The Trusted Domain Is Dead. A Hacked Thai College Just Proved It.
Brief
Somewhere in Thailand, a college’s web server has been doing double duty. By day it serves students and faculty.
In the background, unknown to its administrators, it has been serving as the most convincing link in an advertising fraud chain that anti-fraud researchers at ADEX describe as cloaking without cloaking code.
The setup is almost elegant in its simplicity. An advertiser buys ad inventory and points the ad not at a landing page but at a Google search. The top result for that search is km. chpc. ac. th, a real college domain in Thailand’s restricted . ac. th educational zone.
Click it and you land on an online casino, which is illegal to advertise in the country. At no point does anyone spin up a fake server, spoof a user agent, or serve different content to bots and humans.
Every piece of the chain is exactly what it appears to be. The fraud lives in the arrangement.