A domain name costs about $10. That is the entire marginal cost of the spam that is outranking legitimate sites in every market Timothy Malmros has checked.
I have been doing SEO for close to twenty years. I still have conversations that shift how I see the search landscape, and my Unscripted SEO Podcast episode with Timothy was one of them. He spent nearly two decades in gambling affiliate SEO, the vertical where every black hat technique gets field-tested first. He has since retired from active affiliation and now does something rare: he reverse-engineers how the current tricks work and posts the findings publicly, with nothing to sell.
If you build or maintain websites, you should understand this mechanism, because it explains a lot of what you see in the results pages right now. It also explains why a rel="canonical" tag, a thing most of us treat as boring hygiene, has become one of the most abused signals on the web.
The canonical trick, step by step
Timothy calls it the canonical trick. Here is the loop as he described it:
- Buy an expired, high-authority domain. His example: Carolina Partners, an old mental health clinic. The registrant let it lapse; someone picked it up. The old PDFs are still on it, which is the point. They look like trust.
- Bombard it with spam links. "Links that look like something out of 2002," with anchor text like sweepstakes casinos and best sweepstakes casinos. The goal is topical relevance through links, not through content.
-
Canonical the whole thing to a fresh domain. Something like
toponlinesweeps.us.comor a throwaway subdomain. The expired domain's accumulated authority now points at the new one. - Wait about a week. The fresh domain ranks. Then it dies.
- Canonical it again to the next $10 domain. Repeat.
In his words: "A domain name costs 10 bucks. So it's infinite. An infinite loop. And it's in every market I've seen so far. Sweden, Germany, the Netherlands, Italy. It's worldwide. It's absolute spam that's ranking. And since it's everywhere, there's no solution in place."
The part that should bother anyone who has ever written a canonical tag: this is the tag being used exactly as specified. Google's own guidance from 2008 describes consolidating signals from one URL to another. The spec is fine. The referee is missing.
Why it works: the grace period
The interesting question is not whether Google can detect it. It is when. Timothy's read is that Google has to put a page in the results before it can judge whether users want it:
"There's a grace period where Google needs things in the SERPs to understand if it's what the user wants or what the user doesn't want. And it's the grace period that seems to help these tactics flood the SERPs."
A spam page can rank for two or three days, get tanked, and there are ten more queued behind it. Automation makes the grace period a feature. And there is collateral damage: the same spam link networks that prop up the throwaway domains also fire junk anchors at the legitimate sites already ranking, which puts those sites under review. "You've got 20 sites that are under a temporary link penalty, your expired domain just slots in instantly."
So the incumbents get pushed down not by being outcompeted, but by being contaminated.
Why it works at all: links still decide
Timothy is blunt about the underlying model. "How many times can you write about sweepstakes? How do you know which one is the best? It's the same content. What determines the rankings are the links."
That is uncomfortable for people who have spent years on content quality, and it matches what I have seen in verticals where the content is functionally identical across competitors. When the words cannot differentiate, the link graph does, and the link graph is exactly what expired domains let you buy.
He is also honest about the limits of his own model. Some drop domains work and some do not, and he cannot always tell why. Tori Spelling's old site, repurposed as a crypto casino portal with a monster backlink profile, does not rank. An old UV-armband store in Sweden, with an unimpressive link profile, dominated Swedish gambling queries with the same trick. "Either it's roulette, or there's something I'm missing." Anyone who claims to know precisely which signals Google weighs here is probably selling something.
The referee left the building
The historical context is what turns this from a curiosity into a structural problem. Timothy used to do the old-school version of this himself:
"I must have snapped 2,000 domains, easy. But then it stopped working, because there was a referee. And this is the big problem here. There's no referee now. Google used to have a huge anti-spam team, so they would stop this very quickly. Now it takes years."
His theory on why is provocative but worth sitting with: the moment ChatGPT launched, Google had a real competitor, resources moved to the AI race, and the manual spam-fighting capacity went with them. Whether or not that is the full story, the observable result is a long lag between a tactic appearing and Google acting on it. Parasite SEO took roughly six years to get a real crackdown. He expects the canonical trick to last another five or six.
Faking brand signals for rent
One more layer, because it connects to something in the Google leak: click metrics matter, and they can be bought.
"You can rent a box of Android phones, just a motherboard, each connected to a VPN, managed from home. You can send bots to go through the search results, click on your site, and increase bounce rate. And it's not that expensive."
The bots are simulating what a real brand earns. Timothy's example is Ninja Casino in Sweden: terrible backlink profile, but so much TV advertising that brand searches pushed it to position one or two for casino. When Swedish regulation hit and the ads stopped, it fell off a cliff. The bot farms are counterfeiting that curve. Borrowed time, but it works until it does not.
What to do with this if you run a real site
I am not going to tell you to canonical your way into a gambling SERP. Here is what I actually take from it:
- Watch your inbound anchor text weekly. I had a manufacturing client in the door niche where someone was standing up ten to twenty junk domains a month and firing irrelevant anchors at everyone in the top ten. An aggressive weekly disavow routine brought the rankings back. If your anchor profile suddenly fills with garbage, you may be collateral damage in someone else's grace-period play.
- Treat canonical tags as a security surface, not just an SEO setting. A compromised site with an injected canonical is a quiet way to hand your authority to someone else. Audit them the way you audit redirects.
- Own something Google cannot reshuffle. An email list, a community, a podcast audience. The channel where a $10 domain can outrank you for a week at a time is not a foundation.
- Stay off the shortcuts. The Ninja Casino arc is the whole lesson. Signals that simulate a brand collapse the moment the simulation stops.
Timothy's closing line is the one I keep coming back to: "Whatever works, you see it in gambling first, because that's where the money is. The more lucrative it is, the shadier it gets."
The full conversation is on the Unscripted SEO Podcast, and the longer write-up with the Medic-update and SEO-tools tangents is on my site. Timothy posts his ongoing black hat research on LinkedIn.
Top comments (0)