> ## Content Index > Fetch the complete content index at: https://www.citizenjournal.us/llms.txt > Use this file to discover other available public pages before exploring further. # Kansas government subdomains hijacked to advertise porn, gambling, illegal streaming - URL: https://www.citizenjournal.us/kansas-government-subdomains-hijacked-to-advertise-porn-gambling-illegal-streaming/ - Published: 2026-08-12T16:59:47.000Z - Updated: 2026-08-15T21:56:32.000Z - Description: In one case, the hijacking went undetected for over two years - Author: Matthew Petillo - Tags: hcj, dnn, #news, mcj, scj, ncj, hutch, ksu, tcj, lcj, hays Sign up for our free newsletter and never miss a story. [Sign up free](https://subscribe.citizenjournal.us/?ref=citizenjournal.us) “82,997,121 jackpot won!” “Every black scatter spin can result in a large jackpot that's immediately credited to the player's balance.” “At BAWANGTOTO, entertainment and the opportunity to win big are perfectly combined in one premium platform, providing an unforgettable gaming experience.” These lines, originally written in Indonesian and translated, were advertising a gambling site. At the bottom of the page, the site falsely claimed to be hosted by Etsy, an online marketplace website. To entice people to join, the site claimed to sell discounted coins for the casino. The website that it was hosted on? A [subdomain](https://www.ionos.com/digitalguide/domains/domain-administration/what-is-a-subdomain/?ref=citizenjournal.us) of [ks.gov](http://ks.gov/?ref=citizenjournal.us), the official Kansas government [domain](https://www.cloudflare.com/learning/dns/glossary/what-is-a-domain-name/?ref=citizenjournal.us). A Citizen Journal investigation found four instances of dangling DNS records on Kansas Department of Agriculture subdomains, of which three were taken over by malicious actors. These websites were used to advertise gambling, OnlyFans accounts, porn, and pirated World Cup streams, both on the website and in Google results. In one case, bad actors were able to “squat” on the department’s domain for over two years. ![A screenshot of Google results for one of the affected subdomains, captured July 24, 2026. (citizen journal screenshot)](https://storage.ghost.io/c/f7/e6/f7e66a8b-8f27-493f-8b7e-664ecefd4c3d/content/images/2026/08/Screenshot-2026-07-24-133939-1.jpeg) A screenshot of Google results for one of the affected subdomains, captured July 24, 2026\. (citizen journal screenshot) Prior to publication, Citizen Journal disclosed this incident to the Kansas Department of Agriculture and agreed to hold off publishing this story until the security vulnerability was patched. In a statement, Heather Lansdowne, a spokesperson for the Kansas Department of Agriculture, confirmed Citizen Journal’s findings and said that the associated subdomains were part of department systems that were no longer active. “Our review found no evidence that KDA production systems, development systems, authentication services, or agency data were exposed through these DNS records,” Lansdowne said. “While two of the records resolved to third-party content, they were not connected to KDA-hosted applications or services.” --- ### A quick primer: Wait, what is a subdomain? The best way to think about domains and subdomains is as levels. You’ve probably heard of .com and .org, and in Citizen Journal’s case, .us. In the internet business, those are called **top-level domains.** Think of them as phone books that contain the entries of every website inside them. Every website has a top-level domain. From there, **second-level domains** are likely what you think of when you think about domains. Those are the actual domain names that you type in when you want to go to a website, such as [google.com](http://google.com/?ref=citizenjournal.us), [ks.gov](http://ks.gov/?ref=citizenjournal.us) and [citizenjournal.us](http://citizenjournal.us/?ref=citizenjournal.us). Think of them as phone numbers. Owners of domains can create **third-level domains, or subdomains**, as subsections of their site. For example, the subdomain [calendar.citizenjournal.us](http://calendar.citizenjournal.us/?ref=citizenjournal.us) leads to Citizen Journal’s calendar, and [h2h.citizenjournal.us](http://h2h.citizenjournal.us/?ref=citizenjournal.us) leads to Citizen Journal’s real estate product. Subdomains have several uses for website operators, typically to differentiate between different Internet services or organizations. These are like phone number extensions. Levels count from the right, and in theory, a website can create up to 127 levels. Most don’t. Only the owner of a domain can create subdomains, and they can create them instantly, for free, without question - just by creating what’s called a **DNS record.** These would be the whole list of phone numbers in a phone book, with all the necessary extensions to reach someone. --- Citizen Journal found this vulnerability while attempting to build a civic data tool in early July. Several of the domains that Citizen Journal found were related to [automated programmatic interfaces](https://www.ibm.com/think/topics/api?ref=citizenjournal.us), or APIs, which are used for software applications to exchange data with each other. Citizen Journal could not find any evidence that any data was stolen due to this incident and has independently confirmed that the affected links have been removed as of publication. ![](https://storage.ghost.io/c/f7/e6/f7e66a8b-8f27-493f-8b7e-664ecefd4c3d/content/images/2026/08/image.png) A screenshot of one of the affected subdomain links, taken from an archive. (citizen journal screenshot) Malicious actors were able to take over the subdomains through what is known as a [dangling DNS attack](https://www.paloaltonetworks.com/cyberpedia/what-is-a-dangling-dns?ref=citizenjournal.us). When a domain owner abandons the website that a subdomain points to, malicious actors can take it over. In the Kansas Department of Agriculture’s case, hijackers took over the dangling Microsoft Azure App Services DNS entry used for both development and live KDA websites. This attack exploited Azure’s behavior of allowing any Azure user to re-register App Services. Once the KDA had finished developing one of their internal websites, they decommissioned the servers and databases but forgot to remove the DNS entries that pointed to the now non-existent infrastructure. Since [Azure allows anyone to re-register](https://learn.microsoft.com/en-us/answers/questions/5537635/reusing-name-for-a-web-app-that-was-previously-del?ref=citizenjournal.us) the very same App Service identifiers after a cooldown period, the attackers simply waited until the identifiers became available and leveraged KDA’s mistake to redirect visitors to their websites. In one case, the Internet Archive documented gambling content being present on a Kansas Department of Agriculture subdomain [for over two years](https://web.archive.org/web/20240522024214/https://aimsapi-staging.kda.ks.gov/). Lansdowne, spokesperson for the KDA, said that the KDA does not directly manage its own DNS records. "Retiring a site or service requires coordination with our centralized IT service provider to remove the associated DNS records," Lansdowne said. "In this instance, that step did not occur when the underlying service was decommissioned, and the DNS record remained in place longer than intended." According to Haining Wang, a professor of electrical and computer engineering at Virginia Tech, this type of subdomain takeover has been a problem for over a decade, and modern systems have only made the problem more complex. “Cloud-related subdomain takeover remains an issue, as organizations increasingly rely on SaaS and cloud services, creating many new opportunities for dangling DNS records,” Wang said. “Plus, enterprises have far larger DNS footprints, with more subdomains to manage than before.” According to Wang, government domains are at a higher risk of being attacked because of the inherent trust that people have in them. It’s also not the only type of hijacking to be concerned about. “\[The\] DNS dangle problem is one kind of naming hijacking activities,” Wang said. “ \[Another is\] your unused phone number is taken over by someone else, while you forget to inform your friends about the phone number update.” The Kansas government has a long history of issues with their information technology departments. [A legislative audit published in 2026](https://www.kslpa.gov/audit-report-library/2-year-summary-of-security-controls-in-selected-state-and-local-entities-2024-2025/?ref=citizenjournal.us) found that almost half of Kansas government entities that were audited didn’t comply with IT best practices. The [Kansas court system](https://kansasreflector.com/briefs/kansas-court-investigation-confirms-cyberattack-compromised-personal-data-of-150k-people/?ref=citizenjournal.us), [Wichita](https://thebeaconnews.org/stories/2024/05/22/wichita-cyberattack-what-comes-next/?ref=citizenjournal.us), and [Franklin County, KS](https://www.insurancejournal.com/news/midwest/2024/09/24/794245.htm?ref=citizenjournal.us) have all suffered security incidents in recent years, leading to hundreds of thousands of people’s personal information being compromised and some parts of government grinding to a halt. --- --- Found a mistake? Have a news tip or feedback to share? Contact our newsroom using the button below: [Contact Us](https://www.citizenjournal.us/contact/) ---