Interesting we saw something anormal those compromised sites are setupping random subdomains, on the next day of our threat intelligence
https://google.com/search?q=site:reevescountyesdtx.gov contains 400 search results whiches anormal for a state local enforcement site, random meaningless subdomains, that was highly interesting, it is likely something worse happend
https://www.google.com/search?q=site:ppa-or.gov The samething for that domain contain random subdomains names
That may suggest the compromise of their domain provider, not just the main website itself, because that was anormal those thousands random meaningless subdomains for a local gov websites, local gov website alywas use clear subdomains names that have meanings