Bombet Mirror and Alternative Access

Search for any betting brand and you will find "mirror" links promising another way in. Some of them are genuine alternative addresses run by the operator; many are not. For a Kenyan bettor the question is not only whether a page opens, but whether it belongs to a licensed operator at all — and whether the person asking for your login is who they say they are.

What a mirror actually is

A mirror is the same platform on a different web address: the same account, the same balance, the same bet history. You log in with the credentials you already have; nothing is created or copied on your side. Operators keep alternative addresses for practical reasons, such as moving a site to a new domain or keeping it reachable when a network has trouble resolving the main one.

A mirror solves availability, not legality. A licence covers a specific operator, and in Kenya the Gambling Regulatory Authority's list of licensed gaming companies shows the website domain alongside the company and licence numbers. A domain that does not appear there, or does not belong to the licensed company, is not covered by that licence, however similar it looks.

Why lookalike addresses are dangerous

The commonest scam in online betting is not a rigged game; it is a copied login page. A lookalike domain reproduces the design of a betting site so that you type your username and password into it. Some go further and ask for an M-Pesa PIN "to verify your wallet" or a card number "to unlock the mirror". No betting site needs your mobile money PIN — the PIN is entered on your own phone, in the mobile money prompt, never on a web page. A page that asks for it is a scam by definition.

Kenyan law also treats the people behind unlicensed sites seriously. The 2026 regulations make it an offence to host, register a domain for, process payments for or otherwise service an unlicensed gambling platform, with fines of up to KES 1 million or up to six months' imprisonment for an individual. A link shared in a group chat is no proof of anything.

Where a real address comes from

There is one trustworthy source for an operator's address: the operator. Registered customers receive it by e-mail or SMS from the operator, or find it in their account area; the operator's support can confirm it in chat. Search results, messaging channels, comment threads and "working link today" pages are not sources. Before you type anything, compare the address in your browser, letter by letter, with the domain the operator has confirmed and with the domain in the Authority's list.

When the site will not open

Start with the dull explanations, because they are usually right. Reload the page, clear your browser cache, try a different browser, and switch from Wi-Fi to mobile data or the other way round. Check that your data bundle has not run out and that the date and time on your phone are correct — a wrong clock breaks secure connections. A surprising number of "blocked" sites are simply a stale DNS record or a browser extension getting in the way.

If the site is still unreachable, contact the operator's support by e-mail and ask for the current address. Do not open a second account on another domain to get round the problem: one account per person is a standard rule, duplicate accounts are usually closed, and the balance on them can be withheld. Money left in an account you cannot reach is not simply lost either: under the Act, if no transaction is recorded on an account for three months, a licensee must remit the balance to the player (s.77(1)).

Safety rules that are worth the minute

Bookmark the address you received from the operator and use the bookmark, not a search.
Turn on two-step login if the operator offers it; a stolen password alone is then not enough.
Never enter an M-Pesa or card PIN on a web page.
Match the domain to the licence register before you deposit for the first time.
If in doubt, close the tab and ask support from the e-mail address registered on your account.