Top University Websites Hijacked to Serve Porn and Malware in Widespread Scam
The Hijack
Hundreds of subdomains belonging to prestigious universities including UC Berkeley, Columbia University, and Washington University in St. Louis are redirecting visitors to explicit pornographic content and malicious scam pages, researcher Alex Shakhov revealed.
The compromised domains include causal.stat.berkeley.edu showing porn videos, conversion-dev.svc.cul.columbia.edu pointing to a porn site called "Brazzers Gym," and provost.washu.edu hosting a fake malware alert demanding payment. In total, at least 34 universities have been affected.
“This is not a sophisticated hack—it’s basic neglect,” said Shakhov, founder of SH Consulting. “The scammers are exploiting a clerical error that universities never bothered to fix.”
Background: The Technical Flaw
When universities create subdomains (e.g., provost.washu.edu), they set up a CNAME record that links the subdomain to a canonical domain. This is common for temporary projects, event sites, or third‑party services.
Once the subdomain is no longer needed, administrators often forget to delete the CNAME record. The orphaned record becomes a dangling pointer—a prime target for attackers like the group tracked as Hazy Hawk, who register the now‑unowned canonical domain and take control of the subdomain.
Shakhov explained: “It’s like leaving your front door unlocked after moving out—anyone can walk in and put up their own sign.”
What This Means
The hijacked subdomains damage the universities’ reputations, erode trust in their .edu domains, and expose users to explicit content and scams. Victims landing on the fake malware page are pressured to pay a fee for a non‑existent cleanup.
Google search results currently list thousands of these hijacked pages, meaning the problem is far from contained. “Universities must audit their DNS records immediately and remove obsolete CNAME entries,” Shakhov urged.
Without prompt action, the same technique could be used to serve phishing sites, distribute malware, or conduct other attacks under a trusted .edu banner.
Related Articles
- Canada Unveils POET Mission to Discover Earth-Sized Exoplanets
- Beyond Tatooine: 10 Surprising Truths About Planets in Binary Star Systems
- How Flowering Plants Survived the Dinosaur-Killing Asteroid: The Role of Genome Duplication
- How to Analyze Ransomware Threat Landscape Data: A Q1 2026 Guide
- How AI Is Transforming Soil Science for a Sustainable Future
- How to Get Rich in Any Era: A Historical Guide to Financial Flexibility
- 2026 Poised to Overtake 2024 as the Hottest Year, Says Renowned Climatologist
- Mastering Test-Time Compute: A Step-by-Step Guide to Smarter AI Reasoning