Mirrors, Lookalikes and How to Tell Them Apart

The word "mirror" covers two completely different things, and treating them as one is how people lose money. One is an operator's own alternative address, published by the operator itself. The other is a copy built by someone else to harvest logins and payments. They look identical in a screenshot and are trivially distinguishable through a register. This page explains the check; it does not explain how to reach anything that has been restricted, and deliberately so.

Why alternative addresses exist at all

Legitimate reasons are mundane: a technical migration, a regional domain, a temporary maintenance address. None of them require a reader to hunt for a link on a forum, because an operator that changes address announces it on the address people already have and through the channels attached to the account.

Alongside that sits the supervisory reality in Bulgaria. The National Revenue Agency, which took over gambling supervision from the abolished State Commission on Gambling, publishes a list of internet pages blocked for access from the country as well as the register of licensed organisers. A domain on the blocked list is there because it falls outside the licensed perimeter, and this site does not describe ways around that measure — a page that helped evade it would be assisting exactly the sites the list exists to fence off.

The check, in one minute

Open the register entry for the organiser and read which domains the permit covers.
Compare the address in the browser bar character by character. Lookalikes rely on a swapped letter, an added hyphen or an unusual top-level ending.
Confirm the connection is encrypted — a padlock proves the transport, not the owner, so it is a necessary check rather than a sufficient one.
Verify that the account and balance are the ones you know. A genuine alternative address shows the same account; a copy shows nothing or asks you to register again.
Treat any address received by message, forum post or search advertisement as unverified until step one has been repeated.

How a phishing copy behaves

A convincing copy reproduces the layout and the logo and fails on function. The login appears to succeed but the balance is empty or absent. A "verification" step demands documents that were never requested before. The cashier asks for card details in a form that does not match the usual provider screen. Payment options appear that the genuine site never offered for Bulgaria — an obvious tell for a reader who knows that the local rails are cards, bank transfer, ePay.bg, EasyPay, Skrill, Neteller, paysafecard and crypto, listed on the payments page.

If credentials were entered somewhere doubtful

Change the password on the genuine domain immediately, and change it anywhere the same password was reused.
Switch on two-factor authentication.
Check the transaction history for operations that were not made, and write to the operator through the route on the support page.
If card details were entered, contact the issuing bank before anything else.
Where money has actually moved, the procedure for a formal complaint is on the complaints page.

Habits that make the question go away

Bookmark the genuine address once it has been checked, and reach the site only from that bookmark. Do not search for the brand and click the first paid result. Do not accept a "new address" from a message, however plausible the sender looks. And keep the register in mind as the authority: it answers whether a permit exists, whether it is active and which domains it covers, which is precisely the set of questions a lookalike cannot survive. Background on the site's own position is in about this reference desk.