Expired Council Domains Sent Scottish Users to Offshore Casinos
The council directory covers 69 community councils and includes contact details, social profiles and website links. Fifteen of the 16 problem links had once belonged to sites hosted through Online Borders, a platform used by local groups in the region.
Old Domains Kept Their Official Backlinks
The service became unresponsive around eight years ago. Community councils were told to create replacement websites, but the old addresses were still listed on the Scottish Borders Council site.
Those domains were later repurposed. According to the BBC, the affected links eventually began sending visitors to one portal promoting “top noGamstop casinos.”
The council removed the links after the BBC raised the issue earlier in August. It also contacted community councils and asked them to check that their web details were current.
Trusted Links Gave the Casino Pages Extra Reach
Dr Daniel Thomas, a cyber security specialist at the University of Strathclyde, described the setup as domain squatting. The method relies on acquiring expired web addresses that still carry links, search visibility or a connection to a trusted organisation.
That history can remain valuable even after the original website disappears. A gambling page reached through an official council directory may also receive stronger search signals than a newly created offshore domain.
The incident did not require attackers to compromise the main Scottish Borders Council website. The weak point was a collection of external links that remained online after the organisations behind them had moved elsewhere.
Offshore Sites Avoid UK Player Safeguards
The redirected pages promoted casinos outside the British licensing system. “No Gamstop” operators can accept players who have excluded themselves through GAMSTOP because they sit outside the UK licensing framework.
GAMSTOP participation is mandatory for licensed online gambling businesses in Great Britain. UK rules also prohibit gambling operators from accepting credit card payments, a restriction introduced in April 2020.
Public-Sector Domains Remain a Target
Similar tactics have appeared elsewhere. Old Catton Parish Council in Norfolk dealt with gambling content on its website in June 2026, while more than 100 Indian government and public-sector sites were reportedly abused through gambling-related cloaking that month. Nigeria’s National Population Commission also faced a casino redirect incident in 2025 after a public subpage was left exposed.
The Scottish Borders case shows how neglected web infrastructure can create a route into the offshore gambling market without a breach of the authority’s main website. For councils and other public bodies, old external links now need the same routine checks as active pages. An expired community domain can retain years of trust and visibility long after its original owner has stopped using it.