SIDN investigation uncovers network of gambling domains; CasinoNieuws hit by suspected attack

SIDN published an investigation on 29 September that mapped a broad network of gambling-related .nl registrations after four months of analysis, and CasinoNieuws.nl reported a sudden surge of traffic and errors that it links to the outlet's cooperation with the research. SIDN said it examined more than 100,000 domain registrations, identified roughly 2,900 with a clear relation to online gambling and made nearly 1,800 domain names unreachable. CasinoNieuws described “millions” of visits and bot-like traffic in a LinkedIn post; the site suggested the timing was connected to its assistance to SIDN but did not produce independent attribution of an attacker.

SIDN illegal gambling investigation: scope and top-line figures

The Dutch domain registry SIDN ran a four-month review of .nl registrations and published the results on 29 September. The dataset included over 100,000 domain registrations with approximately 2,900 tagged as gambling-related. SIDN's public breakdown included:

• 112 .nl domains where paying gambling activity appeared to be offered without a licence from the Kansspelautoriteit (the Dutch Gambling Authority).

• 312 registrations without an active gambling site that were nonetheless judged potentially risky by name or registration pattern.

• 121 sites that misused names or logos of legitimate operators.

• 70 so-called linksites that operated as apparent casinos but redirected visitors to other gambling sites.

SIDN removed or made unreachable almost 1,800 domain names via verification and notice procedures during and after the study. The registry differentiated between categories of action: a majority of cases proceeded through holder verification (disconnecting nameservers where registration data could not be confirmed), and a smaller portion used Notice-and-Take-Down for clearly unlawful content.

What the SIDN illegal gambling investigation revealed about infrastructure and reuse

The investigation emphasised that the network was not only composed of active, unlicensed casinos. The largest single category—more than 1,480 domains—consisted of repurposed legacy sites. These were names previously used by shops, local initiatives or events. When an original registrant allowed a domain to expire, a new registrant could re-register it and populate it with casino articles or redirect traffic to foreign operators.

The practical effect is that a familiar or long-standing domain can inherit backlinks and visibility, which later are leveraged to promote gambling content. SIDN highlighted that automated checks alone will miss this behaviour because the outward appearance of a site can change over time; investigators manually reviewed borderline cases to assess final destinations and operator relationships.

Impact on CasinoNieuws.nl and access to reporting

CasinoNieuws.nl reported severe reachability problems in a LinkedIn post, describing exceptional traffic over a weekend and on the day of the announcement. The newsroom said servers were regularly stressed and visitors saw error pages; it also claimed traffic originating from a bot network and cited “millions” of visits. CasinoNieuws framed the surge as plausibly linked to its cooperation with SIDN's study, but the outlet did not present forensic evidence or identify an attacker in its public statement. SIDN's report and CasinoNieuws' operational issues are separate facts: one is a published technical and classification exercise, the other is a publisher's account of service disruption.

A pattern of behaviour described by CasinoNieuws—so much traffic that ordinary visitors are effectively blocked—matches the symptoms of a distributed denial-of-service condition. The public note from the news site did not, however, include a technical analysis that would confirm DDoS or show origin IPs. Restoration work was underway at the time of the report; the LinkedIn update did not confirm whether availability was later fully restored.

Misleading presentation, targeted content and investigative hurdles

SIDN found multiple techniques intended to evade detection. Some sites presented different pages depending on the time of day or the visitor's device, so a mobile user could see different content from a desktop visitor. Investigators also encountered blocks for known IP addresses tied to government or law-enforcement agencies. Other pages initially showed free games and only later linked to real-money gambling. These behaviours make single-point checks unreliable and increase the manual workload for classification teams.

The investigation also drew attention to brand misuse: copied sites, cloned login pages and names that closely resembled licensed providers. Gambling Club previously reported a separate Belgian case involving more than twenty fake sites using the PepperMill Casino name to lure players. Those dossiers underline that a recognizable logo or familiar domain string does not prove a site's legitimacy; the underlying licence and operator details must match.

Belgian context and wider enforcement parallels

Belgium faces a related challenge. The Belgian Kansspelcommissie added 31 websites to its blacklist with a decision on 28 September, bringing the national list to 1,016 entries. Gambling Club's reporting observed repeated variants of the same names on the Belgian list, demonstrating that the count of addresses does not equate to a count of distinct companies. Territorial licensing remains decisive: the SIDN study assessed activity against the Netherlands' regulatory framework and the presence of a .nl name or a foreign licence does not amount to a Belgian permit.

SIDN said it aims to intensify cooperation with the Kansspelautoriteit so that rapid signal detection can be followed by regulatory assessment and action. The registry warned that making a domain unreachable is not the same as deleting hosted files, and that organisations behind a network can reappear under fresh registrations if follow-up enforcement is absent.

What this means for investigators, publishers and regulators

Investigators need time-consuming, manual review to complement automated detection because many sites vary content by device or time and reuse dormant domains. Publishers that assist research can face operational risk: CasinoNieuws' public account shows how access to reporting can be affected when a newsroom experiences a traffic surge of unknown origin. Regulators and registries must coordinate: rapid signal capture by a domain registry requires matching follow-up by enforcement authorities to prevent displacement across new addresses.

For readers of gambling reporting the immediate takeaway is concrete: recognisability, tidy presentation and a familiar domain name do not substitute for a valid local licence. That fact is central to how both the SIDN investigation and the Belgian blacklist should be read by players and by industry stakeholders.

For coverage of regulatory developments see regulation; for further reporting on the incident and its aftermath visit our news section.