Threat reportThreat IntelligenceTL-2026-2126
Illegal IPL Betting Platform Network: 1,200+ Domains, Deepfake Celebrity Endorsements, and Systematic Withdrawal Blocking (CloudSEK 'Hit Wicket' Report)
Illegal IPL Betting Platform Network (TL-2026-2126), also tracked as Hit Wicket, is a high-severity tracked intrusion set, first published 2026-08-23. It has no confirmed attribution, affects Government of India .gov.in public-sector websites (multiple, maps to 14 MITRE ATT&CK techniques (T1204.001, T1533, T1583.001), and is covered by 9 detection rules and 14 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 14MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 14Indicators of compromise
Key facts for TL-2026-2126
- Threat ID
- TL-2026-2126
- Also known as
- Hit Wicket
- Severity
- HIGH
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- government administration, consumer, financial-services, sports-entertainment
- Target regions
- india
- Detection rules
- 9
- Indicators of compromise
- 14
Malware and tooling in Illegal IPL Betting Platform Network
Malware and tooling: AI deepfake video/voice generation tooling, Clone betting scripts
How Illegal IPL Betting Platform Network works
CloudSEK documented a seasonal illegal-betting fraud ecosystem active during IPL 2026, spanning 1,200+ domains and a single backend managing 25+ betting sites, that used purchased clone scripts, AI deepfake celebrity endorsements, black-hat SEO backlink injection into compromised .gov.in government websites, and money-mule networks — while systematically denying withdrawal requests. Between May 2025 and May 2026 the operators of one such platform rejected over 9,300 withdrawal requests, an estimated ₹4.65 crore in user losses, with victims seeking recovery funds further preyed on by data-harvesting fake loan apps used for blackmail.
On May 20, 2026, CloudSEK published "Hit Wicket: Inside The Expansive Web of Scams Targeting Millions of IPL Fans This Season," authored by researcher Sourajeet Majumder, documenting what the firm characterizes as "not a collection of opportunistic scams" but "a structured, seasonal criminal industry" built around India's IPL cricket tournament.
The fraud chain begins with discovery and recruitment: self-styled "tipper" accounts on Telegram, Instagram, and YouTube Shorts promote betting/prediction platforms via affiliate referral links, earning commissions per referred depositor. AI-generated deepfake videos cloning the faces and voices of Indian public figures — CloudSEK specifically names YouTuber/content creator Ranveer Allahbadia and cricketer Smriti Mandhana — are used without consent to manufacture false endorsements of these platforms. Reach is amplified through bulk SMS campaigns using spoofed sender IDs, and through Meta Ads and Google Ads purchased to target cricket fans; the underlying phone-number lists used for SMS targeting are themselves harvested and sold by dedicated lead-generation services.
On the platform side, clone betting scripts are sold openly on Telegram and underground forums, letting operators stand up new betting sites rapidly and cheaply. CloudSEK obtained visibility into the admin panel of one such operation and found a single backend simultaneously managing 25+ distinct betting websites, offering live odds, in-play betting, deposit bonuses, and referral programs across all of them. The admin panel provides real-time user-activity tracking and an agent-based, territory-assigned operator structure with centralized, manual control over withdrawal approval/denial. Early wins are engineered to build user confidence and encourage larger deposits; once deposits grow, withdrawal requests are deliberately — not technically — denied by platform agents. CloudSEK's access to this single admin panel showed more than 9,300 withdrawal requests rejected between May 2025 and May 2026, worth an estimated ₹4.65 crore, with individual denied withdrawals documented up to ₹5 lakh.
Victims who chase lost deposits or seek recovery funds are steered toward fake loan apps that request excessive Android permissions to harvest contacts, call logs, and photos from the device; this data is then used to blackmail and coerce victims, a secondary extortion layer on top of the direct financial loss from blocked withdrawals.
A distinct pillar of the ecosystem is black-hat SEO abuse of Indian government (.gov.in) websites: CloudSEK reports use of "Hacklink Market," an open marketplace where cybercriminals can purchase access to thousands of already-compromised websites and receive dedicated control panels for injecting keyword-rich anchor-text backlinks. Attackers used this to inject betting-platform backlinks directly into .gov.in sites, exploiting the high domain authority and inherited institutional trust of government domains to elevate betting destinations in organic search rankings. A press query CloudSEK/reporting outlets sent to India's Ministry of Electronics and IT (MeitY) about the compromised government websites went unanswered as of publication.
Fund movement is handled through money-mule networks recruited via Telegram and WhatsApp; mules receive deposited funds into business-registered bank accounts, which mask the operators' identity and lend a veneer of legitimacy to the transactions. Follow-on reporting additionally describes cryptocurrency laundering routes and traditional hawala transfers used to move proceeds out of the formal banking system.
CloudSEK frames the operation as recurring and seasonal: infrastructure (domains, scripts, deepfake content, ad campaigns) is developed and refreshed year-round and escalates sharply during each IPL tournament window, with rapid platform-renewal cycles (spinning up new domains as old ones are reported/blocked) deliberately outpacing enforcement and takedown efforts. The report's authors warn the ecosystem is normalizing illegal gambling participation among young cricket fans through relentless, celebrity-fronted marketing.
MITRE ATT&CK techniques used in TL-2026-2126
Execution
Collection
T1533 Data from Local System; T1636.002 Call Log; T1636.003 Contact List
Resource Development
T1583.001 Domains; T1583.008 Malvertising; T1584.004 Server; T1585.001 Social Media Accounts; T1588.007 Artificial Intelligence; T1608.006 SEO Poisoning; T1650 Acquire Access
Reconnaissance
T1589 Gather Victim Identity Information
Impact
Stealth
Affected products and versions in Illegal IPL Betting Platform Network
- Government of India — .gov.in public-sector websites (multiple, unspecified departments/states)
Vulnerable versions: Unspecified — multiple compromised .gov.in domains used for backlink injection - Various unlicensed operators — Clone-script illegal IPL betting/prediction platforms (1,200+ domains, 25+ sites on one shared backend)
Vulnerable versions: All identified instances
Remediation for Illegal IPL Betting Platform Network
Immediate actions
- Submit takedown/abuse requests to registrars and hosting providers for identified illegal-betting domain clusters and the shared 25+-site backend
- Notify CERT-In and India's Ministry of Electronics and IT (MeitY) of confirmed .gov.in domains carrying injected betting backlinks for urgent remediation
- Block outbound/DNS resolution to known illegal-betting domain clusters at perimeter/web-proxy layer
- Advise users who transacted with flagged platforms to monitor linked bank accounts and revoke excessive Android permissions granted to loan/finance apps installed during the incident
- Report and request takedown of identified deepfake celebrity-endorsement videos and tipper/affiliate channels on Telegram, Instagram, and YouTube
Workarounds
- Government domain (.gov.in) operators should audit backlink profiles and search-index snapshots for unauthorized betting-related content injected via Hacklink-Market-style access
Longer-term hardening
- Harden .gov.in CMS platforms against unauthorized content/backlink injection via patch management, WAF, and file/content integrity monitoring
- Establish an expedited takedown channel with Telegram, Meta, and YouTube for tipper-channel and deepfake-endorsement abuse tied to illegal betting
- Deploy deepfake-detection tooling to monitor for unauthorized use of public figures' likeness in advertising/endorsement content
- Run public-awareness campaigns warning cricket fans about withdrawal-blocking betting scams and fake loan-app blackmail schemes
- Extend AML/KYC scrutiny to newly business-registered bank accounts exhibiting money-mule transaction patterns during IPL season
Timeline of Illegal IPL Betting Platform Network
- Start of the ~12-month window (May 2025-May 2026) during which the observed single-backend betting-platform admin panel logged systematic denial of withdrawal requests, per CloudSEK's direct access to the panel.
- End of the documented May 2025-May 2026 withdrawal-rejection window: over 9,300 withdrawal requests denied, an estimated ₹4.65 crore in user losses, from the single admin panel CloudSEK accessed.
- The420.in, FintechBizNews, Devdiscourse, Business Standard, and Asia Insurance Post syndicate/report on the CloudSEK findings the same day as publication.
- A press query sent to India's Ministry of Electronics and IT (MeitY) regarding the compromised .gov.in websites carrying injected betting backlinks goes unanswered as of publication.
- CloudSEK publishes 'Hit Wicket: Inside The Expansive Web of Scams Targeting Millions of IPL Fans This Season,' authored by researcher Sourajeet Majumder, detailing the 1,200+ domain betting fraud ecosystem, deepfake endorsements, and .gov.in SEO abuse.
- O Heraldo (Goa) publishes follow-up coverage, 'IPL 2026 becomes hunting ground for cybercriminals, fake betting apps and AI scams,' summarizing the CloudSEK findings for a regional Indian audience.
Sources cited for Illegal IPL Betting Platform Network
- Hit Wicket: Inside The Expansive Web of Scams Targeting Millions of IPL Fans This Season
- CloudSEK Flags Large Illegal IPL Betting Ecosystem Powered by AI Deepfakes
- IPL Scam Using Deepfakes: Rs4.65 Cr In Potential User Losses
- Cyber criminals promoted illegal betting platforms across 1,200 domains during IPL: CloudSEK
- Cybercriminals promoted illegal betting platforms during IPL: CloudSEK
- IPL 2026 becomes hunting ground for cybercriminals, fake betting apps and AI scams
- Cyber criminals promoted illegal betting platforms across 1,200 domains during IPL: CloudSEK
Detection coverage for TL-2026-2126
As of 2026-08-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2126 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.