KSA Has 26 Cloned .co.nl Gambling Sites Taken Down, Nearly All Copies of Licensed Brands

Illegal operators have been rebuilding licensed Dutch gambling sites on .co.nl instead of .nl and sending visitors on to illegal casinos. The regulator had them removed within 48 hours by asking the extension's private operator, a route that needs no court order but says nothing yet about how many players the clones caught.

• The Kansspelautoriteit (KSA) said on 7 October that it recently had 26 websites on misleading .co.nl domain names removed, nearly all of them copies of licensed operators' sites that redirected visitors to an illegal gambling website
• The clones took licensees' existing domain names and swapped .nl for .co.nl, and they were offline within at most 48 hours of the KSA informing CO.NL, the independent operator of the extension, which the regulator says cooperated well
• In a wider look at .co.nl the KSA found other illegal gambling sites, and says 86 websites have so far been reported to .CO.NL and removed; it names no brands and gives no dates or visitor numbers
• CO.NL B.V. runs .co.nl independently of SIDN, the .nl registry, and its acceptable use policy lets it cancel or lock names used to mislead the public or to promote illegal activity
• The KSA has said it cannot legally take sites offline itself, which leaves registries, platforms and payment firms as its levers, the argument its chairman made last month when he said half of every euro Dutch consumers gamble goes to the illegal market

Clones of Licensed Sites, One Extension Away From the Real Thing

The Kansspelautoriteit (KSA), the Dutch gambling regulator, said on Wednesday 7 October that it is acting against misleading .co.nl domain names showing illegal gambling, and that it increasingly comes across fraudulent gambling sites that are clones of legal ones. The method, according to the regulator, is to take an existing domain name and change the extension: illegal operators rebuild a licensed provider's website and put it on .co.nl instead of .nl, and visitors are redirected from the fake site to an illegal gambling website (our translation from the Dutch, as throughout).

The KSA said it had recently had 26 websites with misleading .co.nl names removed, nearly all of them copies of licensees' websites. The extension's operator, CO.NL, cooperated well, according to the regulator, and the sites were offline within at most 48 hours of the KSA informing it. Looking at .co.nl more widely, the regulator also found other illegal gambling sites: so far 86 websites have been reported to .CO.NL and removed. The release does not say whether the 86 include the 26 clones.

It also does not name the licensees whose sites were copied or the operators visitors were sent to, say when the removals happened or how long the clones were live, or give any figure for how many people visited them. Nor does it say whether the names were deleted, suspended or locked, or whether anyone behind them has been identified.

A Private Registry Under .nl, and a Regulator Without a Takedown Power

.co.nl is a second-level domain run by a private company, not by SIDN, the foundation that runs .nl. Its operator says it has no further relationship with SIDN and operates independently. It was started in 2008 by EuroDNS and split off in 2013 into CO.NL B.V., based in Gouda, according to its website and terms. Registrations have run through CentralNic since 2018, and its current terms require registrars to be accredited by CentralNic, whose London-listed parent, CentralNic Group, renamed itself Team Internet Group in 2023.

CO.NL's acceptable use policy, dated September 2022, counts as abuse using a .co.nl name to defraud or mislead the public, to infringe trademarks or to promote illegal activity of any kind, and reserves the registry's right to cancel, transfer, lock or hold a registration. That contractual route, rather than a statutory power, appears to be what the KSA relied on: it says it informed the operator, not that it ordered anything. A KSA spokesperson told AD in September 2025, as reported by NL Times, that "at this moment, we are not legally allowed to take those sites offline ourselves".

The regulator's 2026 supervisory agenda commits it to making illegal operators' infrastructure unreachable through an alliance with payment, social media and hosting firms, with a target of at least 90% of players staying with licensed operators, and records that several .nl affiliate sites were made unreachable via SIDN in 2025. The .co.nl action extends that approach beyond SIDN, while parliament has voted to make platforms that keep showing illegal ads fineable by the KSA.

A Clone Turns a Licensee's Brand Into the Black Market's Front Door

This is a channelisation problem licensees share. A player who lands on a copy of a familiar licensed brand believes they are in the regulated market, with Cruks self-exclusion checks, deposit limits and a complaints route, while their money goes to an operator offering none of them. That is harder to spot than an offshore casino found through an advert, because the clone borrows trust the licensee built. When .co.nl launched in 2008, .nl holders had a two-month priority window to claim the matching name, long before the Dutch online market opened in 2021. Registering the matching .co.nl name and monitoring lookalikes across extensions is cheap, and a licensee hears about a clone first through confused customers. The KSA is meeting impersonation on its own side too, having tightened domain checks on its Kansspelwijzer register after a fraudster obtained a lottery licence by posing as Quick Boys' chairman.

Registry Cooperation Beats Blocking on Speed, but Only Where a Registry Will Listen

Forty-eight hours from notice to offline, without a judge, compares well with Chile, where internet providers block mirror sites within 48 hours only after court rulings and a three-step validation. A registry removal also takes the name away for everyone, not just customers of Dutch internet providers; SIDN argued in 2016 against a proposed KSA power to make providers block domains, calling such blocking easy to get around. But CO.NL acted under its own policy, not an order, and the same request gives the KSA nothing against a clone on a foreign registry with no interest in Dutch gambling law. Removing a clone does not touch the illegal casino it pointed to, and the tactic can move to the next extension.

The Numbers Count Takedowns, Not Players

Without visitor numbers, the brands copied, how long the sites ran or where they sent people, there is no way to tell whether the clones moved meaningful money out of the licensed market or were a tidy-up at the margins. Set against a 90% target and a chairman who says half of every euro already goes illegal, 26 domains are a small part of the gap. The useful number is how many players they reached.

The KSA has found a lever that works in two days without a court, and a registry willing to pull it. Whether it matters for channelisation depends on how many players the clones caught, a figure the regulator has not published.