Casino, pharma, adult: not every bad past is the same

You find the domain late on a Tuesday. Two newspaper links. A university page. An old trade magazine that used to rank things. The kind of corner signposts have pointed to for years — people, and Google, already walk there.

You're half-planning the launch already. Then you open the archive and scroll back. The magazine is gone. In its place: roulette bonus codes in four languages. Scroll again: pills, no prescription asked. Scroll again: a parked page, then nothing. The domain died with its boots on.

Your first thought is one word: blacklisted.

Wrong word. There is no list. And a "bad past" isn't one thing — pasts come in grades, from a coat of paint to a foundation crack. Here's the short version: a casino past usually washes out. Hacked-site spam often does. Pharma and loans are a gamble. Malware and phishing can be cleared, slowly, through an official review. Adult rarely comes back for anything else. Illegal content isn't an SEO question — it's a legal one. And for the one question that actually matters, does Google still punish this domain?, there's exactly one honest way to find out. It costs about ten dollars.

First, kill the blacklist myth

Search for "domain blacklist check" and you'll find tools happy to sell you an answer. The honest version: Google publishes no list of punished domains. There is no blacklist to check.

A manual action — Google's term for a penalty a human on their spam team handed out — shows in exactly one place: Search Console. And Search Console only talks to the domain's verified owner. From outside, no tool can see a penalty. Ours can't either. Anyone who claims otherwise is reading signs and calling them sentences.

Signs are still worth reading: a link profile full of casino and pill links, a long drop history, an archive of junk. Those predict risk. They don't confirm punishment.

The one real, public list that exists is Google Safe Browsing, and it's about safety, not SEO — malware and phishing. That one you can check from outside, and you should.

One more myth while we're here: the "Google sandbox," the idea that a new domain can't rank for months. That's a community term. Google has never confirmed a sandbox exists.

The risk ladder, from "usually fine" to "walk away"

A bad expired domain is a corner where stolen goods were sold. Foot traffic, sure — but the police are watching. What most people miss is that the police treat crimes differently. So does Google.

Casino and betting: usually recoverable

Gambling is a legal, regulated business across much of the world, and plenty of ex-casino domains were real companies with real marketing budgets. Their old links are usually a mix of genuine press coverage and paid placements.

The problem is relevance, not poison. The consensus among people who rehabilitate domains: a betting past fades if you build something real and the gambling links aren't the entire profile. Note the word consensus — Google has never published a "former casino" penalty.

Hacked-site spam: often recoverable

A plumber's blog gets hacked. Overnight, ten thousand pages selling counterfeit sneakers appear under /cheap-jordans/. The owner never notices, the hosting lapses, the domain expires — junk still attached.

The archive tells this story clearly: a normal site for years, then a sudden wall of gibberish, then a parked page. The consensus: Google's systems mostly blame the hack, not the domain. Start clean and these often come back fine. "Often" — if the hack stood for years, it basically became the domain's identity.

Pharma and payday loans: uncertain

These were the money verticals of spam for a decade. A domain that spent years as a pill shop usually has a bought link profile, because that's how that business worked.

Outcomes here split. Some domains recover fully. Some never rank for anything again. Nobody outside Google can tell you which bucket you're holding — even a clean-looking link profile only hints. This is the tier where the $10 test stops being optional.

Malware and phishing: recoverable, the slow way

The one bad past you can verify from outside, because Safe Browsing flags it publicly — that red browser warning.

It also has an official exit: put up a clean site, verify the domain in Search Console, request a review. It works. It's also the slow lane, and it only makes sense for a domain that's genuinely worth the wait.

Adult: rarely worth it

You'll see it in the links before you see it anywhere else: adult directories, adult link exchanges, comment sections best left unvisited. If you're building an adult site, the history fits. If you're building anything else, you're dragging a past with zero audience overlap toward people who don't want it.

Rare exceptions exist — a brief adult episode on a long, otherwise clean history. Don't plan on being the exception.

Illegal content: never

Counterfeit goods, scams, phishing the site itself ran — call it what it is. At this rung, Google isn't the problem. Legal risk is, and it may not end when the domain changes hands. No ranking is worth that.

If you already own something in this category and aren't sure where the line is, talk to a lawyer. Before you build, not after.

How to check a domain's past, in order

Scroll the whole archive. The Wayback Machine, end to end. One snapshot lies; a timeline tells the truth — a real site, then a hack, then pills, then a parked page is a story you only see end to end.
Run a site:domain.com search. If old spam pages still appear in Google, you can read exactly what Google remembers. If nothing appears, that's normal for an expired domain — not a penalty sign on its own.
Check Google Safe Browsing. The one real public list, for malware and phishing. Free, a minute of your time.
Read the link profile. Spam pasts hide here even when the archive looks clean. The DD Backlink Strainer extension (it runs on domain lists in ExpiredDomains and auction sites) returns a verdict — Strong, Mixed or Weak — with reasons: who links (editorial sites, platforms, directories, auto-generated pages, toxic links), the top editorial donors, the earliest record we have (our expired-domain records go back to 2006), and the years the domain was dropped. What it can't tell you: whether old links still point anywhere, and whether the domain carries a penalty. On that second one, nothing can.
Run the $10 test. Register it, verify it in Search Console, open the manual actions and security issues pages, and read. Ten dollars for the only straight answer that exists. The full method: The $10 test: does Google still trust this domain?

For a longer walkthrough: Check a domain's past before you build on it.

What you build matters more than what happened

Google's spam policies, updated in 2024, name the thing people used to do with these domains: expired domain abuse — buying an old domain and filling it with unrelated, low-value content to coast on its old links. Scaled content abuse and link spam sit beside it in the same policy.

Read that twice, because it cuts both ways. A rough past plus more junk equals spam in Google's book. A rough past plus something genuinely useful is how the recovery stories go.

One warning worth its own paragraph: if the plan is to buy a domain with a past and redirect it at your main site to inherit its links — that's paying for links with extra steps, and now your clean site shares the bathwater. Restore, don't redirect. If old links point at a page that used to exist, put a real, relevant page back at that address.

What to do now

Scroll the domain's full history in the Wayback Machine. Years, not one screenshot.
Run a site: search and check Safe Browsing. Five minutes, free.
Get the link profile checked. If you scan lists on ExpiredDomains or auction sites, the DD Backlink Strainer extension gives you the verdict and the reasons in a side panel; the free plan covers 250 domains a day.
Casino or hack past with decent links: proceed, and build something real. Pharma, malware, or any flavor of uncertain: run the $10 test first.
Illegal past or trademark trouble: talk to a lawyer before anything else.

Short on time? The 10-minute domain history checklist walks through all of this before you pay for the domain.