Dutch Regulator Shuts Down Casino Sites Posing as Licensed Operators Via “co.nl” Domains

The Dutch gambling regulator has uncovered a new trick used by unlicensed operators: copying the web addresses of licensed Dutch brands and sending visitors to illegal casinos, according to a report by GamblingNews.uk.

The Kansspelautoriteit (KSA) said unlicensed operators are registering domains ending in “co.nl” that mirror the “.nl” addresses of licensed operators. Anyone who lands on one of these lookalike sites is quietly redirected to an unlicensed gambling platform. Because the clone looks like the real thing at a glance, players can end up on a site with no Dutch licence, no player protections and no recourse if something goes wrong.

How the sites were taken down

The co.nl extension is normally reserved for Dutch companies, and the registry’s operator cooperated with the KSA to act quickly. The regulator said it has closed 26 of these sites, with almost all of them being copies of websites belonging to licence holders. The takedowns were completed within 48 hours. Across the wider campaign, 86 websites using the extension have now been reported to the KSA and removed.

The speed matters because the Dutch regulator has few tools of its own for this. It has no power to block websites outright. For domains under the Dutch registry, it can lean on registry operators to act, which is what happened here. Foreign domains are a different matter, and the government has acknowledged there is currently no mechanism to force internet providers to block them.

A growing political problem

The announcement lands amid mounting concern about the size of the Dutch illegal market. Many in the industry now estimate that spending with unlicensed operators is roughly on par with the regulated sector, which is itself seeing stagnant growth. The KSA has previously warned that the state is losing more than €500m a year in gambling tax to the black market.

Pressure on ministers has been building. Following a recent parliamentary debate, Minister for Legal Protection Claudia van Bruggen promised greater powers to tackle illegal operators, while cautioning that forcing providers to block foreign domains remains out of reach for now. Politicians across the spectrum have urged her to give authorities more power to block sites.

The co.nl case follows a September investigation by broadcaster BNR, which found at least 1,000 legitimate Dutch and European websites, belonging to companies, charities and freelancers, had been turned into shopfronts for illegal casinos. Some were hacked, others were expired domains bought up and filled with gambling content. The true number could be above 8,000. Because search engines already trust those addresses, the casino pages ranked well. The KSA called it a very big problem, but said the sites fall outside its remit because they are not dedicated gambling operations.

Earlier this week, the KSA also warned the public about a fraudulent lottery licence obtained using falsified identity details. A fraudster had set up several lottery websites in the name of an organisation that never applied for a licence. The regulator described misuse of legitimate names and brands as a new risk for its oversight work.

The licensed market

The enforcement news arrived shortly after all eight operators active at the re-regulation of the Dutch online market had their licences renewed. Names including Entain’s BetCity, Holland Casino Online, Kansino and bet365 are among those with terms extended. The licence renewals also came ahead of the House of Representatives rejecting a blanket ban on gambling advertising, a decision that licensed operators had been watching closely.

For licensed brands, the co.nl clones are an awkward threat. Their own customers can be misled into depositing with an illegal operator under what looks like a trusted name, while the operators themselves have no legal route to shut those sites down. For now, the regulator’s reliance on cooperation from domain registries is the main line of defence, and the speed of this latest takedown suggests that approach can work where the domain extension is Dutch-controlled.

Whether lawmakers will deliver the site-blocking powers the KSA has been asking for remains an open question, and the clone-domain tactic will likely feature in that debate.