google Search Console can be used to emulate Googlebot crawling and indexing for inspection, and may expose the injected HTML.

Potential injected pages can also be found with a simple Google query such as slot site:<domain>. This query is useful for a quick check, but Google Search Console should be used for more reliable results.

Inspecting website files, logs, system files, runtime behavior, and network activity can reveal indicators of compromise and help determine the required recovery actions. Attackers sometimes also leave traces that provide clues to their online presence or even their real identities.

All injections and changes made by the hackers need to be removed, and vulnerabilities or issues used for initial access need to be fixed. If any part is missed, attackers can often regain access. AI can assist the analysis and cleanup, but the work still requires holistic planning and verification. Human experts may still be needed, particularly in complex cases.

Long-term risk reduction depends on good engineering and security practices. These practices can include well-managed web development and maintenance, a controlled DevOps pipeline, secure configuration, containerization, security monitoring and protection, and continuous vulnerability validation.

AI-Assisted Analysis and Recovery

Current AI models and agentic workflows can assist administrators with limited security expertise in analyzing attacks and performing recovery. Although AI can be powerful for incident response, its use should be carefully controlled to avoid unintended changes.

Installing and running an AI agent directly on a compromised server is not recommended.

The agent should run on a separate computer and work from a copy of the website files, preferably accompanied by a complete server image. If it must execute commands on the compromised server, it should connect through a constrained intermediary such as SSH MCP, and every action must be planned and reviewed before execution.

Results vary with the model, reasoning intensity, prompt, and available context. Context about the website technology, server contents, and specific incident-response and recovery requirements described in the prompt can guide the analysis.

Additional context may include a previous known-good state of the website files for integrity comparison, when available, and relevant logs for tracing suspicious activity.

At the time of writing (August 2026), GPT-5.6-sol and Opus 5 are among the most capable models for this use case.

SEO Integrity Protection

Organizations at high risk from this hacking campaign that want to protect their reputation can add controls specifically for SEO integrity.

The first approach is to automate monitoring through the Search Console API and search-result data sources such as SerpApi.

Queries that combine site:<domain> with selected keywords can identify unexpected pages or keywords associated with the domain. This automation can run periodically.

Second, when the risk is genuinely high enough, an SEO integrity proxy can be designed and built at the network edge. The proxy can identify search crawlers, inspect responses from the origin, and detect suspicious content in those responses.

Beyond detection, an SEO integrity proxy can provide protection by centralizing the content delivered to crawlers. This is particularly useful for static pages that rarely change because the HTML delivered to crawlers can be assured without depending on the origin. The controlled HTML should remain consistent with the content available to regular visitors to avoid being flagged or penalized by search engines.

SEO integrity protection requires additional engineering effort, and not every organization will choose to pursue it. Even so, the author's experience designing and developing this custom solution with institutional partners shows that the control can be highly effective and useful.

The primary issue when a website's SEO is cloaked or manipulated is still to identify and eradicate the root cause. SEO integrity protection does not clean the origin or remove the attacker's access. Its purpose is limited to ensuring that the domain continues to serve known-good HTML to crawlers, whether the origin is injected or not.

What the Indonesian Government and Authorities Can Do

This issue covers both illegal online gambling and the security of Indonesian websites themselves. The government needs to prioritize website security.

The number of Indonesian websites affected by SEO Cloaking, particularly government websites, shows that the government still needs action at scale. Hacked websites do not only increase the promotion of illegal online gambling. The affected systems also carry many other risks.

Securing government information systems is challenging because they are decentralized, with different applications and infrastructure across ministries, provinces, regencies, cities, and public bodies. Many systems were delivered as projects with limited ongoing application and infrastructure maintenance.

This challenge requires a more holistic government strategy covering people, process, and technology.

Several sustained actions can be taken.

• Optimize the use of AI across all workflows related to online gambling eradication, especially for securing institutional websites.
• Automate keyword searches and sweep institutional domains to detect systems that have become victims of online gambling attacks.
• Use AI to enumerate and map gambling brands, AMP pages, operator domains, bank accounts, phone numbers, and digital wallet identifiers for enforcement.
• Optimize the workflow for reporting and requesting keyword censorship from companies such as Google and Meta so the process becomes more efficient and effective.
• Pursue zero SEO Cloaking and illegal online gambling advertisements on .go.id domains through detection and firm action when affected sites are not cleaned within a defined period or by requiring the installation of a dedicated security solution designed for this purpose.
• Publish transparent performance metrics and establish an independent oversight body for the cybersecurity of public institutions and enforcement against hacking or illegal online gambling promotion.
• Consider a new strategy for better management and control of the many decentralized information systems that exist today.

Outlook

The incidents in this case study represent a sample of a broader campaign. Different threat actors can adopt the same tactics, techniques, and procedures, particularly SEO Cloaking and the use of hacked websites as advertising infrastructure.

The Indonesian government must first improve the security of its own information systems and reassess the national strategy for stronger cyber defense across its institutions.

As long as online gambling promotions remain visible in search results through hacked government websites, sustained control will require extensive additional effort and consideration of other strategies that can improve collective cyber defense.