Hyderabad: Betting apps named in investigation records and banned in India by the Ministry of Electronics and Information Technology (MeitY) are not vanishing. Instead, they resurface almost immediately under new domain names, retaining the same brands, user interfaces and back-end systems.An analysis by TOI of betting websites found that platforms such as Hublibook, VLbook, Yolo247, JeetWin, Fairplay, Parimatch, 1xBet and Betpro do not operate through a single website. They run networks of mirror and clone sites, allowing users to continue betting even after a specific URL or IP address is blocked or cited in an FIR or prosecution complaint.
For investigators, each domain that appears in a charge sheet is often just one face of a larger, constantly shifting structure. These apps offer betting on sports events, including cricket, football and horse racing, along with card games and online casino products.How mirror sites keep the betting engine aliveA mirror site is a duplicate website hosted under a different domain but offering the same services. Built specifically to evade bans, these clones carry identical layouts, logos, odds tables and login systems—only the web address changes. Once a brand is named in an FIR or added to a block list, traffic is quietly diverted to fresh URLs that regulators have yet to identify.These platforms also promote online casino games, enabling users to play real-money titles such as roulette and blackjack.Cyber forensic expert Patibandla Prasad told TOI that betting companies register multiple domains well in advance. “When one is blocked, traffic is immediately redirected to an alternative domain to ensure uninterrupted access for users. Technically, the business never goes offline; only one door is closed at a time,” he said, adding that apps frequently change IP addresses to evade detection and blocking.Investigators found that around 680 betting companies are registered in Curacao, with at least 50 operating in India. In this offshore-heavy ecosystem, cycling through large batches of domains is not an exception but a core strategy.1xBet and its shape-shifting surrogatesThe Enforcement Directorate’s prosecution complaint places 1xBet at the centre of this model. It describes the platform as “an illegal but popular online betting service” offering sports betting, live betting and gambling products, including casino games, 1xGAMES, TV games, bingo and IPL betting. It also operates mobile apps compatible with Android and iOS.According to the complaint, 1xBet did not halt operations after being banned. Instead, it continued by launching mirror domains and surrogate brands such as ‘1xBat’, ‘1xBat Sporting Lines’ and ‘1xBat Games’.Online researchers tracking regulatory blocklists note that 1xBet-related sites appear most frequently on international blacklists, with nearly 1,800 website addresses across multiple name variants. The scale highlights how mirror sites and brand spin-offs blur the line between a single platform and an entire ecosystem.A TOI investigation also found that Hublibook, VLbook, Yolo247, JeetWin, Fairplay, Parimatch and Betpro often surface together, indicating links to offshore betting and gambling operations.Hublibook and its 365 twinHublibook illustrates how direct mirroring can be. While the core site, hublibook.com, remains active, a parallel site—hublibook365.com—operates with similar branding and features.For users, the transition is almost seamless. A blocked link shared in messaging groups is quickly replaced with a new address loading an identical dashboard. For law enforcement, however, each fresh domain requires a new round of notices, blocking requests and legal references.As a result, Hublibook appears in official records not as a single website but as part of a wider, continuously mutating network.VLbook’s changing facesVLbook demonstrates how brands splinter once flagged. After vlbook.co was reported, it reappeared as vlbook.club and vlbook.org.in.Investigators list a broader pattern: “VLbook, vlbook.*, vvbook.co, dhanibook365.com, telugu365.in, yes365, etc.” Telangana CID FIRs name VLbook among banned betting apps.The shifting extensions—.co, .club, .org.in—and offshoots retaining familiar terms like “book” or “365” help reassure users while staying just beyond immediate block lists. Other betting apps promoted on VLbook-linked sites include Mylaser247, Reddybook, Cricbet99, Fairplay Pro and Allpanelexch.Yolo247 and the affiliate webMapping of Yolo247 shows a layered structure. While yolo247.com remains active, affiliate domains such as yolo247.club and yolo247.site are used by Indian ID sellers.These smaller sites often carry the same logos, colour schemes and promotional content but function primarily as funnels—onboarding users, assigning betting IDs and redirecting them to the main platform or its latest mirror.Parimatch, Mostbet and the Curacao connectionParimatch follows a similar pattern. While parimatch.com serves as the global face, investigators list multiple mirrors, including parimatchwin.in, parimatchwin104.com, parimatchwin.com, parimatch.md and ruparimatch.com.Mostbet’s operation is even more expansive. Investigators estimate that the platform runs around 40 mirror sites, indicating a pre-planned reserve of backup domains ready to absorb traffic whenever one address is blocked.Geoblocks, rotating servers and the VPN loopholeOn paper, bans appear straightforward: once flagged, access is blocked within specific regions. However, investigators note that despite bans—earlier limited to Telangana and now extended nationwide—many betting websites remain accessible due to IP masking.Servers rotate dynamically, spreading traffic across constantly changing IP addresses, complicating enforcement tied to static block lists.Users further bypass restrictions through VPNs, which create encrypted tunnels between the user and a remote server. This prevents ISPs from filtering traffic and makes users appear to be accessing the sites from outside India or from jurisdictions where no ban exists.The result is a system where, despite nationwide bans, the same betting brands remain just a few clicks away for users willing to follow new links and route their traffic through VPNs.
