Domain, host and brand: the technical layer

Beneath the brand sits a technical layer that most players never look at: a domain name, the name servers it points to, the infrastructure serving the pages, and the certificates that authenticate them. This layer changes far more often than the corporate layer above it, and unlike ownership records it can be observed directly from outside.

The components

The domain name. A registered string leased from a registrar for a fixed term. Registration data — creation date, registrar, name servers, sometimes the registrant — is published through registry lookup services, although the registrant is redacted by default in many registries for privacy reasons.

The name servers. These translate the domain into an address. Changing them is the fastest way to move a site to different infrastructure, and it leaves a dated trace.

The hosting or delivery layer. The infrastructure actually serving pages. Content delivery networks sit in front of most commercial sites, which means the visible address usually identifies the delivery network rather than the origin.

The certificate. The TLS certificate names the domains it covers. Certificates are logged publicly when issued, so certificate transparency records provide a dated, independently held list of hostnames associated with an operation.

The brand. The trading name presented to the player, which may or may not correspond to the domain, and may be served from many domains at once.

Mirrors and redirects

A mirror is a second hostname serving the same operation. Mirrors exist for ordinary reasons — regional traffic management, load distribution, staging — and for less ordinary ones: continuing to reach players in markets where the primary domain has been blocked, or maintaining access after an enforcement listing.

A redirect sends a visitor from one hostname to another. Chains of redirects are common in affiliate marketing, discussed in Affiliates: the marketing layer players mistake for reviews, and are also used to consolidate several acquired brands onto a single operation.

Neither is inherently improper. What matters evidentially is that a mirror or redirect can change the operator you are dealing with without changing anything you can see. Two hostnames that render identically may resolve to different infrastructure, be served by different entities and carry different terms.

Why a domain changing hands matters mid-dispute

Domains are assets. They are bought, sold, transferred between group companies, seized in commercial disputes, and allowed to lapse. Any of these can happen while a player's complaint is open, with consequences that are entirely practical:

1. The counterparty may change. A site under new control is not necessarily operated by the company you contracted with. Your claim lies against the original operator, which may no longer be reachable through that address.
2. The record disappears. Terms and conditions, promotional pages and support transcripts hosted on the domain vanish on transfer. If you did not capture them, they are gone — the reason The evidence you need before you complain insists on capture before escalation.
3. The licence statement changes. Footer licensing text is page content. It is edited without notice and without history.
4. Support routes lapse. Mailboxes on the old domain stop being monitored, and correspondence sent to them fails silently.
5. Continuity is asserted without being true. A successor operation may present itself as the same business — same brand, same look, same lobby — while being a different legal person that never accepted your deposit.

What technical records can and cannot show

Can show, with dates: when a domain was first registered; when name servers changed; when certificates were issued and for which hostnames; when a hostname began redirecting; when public archives captured a page.

Cannot show: who owns the operating company; whether the site is licensed; whether two hostnames on shared infrastructure are operated by the same entity. Shared hosting is extremely common and proves nothing on its own — thousands of unrelated sites sit behind the same delivery networks.

Infrastructure evidence is good at establishing when something changed and poor at establishing who changed it. Treating a shared address as proof of common ownership is the most frequent error in open-source research of this kind.

How the platform treats this layer

GambleLABS records domains as records in their own right, with a status, a first-seen date and a last-checked date, and never infers authorisation from technical data. A domain is shown as unauthorised only where a named authority has published it on an official list; the reasoning is set out in the methodology, and the authorities themselves are listed by country under jurisdictions.

For the corporate layer above the domain, see Who actually owns the site you are betting on.