Traffic attack on CasinoNieuws after SIDN probe into illegal gambling sites

CasinoNieuws received a volume of traffic that left readers seeing errors and attributes the incident to a botnet after cooperating in SIDN's investigation into illegal gambling sites, according to the newsroom. The team published the notice on LinkedIn the weekend of the incident and links the traffic spike to its assistance with the study published by SIDN on 29 September 2026.

Investigative findings from SIDN: scope and key results on illegal gambling sites

SIDN, the .nl top-level domain registry operator, examined more than 100.000 domain registrations over four months and published its findings on 29 September 2026. The analysis identified roughly 2.900 registrations with a clear relation to online gambling. Of those, about 600 corresponded to legitimate operators, government bodies or industry associations, so a gambling-related name is not automatically an infringement.

SIDN classified and acted on several categories:

• 112 .nl domains that offered betting for money without a licence from the Nederlandse Kansspelautoriteit.

• 312 registrations with no active site but registration patterns that flagged them as potential risks.

• 121 sites that improperly used names or logos of licensed operators.

• 70 “linksites” that pretended to be casinos but redirected to other platforms.

In total, SIDN made nearly 1.800 domains inaccessible by taking measures against name resolution. SIDN stresses that a domain being “inaccessible” does not mean hosting files were deleted: removing the nameserver cuts public visibility via that address, but the infrastructure can remain active under another address.

CasinoNieuws and the incident: what has been published and what has not

CasinoNieuws' newsroom described on LinkedIn extraordinary traffic spikes during the weekend and on the day they published the alert. The result was server load and many visitors seeing error messages. The post mentions “millions of visits” and traffic coming, according to the newsroom, from a botnet. CasinoNieuws proposes the cause could be linked to its cooperation with SIDN, but acknowledges that this is the newsroom's interpretation and not an independent technical attribution.

The site's public statement does not include forensic analysis, identification of an attacker, or evidence that definitively confirms the link between the traffic spike and cooperation with SIDN. CasinoNieuws reports it is working to restore service and asks readers for patience; the statement does not specify whether availability is fully restored.

Observed methods in domains and their relation to organic visibility

SIDN performed manual work when automated inspection was inconclusive. Researchers pointed to techniques that complicate detection:

• Changing content by device or time window, with versions that hide the real offer from certain visitors.

• Blocking IP addresses associated with public bodies and law enforcement to avoid official checks.

• Initial presentation of free games that then redirect to real-money betting.

Reusing expired domains was the largest category: more than 1.480 cases where former pages for local shops, conferences or initiatives had accumulated visibility and were taken over by new owners to host casino content or links to foreign operators. That practice leverages the prior reputation of the domain to attract traffic.

Gambling Club had already addressed this phenomenon in an interview with Frank Kruit about search-result manipulation and the use of old domains to spread unauthorised gambling content.

Impact on detection and compliance: the distinction between making a domain inaccessible and deleting content

SIDN mainly used holder verification. If the registrant does not prove the accuracy of their details in time, the nameservers are disconnected. In fewer cases the Notice-and-Take-Down route was followed for clearly illicit uses. Both routes have legal and procedural requirements; mere suspicion does not automatically lead to removal.

The measure affects name resolution but does not delete content hosted on a server. That is why operators or malicious actors can reappear with new registrations. SIDN said it intends to step up collaboration with the Nederlandse Kansspelautoriteit so that rapid flagging is followed by effective assessment and action.

Belgian context and parallels with PepperMill

In Belgium similar problems have been recorded. The Kansspelcommissie added 31 sites to its blacklist on 28 September, bringing the total mentions to 1.016. Gambling Club documented more than twenty fake pages that used the PepperMill Casino brand as a lure.

Territoriality remains relevant: SIDN's investigation assesses the Dutch context and for Belgian players the relevant authorisation remains Belgian. A .nl domain or a foreign licence is not proof of permission to operate in Belgium.

Resistance and risks for those who investigate

This is not the first time an investigator or outlet that exposes affiliate networks or irregular sites has publicly linked its work to technical incidents. Frank Kruit reported attempts to take over his LinkedIn account that he related to his investigations against illegal gambling affiliates. Those statements were his and do not imply proof of external culpability.

For CasinoNieuws there are no public data on a possible perpetrator or their motive. What is documented is the reported loss of accessibility by the site itself and a study that identified thousands of registrations tied to the gambling ecosystem.

SIDN seeks to institutionalise early flagging; CasinoNieuws aims to recover normal service. The combination exposes a practical threat: access overload can limit the dissemination of investigations that, precisely, seek to increase visibility on illegal offers.

"The structure of some domains makes the return of alternative addresses easier; removing nameservers is not a definitive solution," SIDN noted in its report, which distinguishes categories and measures taken.

"Thousands of registrations appear linked to the gambling ecosystem, but that does not make every address an illegal operator," SIDN's communication published on 29 September warned.

What the sector should watch

Operators, platforms and regulators should bear in mind that risk identification requires verification and that the mere presence of a gambling-related name is not proof of illicit activity. For journalists and compliance teams, the recommended practice remains to cross-check registrations, confirm licences with the Nederlandse Kansspelautoriteit and review the final destination of traffic. For newsroom procedures see [news](/news).

For technical readers: reuse of domains with history and the use of device-differentiated presentations increase investigative workload and make inspection necessary at multiple times and conditions.

SIDN and the Nederlandse Kansspelautoriteit appear as the actors that must coordinate more closely to prevent reemerging networks from continuing to capture users via alternative domains.