Breaking News: University Domains Serve Explicit Content
Websites for some of the world's most prestigious universities are serving explicit pornography and malicious content after scammers exploited shoddy record-keeping, a researcher revealed this week.
Affected domains include berkeley.edu, columbia.edu, and washu.edu — the official sites for UC Berkeley, Columbia University, and Washington University in St. Louis. In one case, a subdomain redirected visitors to a fake malware warning demanding payment.
Researcher Alex Shakhov, founder of SH Consulting, said that hundreds of subdomains across at least 34 universities are being abused. Google search results list thousands of hijacked pages.
The Hijack Method
Shakhov explained that the scammers—linked to a group tracked as Hazy Hawk—exploit a clerical error by site administrators. When a university creates a subdomain, it sets a CNAME record linking it to a canonical domain. When the subdomain is later decommissioned, the record is often left behind.
"This is classic digital housekeeping failure," Shakhov said. "The records remain active, and scammers simply take them over." Once hijacked, the subdomains serve porn, redirect to scams, or host malware.
Background: A Systemic Vulnerability
This isn't a one-off attack. The problem stems from a widespread lack of oversight in domain management across higher education. IT departments often focus on securing main domains while ignoring subdomain records created for temporary projects, labs, or events.
Hazy Hawk, a known threat actor, has been exploiting this for months. The group targets .edu domains because of their high trust ranking with search engines and users.
"Universities are attractive targets," said cybersecurity analyst Karen Liu. "A compromised .edu subdomain can bypass many security filters."
What This Means
For affected universities, the reputational damage is immediate. Visitors searching for academic resources may instead encounter explicit content or scams, eroding trust.
Beyond embarrassment, legal and compliance risks loom. Hosting pornographic material, even inadvertently, could violate acceptable use policies and expose institutions to liability.
"This is a wake-up call," Shakhov warned. "Every university needs a rigorous domain audit and decommissioning process."
Cybersecurity experts recommend regular scans for orphaned CNAME records, automated expiration of subdomains, and strict access controls. Until then, more universities may find their digital real estate hijacked.
This breaking story is developing. Check back for updates on affected institutions and remediation efforts.