ONJN blacklist: 808 domains blocked in Romania

Romania’s National Gambling Office met as a Supervisory Committee on 30 July 2026 and issued two blacklist decisions — no. 517 of 30 July and no. 537 of 31 July, both signed by president Vlad-Cristian Soare on reports from the office’s monitoring directorate. Trade coverage put the total at “around 800”. We downloaded the annexes and counted: 677 domains in Annex 1 to Decision 517 and 131 in Annex 1 to Decision 537 — 808 exactly. Both rest on art. 10(7), art. 15(4)(c) and art. 17(11) of OUG 77/2009 and on ONJN President’s Order 147/23.06.2015. Under Art. 2–4, the authorised providers on ANCOM’s register must restrict access and redirect every listed domain to a single address, 213.177.28.90, within 15 days of communication; the decisions take effect on communication and can be challenged within 30 days, ultimately before the Bucharest Court of Appeal. The live list stood at 2,671 lines when we pulled it on 13 August — 2,646 of them unique.

The number that matters is not 808. Sorting the annexes by brand string, 99% of Decision 517’s 677 domains fall into eight clusters — 228 numbered hitnspin variants, 169 nv…casino, 100 gg…bet, 100 verdecasino, then royalstiger, luckywave, fieryplay and manekispin — with four singletons in the entire annex. Decision 537 is starker: 126 of its 131 domains are icecasino variants. Two decisions, 808 domains, roughly nine operators.

Why it matters

This is what pre-registered domain inventory looks like when a regulator finally photographs it. Ranges numbered to 1hitnspin127 and verdecasino1594 are not registered in response to a block — they are bought in bulk ahead of it, and the block is the event they were bought for. A regulator publishing 808 entries is not reporting 808 businesses interrupted; it is reporting nine businesses changing a DNS record.

Counsel’s note

Ihor Makushinsky · senior counsel

Read the remedy for what it is. Art. 4 orders a redirect, not a removal: the sites stay online, fully functional, everywhere outside Romanian resolvers, and any user on a VPN or encrypted DNS never notices. Add the 15-day implementation window and a 30-day challenge period, and the operator has ample notice to push traffic to the next range. The Romanian rule is a market-access measure, and it works as one — it does not touch the business.

For a licensed brand the more useful reading is diagnostic. The clustering in these annexes is the same pattern that shows up under a clone campaign against a real operator: one template, one host, a numbered sequence, and rotation on trigger. If your monitoring only catches domains one at a time as they surface in search or in player complaints, you are seeing a range at the rate the attacker chooses to reveal it. Enumerate the pattern instead — the numbering that makes these farms cheap to run also makes them enumerable, and the whole range is usually visible in registration and certificate data long before the domains start serving traffic.

One boundary worth stating plainly, because it is the question clients ask: the blacklist is a licensing instrument, not a trademark one. It reaches operators trading in Romania without a Romanian licence. It does not reach a site because it impersonates you, and being listed says nothing about infringement. If a clone is wearing your licensed brand, an ONJN listing is at best a partial, territorial answer — the clone keeps its traffic, its deposits and its search rankings everywhere else. That work runs at the source: the host, the registrar, the platform, and then de-indexation so the successor domain does not inherit what the blocked one earned.

What this means for you

If you hold a Romanian licence, treat the blacklist as a channel to feed, not a remedy to wait for — and monitor whether your own brand strings appear in the annexes, because the register is public and permanent. If you are fighting clones, map the full numbered range before you file anything, then pair the source takedown with de-indexation. Our guide on taking down a casino clone website covers the evidence groundwork, finding the real host behind Cloudflare covers the layer a DNS block never reaches, and our Romanian page sets out how we run this for licensed operators.