Interesting we saw something anormal those compromised sites are setupping random subdomains, on the next day of our threat intelligence

https://google.com/search?q=site:reevescountyesdtx.gov contains 400 search results whiches anormal for a state local enforcement site, random meaningless subdomains, that was highly interesting, it is likely something worse happend

https://www.google.com/search?q=site:ppa-or.gov The samething for that domain contain random subdomains names

That may suggest the compromise of their domain provider, not just the main website itself, because that was anormal those thousands random meaningless subdomains for a local gov websites, local gov website alywas use clear subdomains names that have meanings