Bangladesh government websites riddled with thousands of betting pages
Bangladesh’s government websites have become unwitting conduits for the promotion of online betting platforms. Dismislab’s recent research has discovered over 3,000 betting web pages, hosted on at least 11 government websites, actively promoting four major betting platforms.
A primary Google search within the ‘gov.bd’ domain, using keywords like ‘Casino’ and ‘Betting,’ along with a scrutiny of sitemaps of the websites found in search results, unveiled a staggering total of 3,295 betting pages across official websites of key government offices, educational institutions, and defense entities.
The ‘gov.bd’ domain refers to the top-level website domain assigned to government entities in Bangladesh.
Implicated government websites include the Bangladesh Economic Zones Authority, Local Government Division, Department of Public Libraries, Bangladesh Agricultural Development Corporation, Bangladesh Ansar and Village Defense party, Bangladesh Electricity Development Board, and educational institutions like the Rajshahi Education Board, Narayanganj Mohila College, and Kishoreganj Government Mohila College. Two government-registered online news portals have also been found promoting online betting.
While the findings raise questions regarding the management of government websites, Dismislab has notified the incidents to the Bangladesh e-Government Computer Incident Response Team (BDCIRT).
Despite Bangladesh’s strict stance against gambling and its advertising, online betting sites have managed to flout these regulations. They’ve targeted Bangladeshi users through Facebook ads and expanded their reach to television channels, OTT platforms, and billboards in Dhaka.
BEZA faces online betting onslaught
The Bangladesh Economic Zones Authority (BEZA), under the aegis of the Prime Minister’s Office, is dedicated to establishment of economic zones throughout the nation, driving swift economic growth through the expansion and diversification of industry, employment, production, and export. However, its official website has become the primary target of an online betting campaign, with a staggering total of 1493 betting web pages discovered on its main domain and seven subdomains.
These betting web pages are hidden within the complex web of 32 sub-domains belonging to the BEZA website. Some of them are indexed by Google and can be found with a simple keyword search. However, to explore further, Dismislab examined the sitemaps of each sub-domain and found that 7 of them had been compromised by betting promoters, in addition to the main site.
A sitemap provides information about the pages, videos, and other files on the site, and the relationships between them.
The betting web pages within the BEZA website are straightforward. Upon clicking, they present a complete page showcasing a betting platform, accompanied by advertisements enticing users with buttons labeled “Play Now,” “Join Now,” or “Sign Up Here.”
For instance, FancyWin, the betting page discovered concealed within the BEZA domain and its sub-domains, offers a 100% sign-up bonus and declares, “FancyWin: the premier cricket exchange betting platform in Bangladesh; register today and log in!” The 1493 betting pages found on the BEZA domains mostly promote three betting platforms: Jitaace, FancyWin, and SixSixS.
Other government websites hosting betting pages
Various government entities have fallen prey to this betting infiltration. Sitemap analysis reveals a staggering 358 such pages on the Local Government Division‘s website, 352 on the Bangladesh Agricultural Development Corporation‘s, 288 on the Bangladesh Ansar and Village Defense Party’s site, 281 on the Department of Public Libraries, 167 on the Financial Management Academy‘s, and 149 on the Feni Zila Parishad‘s site.
Clicking the “Sign Up Here” button on the Bangladesh Agricultural Development Corporation’s 352 betting pages redirects users to the registration page of a single betting site named “BhaggoBD.” The remaining funnel users to registration pages for betting apps Jitaace and FancyWin, same as the BEZA website.
Dismislab also uncovered betting pages on the websites of the Office of Chief Electricity Inspector (1), Directorate of Drug Administration (1, 2), Bangladesh Power Development Board (1) and even, Bangladesh Navy (1). All identified online betting pages were observed to be active until May 29th, the date of the report’s drafting.
Google indexed several other betting pages planted on the websites of Bangladesh Water Development Board, Ministry of Health and Family Welfare, and Directorate General of Defense Procurement (1), which are now inactive.
Education websites compromised
Dismislab ‘s investigation extended to uncovering betting campaign pages on the websites of three government colleges, education boards, and universities across the country.
Websites of Kishoreganj Government Mohila College, Narayanganj Government Mohila College (1, 2, 3), and Jashore Government City College, all hosted pages of Nagad88. In the case of Jashore, the betting-pages date back a few years, with the latest one originating in 2019.
A Jahangirnagar University website dedicated to first-year Bachelor (Honors) admissions hosts 170 betting pages. These pages direct users to Bhaggobd, another betting platform. Pages of betting and casino are also found on Rajshahi Education Board’s website (1, 2, 3).
The betting campaign also seeped into online forums tailored for educators in Bangladesh, such as Sikkhok Batayan. It hosts a post from August 2023 elaborating the introduction and usage of the Nagad88 betting app. Educators gain access to posting privileges on this platform by registering with an index number assigned to schools and colleges operating under the monthly pay order (MPO) scheme. This system has been previously abused, with instances of forged index numbers used to manipulate teachers’ salaries.
Registered news portals show betting pages
Online Betting pages were found on two registered online news portals listed by the Press Information Department in Bangladesh. The news sites, Daily Dinkal (www.dailydinkal.net) and Ajker Barta (www.ajkerbarta.com) host various betting pages in Indonesian Bahasa language.
According to online archive data, dailydinkal.net functioned as a newspaper until July 2020, after which it began hosting betting-related content. Similarly, Ajkerbarta.com operated as an online news portal until April 2021 before featuring betting platforms.
According to Ashraful Haque, a digital security expert at Engage Media, such online betting campaigns might have been orchestrated by planting various pages on websites without the knowledge of those managing them. “Hacking could occur due to incompetence or negligence in website management and server security by maintenance personnel,” he said. “Inadequate security measures during website development by third-party developers could also be a contributing factor.”
Dismislab notified the Bangladesh e-Government Computer Incident Response Team about these betting pages on May 30 via email.
Recently, TechCrunch reported that around four dozen “gov.in” website links associated with Indian states, including Bihar, Goa, Karnataka, Kerala, Mizoram, and Telangana, were redirecting to online betting platforms.
