Kansspelautoriteit forces removal of 26 cloned .co.nl gambling sites

The Kansspelautoriteit removed 26 deceptive websites using the .co.nl domain extension after those pages cloned the look and content of licensed Dutch gambling operators. The action, carried out in cooperation with the independent CO.NL operator, saw the offending sites taken offline within a maximum of 48 hours; Ksa says a total of 86 illegal gambling-related domains have been reported to CO.NL and removed so far. The regulator published the findings on 7 October 2026.

What Ksa found when investigating .co.nl cloned websites

Ksa uncovered a wave of fraudulent gambling pages that were near-identical copies of websites run by licence holders. The sites used existing elements from lawful operators but swapped the country-code extension .nl for the multi-level extension .co.nl. Visitors to those cloned pages were then redirected onward to illegal gambling platforms.

The regulator describes the practice as a targeted attempt to mislead consumers by reproducing licensed-brand assets on a domain that looks superficially Dutch. Ksa identified that almost all of the 26 removed pages were direct clones of sites belonging to operators that hold licences in the Netherlands.

How the .co.nl extension is structured and why it was abused

The .co.nl extension is offered by an independent operator under the label CO.NL and was developed for websites of Dutch businesses. It is a multi-level domain that allows third parties to register names under co.nl rather than directly under .nl.

• The technical design of co.nl makes addresses look familiar to Dutch consumers because they include the country code element “nl”.

• Illegal operators exploited that familiarity by recreating licensed sites and appending .co.nl instead of .nl.

CO.NL is not a regulator but the domain operator responsible for administering registrations under the co.nl extension. When Ksa notified the CO.NL operator of the fraudulent pages, the operator cooperated and removed the websites promptly.

Timeline and results of the takedown operation

Ksa reported that, after informing the CO.NL operator, the 26 deceptive pages were taken offline within a maximum of 48 hours. The regulator emphasised that the operator “worked well” with the authority to remove the content.

During the broader probe of sites using the .co.nl extension, Ksa discovered additional illegal gambling sites. The regulator has so far reported 86 domains to CO.NL and had these removed.

Legal and consumer-protection implications for the Netherlands

The action is framed as a consumer-protection and enforcement measure by the Kansspelautoriteit in the Dutch market. Cloned pages can undermine the effectiveness of licensing by confusing consumers about which websites are lawful and which are not. Redirects from a deceptive co.nl page to an illegal gambling site create an additional layer of concealment that can hinder enforcement and harm consumers.

Licenced operators whose assets were copied remain the parties whose brand integrity and customer safety were compromised. The removals do not change a licence holder's responsibilities, but they do remove specific vectors that illegal operators use to recruit or trick Dutch players.

What operators and domain registries should consider next

Domain registries and the licensed gambling sector face two distinct tasks: preventing brand impersonation and improving rapid-response mechanisms for takedowns. Ksa’s case demonstrates that cooperation between a regulator and a domain operator can produce fast outcomes — the 48-hour removal window is the concrete result Ksa reported.

Operators that discover cloned versions of their sites on unfamiliar extensions should log the incident with the relevant domain operator and notify the Kansspelautoriteit. Registries that host multi-level or third-party extensions should review their abuse-reporting channels and consider measures to detect mass cloning attempts before they direct traffic to illegal platforms.

Where this sits for enforcement and monitoring

Ksa’s intervention addresses a specific abuse pattern rather than any change in licensing rules. The regulator is continuing its monitoring of online markets and remains prepared to escalate enforcement where cloned sites facilitate illegal gambling activity. The removal of 26 pages and the reporting and removal of 86 domains to date are the concrete enforcement outcomes the Kansspelautoriteit has published.

Operators and compliance teams tracking brand protection may also find the regulator’s activity relevant when prioritising monitoring of domain registrations and implementing technical checks that detect lookalike pages. For broader regulatory context see the regulation section on our site.