630K gov.br Subdomains Abused in SEO Poisoning Attack

**Executive Summary:** Analysts discovered a large-scale SEO poisoning campaign exploiting hijacked .gov.br subdomains to serve crawler-facing fake government-style pages (via cloaking) and redirect real users to gambling and scam sites; the operation is driven by a single exposed Flask/MySQL server containing automation scripts, keyword databases, and templated HTML that generated hundreds of thousands of malicious URLs and includes IOCs and remediation recommendations.