Cyber criminals promoted illegal betting platforms across 1,200 domains during IPL: CloudSEK

Multiple Indian government .gov websites were found compromised and injected with backlinks pointing to illegal betting platforms, exploiting the trust and search authority of official domains to funnel unsuspecting users toward illegal content, the report said.An email query sent to the Ministry of Electronics and IT in this regard did not elicit any reply.CloudSEK also found a second admin panel revealed a network of business-registered bank accounts consistent with money mule setups, used to receive and move user deposits while masking the link to platform operators.

Cyber criminals have been found promoting illegal betting platforms on over 1,200 domains, including government websites, using deep tech to make them appear credible during the ongoing IPL season, digital intelligence firm CloudSEK said in a report.

According to the report, the cyber criminals used AI deepfake tools to clone the faces and voices of Indian cricketers and popular content creators to fabricate endorsements for betting platforms and tipper channels.

The videos are produced cheaply and distributed across Instagram reels and Telegram before they can be taken down, the CloudSEK report said.

''Over 1,200 domains were found actively promoting illegal betting platforms during IPL 2026. CloudSEK accessed the admin panel of one such platform and found it was simultaneously operating over 25 different betting websites from a single backend - with full visibility into user deposits, bets, and withdrawal queues,'' the company said.

The cyber intelligence firm found that more than 9,300 user withdrawal requests were deliberately rejected by agents on this platform alone between May 2025 and May 2026, amounting to an estimated Rs 4.65 crore in losses.

''These were not system errors -- they were intentional, single-click denials. Multiple Indian government (.gov) websites were found compromised and injected with backlinks pointing to illegal betting platforms, exploiting the trust and search authority of official domains to funnel unsuspecting users toward illegal content,'' the report said.

An email query sent to the Ministry of Electronics and IT in this regard did not elicit any reply.

CloudSEK also found a second admin panel revealed a network of business-registered bank accounts consistent with money mule setups, used to receive and move user deposits while masking the link to platform operators.