Kansspelautoriteit secures removal of 26 .co.nl domains linked to fraud

The Kansspelautoriteit removed 26 sites using the .co.nl extension that replicated licensed operators' pages and redirected users to illegal gambling services; the action was completed after notifying the operator CO.NL on 7 October 2026. Operator CO.NL cooperated and the sites were offline within a maximum of 48 hours. In the wider investigation the Ksa has notified and achieved the removal of 86 domains on .CO.NL associated with unauthorised gambling activity.

What the Kansspelautoriteit detected on .co.nl

The Kansspelautoriteit, the Dutch gambling regulator, identified a pattern: unauthorised actors were recreating licensed operators' websites and registering variants using the .co.nl extension. That extension is intended for Dutch business sites and is managed by the independent operator CO.NL. Fraudsters substituted the official ".nl" suffix with ".co.nl" to appear legitimate. From those cloned pages users were redirected to an unlicensed gambling platform.

Most of the 26 removed domains were direct copies of pages belonging to vergunninghouders (licensed operators). After the Ksa's notification, CO.NL removed the registrations at the regulator's request; all flagged pages were taken offline in less than 48 hours.

The role of the operator CO.NL and the 48-hour response

CO.NL is the provider of the .co.nl extension and acted as the technical contact in this case. The Ksa supplied CO.NL with evidence on the fraudulent domains and the operator executed the removal of the indicated domain names. The time window from notification to disconnection did not exceed 48 hours in the cases reported by the Ksa.

The registry's cooperation was decisive to stop immediate dissemination of the copies and to cut redirect paths to the illicit sites.

Scope of the probe: 86 domains removed on .CO.NL

The Kansspelautoriteit's inquiry was not limited to the initial 26 replicas. Following review of the .CO.NL records, the Ksa identified and reported a total of 86 sites that showed vulnerabilities or misuse related to the offering of unlicensed gambling. All those domains were notified and removed by operator CO.NL as a result of the regulator's communication.

That figure includes both clear copies of authorised operators' pages and other entry points used to direct traffic to platforms without permission in the Netherlands.

Consumer risk and impersonation method

The schemes detected share a common objective: to deceive the user into believing they access the legitimate site of a licensed operator when in fact they enter a clone. The typical mechanism was:

1. Registration of a domain that reproduces the brand, design or structure of a licensed operator, replacing ".nl" with ".co.nl".

2. Publication of content that imitates the authorised website to gain the visitor's trust.

3. Redirection from the clone to an unlicensed gambling platform where play or deposits are offered.

That flow exposes consumers to the risk of fraud, loss of funds and absence of regulatory protections that licensed operators provide.

Implications for operators and registries

Licensed operators face reputational risk and user loss when their sites are cloned. The Ksa's findings underline the need for brand holders to monitor domain registrations and to activate rapid notification channels with registries.

Registries and registry operators have an operational role: cooperation between the Kansspelautoriteit and CO.NL enabled swift removals. For operators and DNS infrastructure providers, the practical recommendation is to improve response processes to regulatory notices and deploy proactive monitoring of registrations that use registered brands.

Next phase and ongoing surveillance

The Kansspelautoriteit continues to monitor misuse of domains and will keep investigating and notifying registries when it detects cloning or redirects to unlicensed gambling services. The case also underscores the relevance of cooperation between the regulator and technical operators to mitigate consumer harm.

For follow-up and regulatory context, the sector can consult coverage of rules and sanctions in [regulation](/regulation) and operational news in [news](/news).

“We detected copies of licensed operators' sites and informed the registry for their removal; the pages were offline in under 48 hours,” the Kansspelautoriteit said in its statement.

“The co operation of the .co.nl extension operator allowed a rapid removal of the fraudulent domains,” the regulator added.