Hijacked Expired Websites Are Being Used to Push Illegal Gambling Content in the Netherlands

The Dutch radio station BNR says expired domains are being taken over and repurposed to promote gambling offers, including offers aimed at Dutch customers from jurisdictions where they are not licensed to operate. For PSPs and operators, the useful bit is not the website gossip; it is the distribution channel: trusted domains can be turned into traffic sources for unlicensed gambling without immediately tripping the usual alarms.

1. BNR says there may be 1,000 legitimate Dutch and European websites in this category, and the real number could be 8,000 or more. The pattern is simple enough: niche hobby sites, news sites, and blogs are abandoned by their original owners, then picked up by other parties and filled with gambling content.
2. Those domains can be used to promote unlicensed gambling websites, meaning websites that are not licensed in the jurisdictions they target. BNR specifically notes the Curaçao example: a site licensed in Curaçao may be promoted to Dutch customers, which would be illegal under Dutch gambling law.
3. The reason this is hard to police is that the domains are already trusted and often whitelisted by search engines, so the new content does not trigger an immediate response. In practice, a reputable-looking domain can start sending traffic to illegal gambling pages before anyone notices the switch.
4. The Dutch Gaming Regulator (KSA) says this is a serious problem, but it also creates a jurisdictional headache. The KSA can target sites that are clearly gambling-related and unlawfully marketing to local customers, but hijacked domains of lawyers, broadcasters, and other non-gambling businesses fall outside its normal remit.
5. According to the report, lawmakers and regulators in the Netherlands are now trying to get assistance from Google. That is the key operational detail: enforcement is not just about taking down gambling sites, but about dealing with the trusted domains that are being used as the delivery mechanism.

For high-risk payment teams, the point is obvious: traffic source quality is not the same as domain reputation. A domain that looks clean can still be part of an acquisition funnel for unlicensed gambling, which means KYC, traffic vetting, and affiliate controls need to account for hijacked-web domain abuse as a separate risk class.