Forensic Investigation of SEO Manipulation in Moodle LMS: Uncovering Illegal Content in Educational Platforms

Learning Management Systems (LMS) like Moodle are frequently targeted by covert cyberattacks that exploit the credibility of academic domains for illicit purposes. This study uncovers an SEO-based attack method that infiltrates hidden links to gambling sites through Moodle's public directory. Digital forensic methodology was used to trace the perpetrators' footprints from server logs, HTML/JS files, and activity in Google Search Console. The results revealed a comprehensive exploit: fake admin accounts, redirect file injection, and Google indexing manipulation. This research not only highlights an under-researched threat but also offers a mitigation framework based on the ISO/IEC 27001 standard. Key contributions include identifying SEO-based attack techniques in LMSs, analyzing digital artifacts for perpetrator attribution, and strengthening cybersecurity governance in educational institutions.