How Hijacked Websites Became a Funnel for Illegal Gambling

A Dutch radio broadcaster has pulled the lid off a quiet scheme running underneath the European web. BNR found that hijacked websites now funnel readers toward illegal gambling operators. Those domains once belonged to hobby blogs, local news outlets and even law firms. Each registration expired, someone bought it, and the content changed completely. What survived the handover was the trust those addresses had built with search engines over many years.

The scale is the unsettling part. BNR identified around 1,000 Dutch and European sites caught up in the practice, but the real total may run eight times higher. That would put roughly 8,000 hijacked websites in circulation across regulated European markets. All of them point traffic at operators holding no licence to serve those players.

How Hijacked Websites Get Built

The mechanism is dull, and that is partly why it works so well. Domains expire constantly. Owners lose interest, businesses fold, hobbyists move on, and renewal notices land in inboxes nobody opens anymore. Once the registration lapses, the address returns to the open market.

Buyers are already waiting. Some are ordinary domain investors, but others include hackers and shell companies working the grey edges of the gambling industry. They target addresses with strong backlink profiles and long publishing histories, then rebuild them as gambling content farms.

Old branding sometimes stays partly intact. A site that once covered regional news might keep its layout while every article slot fills with casino listings. Visitors arriving through search rarely notice the handover, because the domain looks exactly as trustworthy as it did five years ago.

Why Search Engines Keep Rewarding Hijacked Websites

Trust is the real asset here. Google ranks partly on domain history, so an address with a decade of legitimate publishing behind it starts from a strong position. Hijacked websites inherit that position wholesale, and the new owners gain ranking power they could never build from scratch.

Crawlers do eventually catch up, but the process is slow. A domain already flagged as reputable does not get re-examined the moment its content shifts. Months can pass while the site sits high in results, serving gambling promotions to anyone searching adjacent terms. By the time the algorithms adjust, the operators have collected the traffic they paid for.

That lag is what makes the whole tactic profitable. Buying an aged domain costs a fraction of what years of legitimate SEO work would cost. The payoff also arrives immediately rather than after months of patient effort.

Where the Traffic Actually Ends Up

The destination matters as much as the method. Hijacked websites route Dutch and European readers toward operators licensed in places like Curaçao. Those licences are genuine documents, but they carry no legal weight in the Netherlands. Marketing those sites to Dutch players breaks national law.

Players clicking through lose every protection the Dutch licensing system guarantees. No deposit limits apply. No connection to the national self-exclusion register exists, and no local route to dispute resolution opens up if something goes wrong.

Credibility is the hook here. The gambling offer looks safe because the domain around it looks safe. Hijacked websites borrow that impression from owners who walked away years earlier, and nothing on the page signals the change.

The KSA Sees the Problem but Cannot Reach It

The Dutch Gaming Authority has called the practice serious, yet its hands remain partly tied. The KSA holds clear power over sites built to market gambling illegally into the Netherlands. It uses that power regularly, issuing penalties and pushing dedicated operators out of the market.

Hijacked websites land in an awkward gap. On paper, a lapsed broadcaster domain still counts as a broadcaster domain rather than a gambling operation. The regulator’s normal enforcement route does not apply cleanly. Taking down what the registry still lists as a media outlet raises legal questions the KSA was never built to answer.

So the loophole holds. The regulator can identify the problem, name it publicly, and still lack a clean instrument to remove it. Lawyers, broadcasters and anyone else with a lapsing domain remain exposed in the meantime.

Lawmakers Turn Toward Google

Dutch politicians have started looking outward for a fix. Instead of fighting each domain individually, they are seeking cooperation from Google. Search controls the distribution channel keeping these sites profitable. Remove the ranking advantage and the business case collapses on its own.

That approach carries obvious limits. Google is not a Dutch institution, and its ranking decisions do not exist to serve national gambling policy. Hijacked websites cross borders freely, so a Dutch fix leaves the rest of Europe untouched. Any workable agreement would also need to operate across languages and markets, because the same trick works anywhere search engines reward domain age.

For now, the practical defence sits with domain owners. Renewals matter far more than most people assume, and an abandoned address still carries real commercial value. Someone out there will pay for the reputation left behind. Hijacked websites are what that transaction eventually produces.