Known malicious kitmediumother

Mexican government sites: sports-betting SEO pages

family: mx-gov-betting-seo-2026-11

Pages planted on compromised Mexican government websites (.gob.mx) that pose as sports guides, such as Liga MX standings or national-team histories. Search engines are shown the guide; visitors who arrive from a search are sent on to an online casino. The pages sit under paths such as /wp-style/ and /app/, with names ending in -guide.html.

Anchors

SMQL queryrun
domain:*.gob.mx AND url:"-guide" AND (url:"/wp-style/" OR url:"/app/")

Provenance

Added: 2026-11-07 23:11
The government site is the victim, not the operator. Matches the planted page paths on .gob.mx hosts only; similar pages on other Mexican public-sector domains that use different paths are not included. A page that answers 404 to an ordinary browser can still be live for search engines.

Sightings (17)Atom feed

HostScanScriptMatchScanned
cmascoatza.gob.mx9b1776d2…—query2026-11-08 06:31
patrimonio.tehuacan.gob.mx9a88bc99…—query2026-11-08 06:26
explora.tehuacan.gob.mx8dee2392…—query2026-10-26 03:24
computeh.tehuacan.gob.mx00bf0a26…—query2026-10-26 03:23
pagos.cmascoatza.gob.mx90751ea7…—query2026-10-26 03:22
soporte.tehuacan.gob.mxbc4c4745…—query2026-10-26 03:19
oficialia.juarez.gob.mxf313a954…—query2026-10-26 03:18
juarez.gob.mxf889539a…—query2026-10-25 23:32
wstrans01.juarez.gob.mx6f482639…—query2026-10-14 11:15
rub.juarez.gob.mxe44c792b…—query2026-06-28 17:01
s3.juarez.gob.mxe7ed4cb6…—query2026-05-22 03:53
www93.juarez.gob.mx3ad7a334…—query2026-05-22 03:52
apitran.juarez.gob.mx65619517…—query2026-05-20 11:13
apidu.juarez.gob.mx924c65b5…—query2026-05-20 11:11
time.juarez.gob.mx161def46…—query2026-05-20 11:09
congresoedomex.gob.mx1230ad55…—query2026-04-26 02:24
www84.juarez.gob.mx0ebccdf1…—query2026-03-26 18:01