KSA forces removal of 26 fraudulent .co.nl cloned gambling sites — what buyers need to know

The Kansspelautoriteit (Ksa) has reported a targeted enforcement action against misleading .co.nl domain names that were being used to present illegal gambling. In collaboration with the independent CO.NL operator, Ksa notified the operator about fraudulent domains that cloned licensed operators’ websites by substituting .nl with .co.nl; 26 offending .co.nl websites were taken offline within a maximum of 48 hours after notification, and in total 86 .co.nl domains have been reported and removed to date.

Verified facts

• The Kansspelautoriteit (Ksa) reported an enforcement action focused on misleading .co.nl domain names used to present illegal gambling.
• Ksa identified that illegitimate gambling operators were cloning websites of licensed operators by using .co.nl instead of .nl to mislead consumers and then redirecting visitors to illegal gambling sites.
• Ksa notified the CO.NL domain operator; following notification, 26 offending .co.nl websites were taken offline within a maximum of 48 hours.
• In total, Ksa has reported 86 .co.nl websites to the operator which were then removed.
• Ksa discovered additional illegal gambling sites during the .co.nl investigation beyond those 26 initially removed.

GEOs and markets

Netherlands

Brands and organisations

Kansspelautoriteit (Ksa), CO.NL

Impact on media buyers

GameHub editorial analysis: Raises destination‑quality risk for NL‑facing campaigns; immediate need for destination QA, domain verification and creative claims review for affiliates and media buyers operating in or targeting the Netherlands and Dutch users, including redirected traffic checks and blacklist updates for .co.nl variants of legitimate domains. Increased regulator willingness to engage domain operators and act quickly against cloned domains is now a clear enforcement precedent in NL market oversight. Also signals potential for similar abuse on other second‑level domain extensions and need for active monitoring across domain variants and redirects in paid funnels and SEO assets. Operators should check brand protection processes and DMARC/DNS reputation for cloned page abuse. Affiliates should run destination and redirect scans, update suppression lists, and remove any creatives pointing to .co.nl clones.

GameHub comment

GameHub editorial analysis: Practical analysis for GameHub Partners media buyers (EN) — 420 words What happened: The Kansspelautoriteit has publicly described a targeted takedown of cloned websites using the .co.nl extension, removing 26 fraudulent domains within 48 hours after contacting the CO.NL operator and reporting a total of 86 domains to date. The core abuse pattern is straightforward: fraudsters copy licensed operators’ sites but swap the final .nl for .co.nl, present the cloned pages to Dutch users and then funnel traffic to illegal gambling platforms. Ksa’s action establishes a clear, documented enforcement path: regulator detection → domain‑operator notification → rapid removal. For affiliates and media buyers this creates three immediate operational imperatives. 1) Destination and redirect QA: Every NL‑directed landing URL, tracking domain and affiliate redirect must be scanned for domain variants and unexpected redirects. Standard checks (HTTP status, SSL, and WHOIS) are insufficient; you must monitor for lookalike second‑level domains (.co.nl, .com.nl, .net.nl and other localized variants) and chain redirects that end at non‑licensed destinations. Implement automatic redirect tracing across your ad and affiliate funnels, and re‑run checks frequently during campaign runtime. 2) Creative and claim verification: Cloned pages often display copyrighted operator branding and responsible‑gambling messaging to appear legitimate. Do not assume a landing containing licensed branding is authorized. Require operators to provide proof of brand‑owned domains, signed landing agreements and control over DNS records for any pages used in paid funnels. Remove any creatives that point to .co.nl variants until operators have certified ownership. 3) Blacklists, monitoring and rapid takedown playbook: Add .co.nl clones and other suspicious SLDs to your internal suppression lists and post‑click monitoring. Keep a takedown playbook that includes: (a) capture forensic evidence (screenshots, redirect logs), (b) contact the domain operator (and Ksa where relevant), (c) pause buys to the destination, and (d) update compliance and affiliate partners. Ksa’s ability to secure removals in 48 hours demonstrates domain operators will act when engaged directly; incorporate direct operator contact steps into incident response. Wider implications: This action signals heightened regulator willingness to cooperate with domain registries and to publicise enforcement results. Media buyers should treat domain‑variant fraud as a persistent market hygiene issue in the Netherlands and expand automated domain variant detection, contractual landing‑domain verification and post‑click monitoring in NL campaigns. The Ksa precedent also suggests similar approaches could be effective in markets where independent domain operators host regionally scoped SLDs.

Editorial note: The “Verified facts” section reports the primary source. The impact and GameHub comment sections are editorial analysis, not claims made by the organiser.