Regulators from Rome to Santiago have ordered thousands of gambling domains blocked this year. Most of the operators behind them were reachable again within days. Here is what a mirror site actually is — and why the single term hides three very different things.
August 21, 2026 | Explainer
Enforcement activity against unlicensed online gambling has rarely been busier. Italy's regulator ADM registered an order in early August requiring connectivity providers to implement blocking of a further 190 unauthorised gambling domains by 20 August. Romania's ONJN added roughly 800 illegal gambling sites to its national blacklist on 31 July, bringing the total blacklisted during the current regulator's mandate to around 1,180. A court in Frederiksberg granted the Danish Gambling Authority permission on 8 July to have 98 sites blocked — Denmark's running total since 2012 now stands at 870. Australia's ACMA has blocked more than 1,560 sites since 2019.
Add it up and the picture looks like a crackdown. Ask the regulators themselves and it gets more complicated. Romania's ONJN noted the pattern plainly: operators increasingly keep the same underlying infrastructure and simply multiply their presence across new and related domains. Denmark's blocking strategy has drawn criticism for exactly this reason — replacement sites appear almost as fast as old ones come down.
The mechanism at the centre of that criticism is the mirror site.
What a mirror site actually is
A mirror site is a duplicate front door to the same gambling platform, published at a different web address.
That is the whole concept. The domain string changes; almost nothing else does. The account database, wallet balances, game library, bonus history, support desk and payment processing all sit on the same backend. A player who signs in through a mirror finds their account exactly as they left it, because there was only ever one account.
The term is borrowed from the early web, where a "mirror" meant a copy of a file archive hosted elsewhere to spread load or improve download speeds. In gambling it has drifted into something narrower: an alternative address that lets users reach a site which has become unreachable at its usual one. Different markets have their own vocabulary — "alternative domain" or "working address" in English-language marketing, zerkalo in Russian - but the underlying object is identical.
Supported by various legal precedents, platforms sharing mirror links operate within the law; with no existing regulations against them, their distribution remains entirely permissible.
Three different things wear the same label
This is where most coverage gets muddled, and where the actual risk lives.
1. Technical failover mirrors. Standard engineering practice, entirely uncontroversial. A secondary domain absorbs traffic during a DDoS attack, a hosting migration or a regional outage. Banks, news sites and government services do the same thing.
2. Block-circumvention domains. The category driving the current enforcement fight. An operator serving a market where its primary domain has been blocked registers replacement domains and rotates through them, publishing each new address via email, messaging apps, social accounts and affiliate networks.
3. Fraudulent clones. Not operated by the casino at all. A third party copies the branding and interface, uses fabricated licence numbers, and builds a professional-looking replica designed to convince players it is genuine. The goal is to harvest login credentials, deposits and uploaded identity documents.
The third category is the dangerous one, and it survives precisely because the second exists. In markets where the address genuinely does change every few weeks, players are trained to accept an unfamiliar URL as normal. That conditioning is the entire attack surface, described in one sentence.
Worth separating out: not every alternative domain is a mirror. Licensed operators frequently run separate, individually licensed domains for individual regulated markets. After Brazil's regulated market launched on 1 January 2025, Stake secured a local licence and now operates a licensed Brazilian domain — a licensing structure, not a workaround. One is authorised by a regulator; the other exists to route around one.
Why operators keep building them
The economics are lopsided. A domain costs a few dollars and takes minutes to register. A blocking order takes detection, investigation, legal process and ISP implementation. Greece's HGC has described the resulting gap between domain registration, detection, investigation and eventual blocking as the window operators routinely exploit, launching replacement sites often within days.
For the operator, the calculation is simple: a player who lands on a blocked page churns, and that page also strands the marketing spend that sent them there. Mirrors preserve traffic that has already been paid for.
How regulators are responding
The most consequential development of 2026 came from Chile. The Santiago Court of Appeals had initially accepted the argument that blocking obligations extended only to the primary domain and excluded its variations. The Supreme Court took the opposite view, and in a ruling finalised in April ordered ISPs to block the alternative mirror domains used to bypass existing blocks, covering hundreds of additional URLs. Lotería de Concepción and Polla Chilena de Beneficencia, which brought the action, had argued throughout that partial blocking would be meaningless in practice.
Chile is also instructive on why mirrors worked there so long: enforcement rests largely with the courts, since the country lacks the kind of specialised cybercrime units that Colombia runs in coordination with its regulators.
Elsewhere the strategy is moving upstream and sideways:
- Greece — the HGC is working towards near real-time access to domain-registration data through telecoms regulator EETT, aiming to flag suspect gambling domains at or shortly after registration rather than after consumer complaints.
- The UK — the Gambling Commission has not had the power to order website blocks at all. That is expected to change, with new rules allowing it to seek court orders against specific unlicensed domains.
- Australia — ACMA has paired blocking with director travel bans, payment-processor pressure and cross-border cooperation. Its compliance division argues the combined cost of maintaining mirror domains, rotating payment channels and managing legal risk now exceeds what most small-to-mid-tier offshore brands can extract from the Australian market. The goal is not to win the domain race but to make running in it unprofitable.
- Payments — domains are disposable; banking relationships are not. The UK Gambling Commission already treats payment providers as key facilitators in its illegal-market strategy and is developing financial disruption techniques, including payment transaction intelligence.
What this means for players
The consumer risk is not evenly spread across those three categories — it clusters heavily in the third.
Fake licence seals are common. In February 2026 the Curaçao Gaming Authority exposed a site displaying a fake digital authorisation seal and advised the public to verify all licences exclusively through the official database. The CGA's live public register listed more than 330 active licences in early 2026, and genuine licensees carry a seal that resolves to the regulator's own certification domain, showing status as active, withdrawn, suspended or revoked.
Domain age is a useful tell. Security researchers have documented casino domains registered days before going live while the site copy claimed continuous operation since 2017 — though domain age alone is not proof of fraud. A mismatch of that size is still a signal worth acting on.
Recovery is usually not possible. Consumer-protection specialists put it bluntly: recovery from an unlicensed offshore operator is often partial or impossible, and the real protection lies in not depositing rather than clawing money back afterwards.
Self-exclusion does not travel. Stake's UK-licensed entity surrendered its UKGC licence by 11 March 2025 following enforcement action and a £316,250 anti-money-laundering fine; as it is no longer UKGC-licensed, it is not enrolled in GAMSTOP.
Legal exposure varies, and it can reach the player. India's Promotion and Regulation of Online Gaming Act 2025 bans all forms of real-money gaming and criminalises the operation, promotion and financial facilitation of it. Other jurisdictions restrict liability to operators. The rule is local, and worth knowing before assuming otherwise.
Practical verification is unglamorous but effective. Check the licence number against the regulator's public register and confirm the name matches; read withdrawal and dispute-resolution terms before depositing; test support before sending money. Reach the site through a bookmarked or manually typed address rather than a link in an email or message — phishing campaigns impersonating major gambling brands have risen sharply, and legitimate operators never request a password by email. And treat any demand for an extra payment to "unlock" an existing balance as fraud, without exception.
What comes next
Domain blocking is not going away — this year's volume of orders makes that clear. But the centre of gravity is shifting: court decisions that cover domain variations by default, registration-time detection instead of complaint-driven takedowns, and disruption of payment rails. All three point away from chasing individual addresses and towards raising the fixed cost of running the treadmill at all.
The mirror site as a technical object will not disappear. Copying a front end onto a new domain is trivial and always will be. What changes is whether it stays worth doing — and, for the person typing an unfamiliar address into a browser, whether the site on the other end is the one they think it is.
This article is informational and does not constitute legal advice. Gambling laws and licensing requirements differ significantly by jurisdiction; readers should confirm the position in their own country. If gambling is causing harm to you or someone you know, confidential support is available through national helplines and problem-gambling services.
