Brooklyn Community Board 5’s website, brooklyncb5.org, has been hijacked and now leads anyone who visits to a Thai slot-machine site. Bushwick Daily discovered it on Saturday, but the domain was in the hijackers’ hands by Aug. 26 at the latest, and possibly since April 29. The board’s X and Facebook accounts, the Brooklyn Borough President’s office and Wikipedia all still list brooklyncb5.org as the board’s website.
Visitors are redirected four times, through three other hijacked domains, to a page branded PGBET888 served from the web address of a Harvard Medical School bone-research lab, which was hijacked the same way. The page carries an Apple logo over the words “Premium Partner,” lists slot machines at 888 baht, and asks for the visitor’s location. Bushwick Daily reproduced the redirect Friday night, Saturday and again on Sunday morning.
The redirect surfaced at 2:13 a.m. Saturday, while we were checking the links in Community Board 4’s Sept. 10 newsletter, which points readers to the Borough President’s community boards page and from there to the Community Board 5 entry.
The board’s X account, @BrooklynCB5, and its Facebook page both list brooklyncb5.org as its website, as does Wikipedia’s article on the board. None of them links to the board’s working website on nyc.gov.
The discovery led to finding that at least one other community board website has also been compromised. Brooklyn Community Board 9’s website, communitybrd9bklyn.org, is currently a storefront for buying mushrooms, THC and gold IRAs.
brooklyncb5.org was registered on March 18, 2015 and is paid up through March 2027. The .org registry’s record shows that on April 29, 2026 the domain was transferred to a new registrar, GoDaddy, whose own records log it arriving two minutes later. On Aug. 12 the registry logged another change, the kind that appears when a domain’s nameservers are moved. They now point at Cloudflare. The security certificate the domain serves today was issued on Aug. 26. Moving a domain between registrars requires an authorization code that exists only inside the account that controls it.
Our investigation found that none of the 89 security vendors whose verdicts VirusTotal aggregates flag brooklyncb5.org, as of a check at 8:06 p.m. Saturday, and that one vendor still categorizes it as “Business/Economy, Government/Legal.”
Questions went to Community Board 5, the Borough President’s office and Dr. Bouxsein on Saturday evening. None had answered by 9 a.m. Sunday.
Bushwick Daily reported the hijacking to GoDaddy on Saturday night and to Cloudflare on Sunday.
At 9:06 a.m. Sunday, the city’s link for Community Board 5 still led to www.bouxseinlab.org and still loaded PGBET888.
Featured image: Bushwick Daily
