The Hijack
Hundreds of subdomains belonging to prestigious universities including UC Berkeley, Columbia University, and Washington University in St. Louis are redirecting visitors to explicit pornographic content and malicious scam pages, researcher Alex Shakhov revealed.
The compromised domains include causal.stat.berkeley.edu showing porn videos, conversion-dev.svc.cul.columbia.edu pointing to a porn site called "Brazzers Gym," and provost.washu.edu hosting a fake malware alert demanding payment. In total, at least 34 universities have been affected.
“This is not a sophisticated hack—it’s basic neglect,” said Shakhov, founder of SH Consulting. “The scammers are exploiting a clerical error that universities never bothered to fix.”
Background: The Technical Flaw
When universities create subdomains (e.g., provost.washu.edu), they set up a CNAME record that links the subdomain to a canonical domain. This is common for temporary projects, event sites, or third‑party services.
Once the subdomain is no longer needed, administrators often forget to delete the CNAME record. The orphaned record becomes a dangling pointer—a prime target for attackers like the group tracked as Hazy Hawk, who register the now‑unowned canonical domain and take control of the subdomain.
Shakhov explained: “It’s like leaving your front door unlocked after moving out—anyone can walk in and put up their own sign.”
What This Means
The hijacked subdomains damage the universities’ reputations, erode trust in their .edu domains, and expose users to explicit content and scams. Victims landing on the fake malware page are pressured to pay a fee for a non‑existent cleanup.
Google search results currently list thousands of these hijacked pages, meaning the problem is far from contained. “Universities must audit their DNS records immediately and remove obsolete CNAME entries,” Shakhov urged.
Without prompt action, the same technique could be used to serve phishing sites, distribute malware, or conduct other attacks under a trusted .edu banner.