Why ACMA Blacklists Don’t Stop Mirror Sites (And the Risks of Playing on Domain Clones)

Key Points

• ACMA asks internet service providers to block illegal gambling websites, but an access block does not necessarily shut down the operator or its infrastructure. Replacement domains can appear.
• A genuine operator-controlled mirror and a fraudulent phishing clone are different. Familiar logos, matching layouts and “official mirror” labels do not prove who controls a website.
• Domain changes create opportunities for scammers to steal passwords, deposits and identification documents through fake migration messages.
• The Interactive Gambling Act targets providers and prohibited advertising—not ordinary customers merely accessing or playing on a service. That does not make offshore casinos authorised or safe.
• A website’s absence from ACMA’s blocked list is not approval. Payment logos and overseas licensing do not establish Australian authorisation either.
• Prioritise security: avoid unfamiliar migration links, never pay to unlock an existing balance and preserve your records. If details were exposed, secure affected accounts, contact your financial provider and report the incident through official channels.

Mirror or Phishing Clone? The Risks Behind Casino Domain Changes

Your usual casino address stops loading. A message arrives claiming the website has moved. The replacement looks familiar: same colours, same logo, same games.

But is it the same operator, an unrelated impersonator or a page designed to steal your login?

That uncertainty is the central risk of casino mirror sites.

The Australian Communications and Media Authority can ask internet service providers to block access to illegal gambling websites. However, restricting access to a particular address does not necessarily close the underlying business or prevent another address from appearing.

This does not mean blocking achieves nothing. It means access disruption and permanent shutdown are different outcomes.

There is also an important legal distinction: the Interactive Gambling Act 2001 targets providers and prohibited advertising, rather than ordinary customers simply accessing or playing on a service. That is not blanket immunity for unrelated unlawful conduct, nor does it make an offshore casino authorised or safe.

For Australians, the practical problem is less about a penalty for opening a mirror and more about losing money, exposing identification documents or entering credentials on the wrong website.

This guide explains how blocking works, why replacement domains appear and why familiar branding cannot establish who controls a page.

What Is an ACMA Blacklist?

“Blacklist” is an informal description of the addresses identified for blocking.

ACMA’s official terminology includes “blocked gambling websites”. Its published information explains that blocking can address websites providing prohibited gambling services, unlicensed regulated gambling services or advertising for those services.

Those categories are distinct.

An online casino offering pokies to Australians involves prohibited services. A wagering website without a valid Australian licence involves a different licensing problem. An affiliate page can also attract action through prohibited advertising.

A list of blocked addresses therefore should not be read as a directory containing only casino operators.

More importantly, it is not a complete list of every unsafe website.

A domain absent from the list has not necessarily been investigated, approved or assessed as trustworthy. Treating “not blocked” as “verified” reverses the purpose of the system.

How ACMA’s ISP Blocking Mechanism Works

Two Acts Have Different Roles

The Interactive Gambling Act 2001 establishes relevant gambling prohibitions.

The assistance mechanism used for website blocking comes from section 313 of the Telecommunications Act 1997.

ACMA explains that it can ask internet service providers to help disrupt illegal online content by blocking access where serious criminal or civil offences are involved.

It is therefore imprecise to describe every block as a court-ordered domain seizure under the gambling legislation.

What an ISP Block Changes

An ISP block restricts access through the participating provider’s network.

Government guidance on section 313 contemplates blocking domain names or specific website addresses rather than unnecessarily broad internet-address blocks.

At a high level, domain-name blocking affects the process used to connect a typed website name with its internet destination. Other implementations can target particular addresses.

The essential point is that an access restriction does not necessarily remove the website’s files from its hosting service.

Nor does it automatically transfer its domain registration, freeze its accounts or reimburse customers.

What Users May See

A user may encounter an ACMA notice explaining that access has been blocked because the website breaches Australian gambling rules.

ACMA’s notice distinguishes prohibited casino services from wagering services lacking the required Australian licence.

That notice is an enforcement warning—not a request to find another entry point.

Why Replacement Domains Can Appear

An online service can involve several separate components:

• A domain name.

• Hosting infrastructure.

• Website software.

• Customer-account records.

• Payment arrangements.

• The business controlling the service.

Changing the public address does not necessarily require replacing every component.

An operator may present substantially the same service through another domain. That new address may require assessment and further disruption action.

ACMA has acknowledged this problem. In reporting by the ABC, the regulator explained that some services establish alternative websites to circumvent blocking and that it continues monitoring and taking action against them.

This is an enforcement cycle, not proof that a replacement is permitted.

It also does not establish that domain changes always preserve accounts, balances or customer protections. Continuity must not be assumed.

A Mirror, a Migration and a Phishing Clone Are Different

The labels are often used loosely, but the differences matter.

A website can look identical without sharing the original account system.

Conversely, a page controlled by the original operator can remain an illegal offshore service targeting Australians.

Authenticity and authorisation are separate questions.

Identifying the operator would resolve only one part of the risk assessment.

Do Australian Players Face Penalties for Accessing Mirrors?

The Commonwealth Government describes the Interactive Gambling Act as targeting providers, not their potential or actual customers.

Accordingly, an ordinary customer does not commit an offence under that Act merely by accessing or playing on an offshore casino mirror.

However, the statement needs boundaries.

It does not mean every related activity is lawful. Fraud, identity misuse and other unlawful conduct remain separate matters.

It also does not mean a player can freely promote or facilitate access to prohibited gambling services.

ACMA has warned that promotion, including certain links and directions to illegal services, can attract enforcement action. Customer participation and public promotion should not be treated as the same activity.

The absence of a player-access offence is therefore not a safety rating, consumer guarantee or invitation to bypass restrictions.

Why Domain Changes Create Phishing Opportunities

Phishing works by persuading someone to trust an impersonator.

The Australian Cyber Security Centre explains that scammers can imitate trusted organisations through convincing messages, branding and websites to obtain passwords, banking details and account access.

Domain migration creates a useful pretext for that deception.

A message saying “our address has changed” asks the customer to accept an unfamiliar destination as legitimate. Someone concerned about an existing balance may be especially motivated to act quickly.

That does not prove every migration message is fraudulent.

It explains the additional trust decision the customer is being asked to make.

There is no verified percentage in this guide for how many casino mirrors are phishing pages. The risk is a credible mechanism, not a claimed prevalence statistic.

The important warning is practical: a familiar-looking replacement can ask for new disclosures without first proving who controls it.

Brand Imitation Is a Documented Problem

This is not purely hypothetical.

In June 2026, ACMA identified gambling websites imitating the licensed ChromaBet and PointsBet services when announcing further blocking action.

That establishes a concrete distinction between a licensed brand and an unrelated website using a similar identity.

It does not establish that every imitation captures passwords or uses the same technical method.

However, it demonstrates why recognition alone is insufficient. A similar name, familiar colours or an Australian presentation cannot confirm the operator.

For wagering services, check the exact operator and website against authoritative licensing information. Do not assume a licence belonging to a recognised brand covers a lookalike address.

For offshore online casinos, an overseas licence still does not authorise casino services to Australians.

Five Risks Behind a Familiar-Looking Clone

1. Stolen Login Credentials

A copied login page can collect a username and password without providing genuine account access.

Reusing that password elsewhere can widen the exposure.

A page displaying an error after submission should not prompt repeated attempts with other passwords.

2. Lost Deposits

A clone may direct payments to an unrelated account or wallet.

An amount appearing on a website’s balance screen is not independent confirmation that the expected operator received the money.

A successful small transaction also cannot prove future withdrawals will succeed.

3. Exposed Identity Documents

A supposed “account migration check” may request a passport, licence, selfie or bank statement.

Once disclosed to an impersonator, those documents cannot be protected merely by changing a password.

4. Compromised Devices

Unexpected downloads, browser extensions or remote-access requests can introduce additional security risks.

Do not install software simply because a message claims it is required to restore account access.

5. Recovery Scams

After money disappears, another contact may offer to retrieve it for an advance payment.

Treat promises of guaranteed recovery cautiously. A second payment can compound the original loss.

Warning Signs That Deserve a Pause

No single visual check proves authenticity.

Instead, watch for combinations of unexpected changes and pressure:

• A message demanding immediate action.

• Requests for passwords or authentication codes.

• A new payment recipient without a clear explanation.

• An unexpected file, QR code or attachment.

• Claims that security checks must be skipped.

• A demand for payment to release an existing balance.

• Contact details that differ from earlier records.

• A supposed support agent asking to control your device.

Poor spelling can be a clue, but polished language is not reassurance.

Scammers can reproduce professional-looking pages and messages. The Cyber Security Centre specifically warns that phishing communications can appear authentic.

The safest response to uncertainty is to stop disclosing information—not to send a small deposit as a test.

Why “Official Mirror” Claims Are Weak Evidence

An “official mirror” badge is a statement made by the page displaying it.

It does not independently establish ownership.

Likewise, a support chat on the disputed website cannot independently verify that same website. The person answering could be part of the impersonation.

Search advertisements, comparison pages and social-media recommendations introduce further sources of uncertainty. Their presence is not evidence of regulatory approval.

For an existing dispute, use contact details preserved from earlier records and verify relevant licensing claims through the authority itself.

Even genuine contact with the original operator does not solve the Australian legal issue.

A real offshore operator can confirm that it controls a mirror while still offering prohibited services.

What Happens to Your Balance When a Domain Moves?

A domain change alone does not explain what happened to customer funds.

Possible questions include:

• Is the same legal entity operating the service?

• Does the original account still exist?

• Has any balance changed?

• Are previous withdrawal requests recorded?

• Have payment instructions or contractual terms changed?

ACMA warns that illegal operators may close or move and customers’ money can disappear.

It also warns that blocking may prevent customers from logging in to existing accounts.

However, blocked access is not itself evidence that ACMA confiscated the money. The regulator’s access restriction and the operator’s handling of funds are different events.

Do not pay a “migration deposit” simply to retrieve an existing balance.

Preserve statements and correspondence, and request a written explanation through a contact route you can independently establish.

What to Do If You Entered Details on a Suspected Clone

Secure Affected Accounts

From a trusted device, change the exposed password and any reused passwords.

Prioritise email and financial accounts if they share credentials. Enable suitable multi-factor authentication or passkeys where available.

Do not approve unexpected authentication prompts.

Contact Your Financial Provider

If card or banking information was exposed, contact the provider promptly using its official app, website or known telephone number.

Explain what information was shared and which transactions occurred.

Do not describe an authorised payment as unauthorised simply because a withdrawal dispute followed.

Preserve Evidence

Save the suspicious address, messages, receipts, transaction identifiers and approximate times.

Avoid returning to the page merely to collect more screenshots if doing so requires further disclosure or downloads.

Address Document Exposure

If identification documents were supplied, explain that exposure when seeking assistance. Follow relevant issuer and official identity-protection guidance.

Report the Incident

Report suspected cybercrime through official Australian reporting channels and notify ACMA about suspected illegal gambling services.

A report can assist investigation. It does not guarantee reimbursement.

What ACMA Can and Cannot Do for Customers

ACMA can investigate suspected breaches and use enforcement and disruption measures.

Its consumer guidance is clear about the limitations of illegal offshore services: Australian regulators may be unable to help when winnings are withheld or customers are treated poorly.

The regulator identifies options such as independent legal advice and contacting the relevant licensing authority.

That is different from promising to recover an account balance.

A blocked-site complaint is also different from a financial dispute. ACMA provides a process for concerns about incorrect blocking, but that process does not establish a right to use prohibited services.

Separate your objectives: reporting the operator, securing exposed accounts and pursuing money recovery may require different organisations.

Why Blocking Still Matters

A measure does not need to eliminate every instance of an activity to create disruption.

Blocking can interrupt straightforward access and present an official warning before someone enters credentials or deposits.

However, counting blocked domains is not the same as counting separate operators, affected customers or recovered dollars.

One service can use multiple addresses. An affiliate page can also appear in enforcement figures.

Claims that blocking is either completely effective or completely pointless need evidence beyond the existence of mirrors.

The reasonable conclusion is narrower: blocking addresses one access route, while ongoing monitoring and other enforcement address a moving target.

It should not be mistaken for a universal fraud filter.

Final Verdict: A New Address Is a New Trust Decision

ACMA blocking does not necessarily remove an offshore service’s infrastructure. That helps explain why replacement domains can appear.

But “mirror” is not a guarantee of continuity, and “clone” is not proof of who owns the page.

For Australian customers, verification means separating several questions: who controls the website, whether the service is authorised, where money is going and what information is being requested.

Ordinary access is not the customer offence targeted by the Interactive Gambling Act. That distinction does not protect a deposit, authenticate a message or make public promotion lawful.

Do not follow unfamiliar migration links, disclose new documents or pay to unlock an existing balance. Secure your accounts, preserve your records and use authoritative reporting and support channels.

Frequently Asked Questions

Why do casino mirror sites appear after ACMA blocks a website?

An ISP block restricts access to an address; it does not necessarily shut down the operator’s hosting infrastructure or account systems. An operator may introduce another domain, which can require further assessment and blocking action. A replacement address does not make the service authorised in Australia.

Is accessing a casino mirror site an offence for Australian players?

The Interactive Gambling Act targets providers and prohibited advertising rather than ordinary customers merely accessing or playing on a service. However, this is not blanket immunity for other unlawful conduct. Promoting prohibited gambling services is a separate issue, and the absence of a player-access offence does not protect your money or personal information.

What is the difference between a casino mirror and a phishing clone?

An operator-controlled mirror is an alternative address for that operator’s service. A phishing clone imitates a website to obtain passwords, payments or personal information. Both can look familiar, so matching artwork and an “official mirror” label do not establish ownership. Even a genuine mirror can offer prohibited services to Australians.

Does being absent from ACMA’s blocked list mean a casino is safe?

No. Absence from the list does not establish that a website has been investigated, approved or verified. A new domain may not yet have been assessed. Overseas licensing, Australian-dollar payments and familiar payment logos also do not establish Australian authorisation.

What should I do if I entered details on a suspected casino clone?

Prioritise security. From a trusted device, change exposed and reused passwords, secure your email and enable suitable multi-factor authentication. Contact your financial provider promptly if payment details were shared. Preserve messages and transaction records, report the incident through official channels and never pay an advance fee to “recover” a balance.

Sources

• ACMA: Website blocking, section 313 authority and complaints about blocks.
• Australian Government: Section 313 guidance and targeted domain or website-address disruption.
• Australian Government: The Interactive Gambling Act targets providers rather than customers.
• ABC News: ACMA’s response to alternative and mirror gambling websites.
• ACMA: June 2026 action identifying websites imitating licensed wagering brands.
• ACMA: Withheld winnings, disappearing balances and recovery limitations.
• Australian Cyber Security Centre: Phishing, impersonation, warning signs and account-protection steps.
• ACMA: The distinction between customer access and promoting or facilitating illegal gambling services.

Last Updated on October 22, 2026 by Pokie-Player