Clone site patterns
Build patterns that repeat across incidents. Compiled 2026-08-10 from the year's log. Individual tells rotate, the patterns hold.
Domain patterns
Domains registered in sets, 8 to 15 at a time, same registrar, same 48 to 96 hour window. A single live clone usually means its siblings are parked and waiting.
Cheap and lax first. .icu, .lat, .cyou, .sbs recur through 2026. Country TLDs appear when the target market has one strongly associated with gambling mirrors.
Three naming families. Exact brand plus a number or suffix. Brand with one character swapped. Brand plus casino, bet, play, win, official, mirror. The official and mirror suffixes convert best in blocked markets.
Template tells
Scraped sites freeze at scrape time. Promos that expired months ago, last year's tournament banners, a copyright year behind the real site. On 2026 clones we still find 2024 promo text.
Top navigation works, depth does not. Responsible gambling pages, complaint forms and license seals either 404 or link to the genuine operator, which the cloners leave in by mistake.
Regulator seals copied as flat images. A genuine seal click-throughs to the regulator's validation page for that exact domain. Clone seals link nowhere or to the real casino's validation entry, a mismatch that settles it in seconds.
Cashier behavior
Always functional, minimal KYC, crypto and fast local methods favored. Several July 2026 entries showed clone cashiers accepting deposits below the real brand's minimum, a tell in itself.
Pending review that never resolves, or a demand for a verification fee. The fee request marks the terminal stage, after it the domain is usually rotated within two weeks.
Rotation timing
Median clone lifespan in our 2026 entries runs 3 to 6 weeks from first observation to takedown or voluntary rotation. Paid-ad-fed clones burn faster, SEO-fed clones last longer. Operators that pursue the whole registered batch rather than the single live domain cut the follow-up incidents sharply, which is the strongest argument for treating the batch, not the site, as the unit of response. Removal routes are covered in who removes clone casinos.