CasinoNieuws website targeted by attack after investigation into illegal gambling sites 

A news website that helps investigate illegal gambling networks suddenly receives so much traffic that readers start seeing error messages. CasinoNieuws.nl reports serious accessibility problems on LinkedIn and points to a bot network. The editorial team suspects a connection with its cooperation in an investigation by SIDN, the organisation that manages the Dutch .nl domain. Who is behind the suspicious traffic has not been publicly established. 

The investigation referred to by the news website uncovered an extensive network of gambling-related domains. SIDN spent four months examining more than 100,000 domain registrations. Since the investigation began, almost 1,800 domain names have been made inaccessible. Behind them are different types of websites: from actual illegal gambling offers to old domains that were given a second life as redirect sites to foreign casinos. 

CasinoNieuws reports millions of visits and error messages 

In its LinkedIn post about the accessibility problems, CasinoNieuws describes an exceptional amount of traffic during the weekend and on the day of the post. According to the editorial team, the server was regularly under heavy pressure, causing visitors to see error messages. With an ironic reference to the appeal of its own articles, the news website mentions millions of visits and traffic from a bot network. 

CasinoNieuws suggests that someone may be unhappy about its recent cooperation with the SIDN investigation. That is the editorial team’s explanation, not an independently established motive. The public statement contains no technical analysis, no identified attacker and no evidence that definitively proves the connection. The news website says it is working to restore accessibility and asks readers for patience. The statement does not make clear whether access has since been fully restored. 

A suspected attack affects access to news 

The pattern described is consistent with a suspected DDoS attack: so much traffic is sent to a service that normal visitors are unable to use it properly. However, CasinoNieuws’ public statement is not sufficient to determine the technical nature of the incident. The term “millions of visitors” also requires context. If part of the traffic was automated, that does not mean that millions of different people actually read the articles. 

For readers, the effect is concrete. They try to open an article and receive an error message. Such an incident therefore also affects access to information about licences, enforcement and illegal gambling offers. Investigations into gambling networks need public visibility precisely so that their findings can reach players and the companies involved. The reported incident highlights that vulnerability, without yet making clear who caused the overload. 

SIDN investigated much more than online casinos alone 

The SIDN investigation into illegal gambling sites using .nl domains was published on 29 September. Of the more than 100,000 registrations examined, around 2,900 had a clear connection with online gambling. Almost 600 of these belonged to legitimate operators, government organisations or industry bodies. A gambling-related domain name was therefore not in itself proof of a violation. 

CasinoNieuws assisted SIDN with knowledge of the Dutch gambling market, an overview of licensed operators and an initial distinction between legitimate and suspicious parties. The further analysis and classification were carried out by SIDN. That distinction matters: the news organisation provided expertise, while the domain registry conducted the investigation and took action against registrations. The result provides a picture of the infrastructure surrounding illegal gambling, not only of casinos where players can directly wager money. 

112 gambling sites and hundreds of other suspicious registrations 

SIDN identified 112 .nl domains where people could actually gamble for money without a licence from the Dutch Kansspelautoriteit. It also identified 312 registrations without an active gambling website that were considered a possible risk because of their names and registration patterns. A suspicious registration without active content is different from a confirmed violation. The investigation therefore kept those categories separate. 

SIDN also found 121 websites that misused the names or logos of legal operators and 70 so-called link sites. The latter category sometimes appeared to be a casino itself, but redirected visitors to another gambling website after a click. The almost 1,800 domains made inaccessible therefore cannot simply be described as 1,800 separate illegal casinos. The total includes a broader group of registrations and websites connected to the supply and promotion of online gambling. 

Old domains are reused to generate gambling traffic 

The largest category described consisted of more than 1,480 reused websites. These included domains previously belonging to former shops, local initiatives or conferences. Once the original owner allowed a domain name to expire, another party could register it again. The address was then used for gambling-related articles or links to foreign casinos. Visitors could therefore end up on gambling content through a seemingly familiar domain name that had nothing to do with the original organisation. 

The attraction lies in the history of such a domain. A website that has existed for years may have built up links and search visibility. The new owner may try to benefit from that when distributing casino content. Gambling Club previously discussed this method in its interview with Frank Kruit about manipulation of casino search results. In that interview, the SEO specialist warned about old domains suddenly being filled with gambling content and directing players to unlicensed operators. 

Well-known casino names are used as bait 

Brand misuse makes the problem more difficult for players to recognise. A familiar logo or a domain name resembling a well-known operator can create a false impression of reliability. SIDN found not only similar names, but also copied websites with registration and login functions. In those cases, the distinction between the genuine platform and an imitation is particularly important: a familiar appearance says nothing about the party actually operating the website. 

A similar issue exists in Belgium. Gambling Club reported on more than twenty fake websites using the PepperMill Casino name. That case shows why relying solely on a brand name is not enough. The exact domain name and the licence of the relevant operator must match. The Dutch SIDN investigation and the Belgian PepperMill case are separate matters, but both show how an existing brand identity can mislead visitors. 

Websites do not show every visitor the same content 

The SIDN investigation also describes methods used by websites to try to evade checks. In some cases, the content changed depending on the time of day or the device being used. A visitor using a smartphone could see different pages from someone using a computer. Known IP addresses belonging to government or law-enforcement organisations were also blocked. A check carried out at one moment and on one device may therefore fail to show what other visitors see. 

Other websites initially displayed free games and only later redirected users to real-money gambling. That makes investigations more labour-intensive: a first look at a webpage does not always reveal the full picture. Researchers therefore had to examine doubtful cases manually as well. For enforcement purposes, what matters is what a website actually does, where visitors are directed and which operator is behind it. A clean-looking homepage can differ significantly from the eventual destination. 

Making a domain inaccessible is not the same as deleting a website 

According to CasinoNieuws’ reporting on the investigation, holder verification was used in most cases. SIDN checks the registration details of a domain name. If the holder cannot prove within the required period that the information is correct, the nameservers can be disconnected. A smaller number of cases were handled through the Notice-and-Take-Down procedure for clearly unlawful use. Both routes have their own conditions; suspicion alone does not mean every domain is immediately removed. 

The measure affects accessibility through the domain name. The files stored with the hosting provider are not automatically deleted, and the organisation behind the website does not necessarily cease to exist. That helps explain why new addresses can continually appear. SIDN therefore says it wants to cooperate more closely with the Kansspelautoriteit. Rapid detection must be followed by assessment and concrete action, otherwise the network can continue reaching visitors through other registrations. 

Belgium’s blacklist shows the same problem with web addresses 

Belgium must also take into account operators that use multiple domain names. In a decision dated 28 September, the Belgian Gaming Commission added 31 websites to its blacklist, bringing the total number of entries to 1,016. Gambling Club’s reporting on the expansion of the Belgian blacklist with illegal gambling sites included several variations of the same names. The number of web addresses therefore does not automatically correspond to the number of separate companies. 

Licensing also remains territorially relevant. The SIDN investigation assesses gambling offers from a Dutch perspective; for Belgian players, Belgian authorisation is what matters. A Dutch domain name or a foreign licence is not proof of a Belgian licence. For Gambling Club readers, the practical lesson of the investigation lies mainly in that verification: familiarity, search visibility and a professional-looking website are no substitute for the required local authorisation. 

Researchers more often report resistance linked to illegal gambling 

CasinoNieuws is not the first party to suggest a link between research into illegal gambling and digital incidents. Gambling Club previously reported on Frank Kruit’s claims that attempts had been made to take over his LinkedIn account. Kruit linked those incidents to his work against illegal gambling affiliates. In that case too, the explanation about the background of the incidents was his own. 

Those earlier reports do not prove that the same people are behind the traffic targeting CasinoNieuws. They do, however, provide context for the concerns of people investigating such networks. For the current incident, no publicly established information is available about the perpetrator or motive. What is clear is that CasinoNieuws itself reported accessibility problems and that the investigation identified thousands of gambling-related registrations. SIDN wants to make detection more systematic, while CasinoNieuws wants its readers to be able to access the website again without encountering error messages.