Description[]
Casino sites are difficult to categorize: A spamvertised brand may be on a single IP or on a fast flux botnet; it may be spammed as short-lived "throwaway" domains that redirect to the target site, or the throwaway domain may load the target domain in an iframe. Spam may arrive in consistent bunches that would suggest the same mailer is responsible for all, yet promote sites with different brands and different behaviors. There are probably several competing casino operations whose affiliates do not deal exclusively with a single sponsoring casino.
All spam casino sites require the player to be gullible enough to download software onto his/her own computer to play the games. Such programs are identified as adware or malware by various antivirus programs, though it is difficult to tell how malicious they may be nor to know if actually playing the games will download additional executable programs onto the computer. Some sites will attempt to download the software automatically by reloading themselves. Others require a click, but will download no matter what the user clicks, even the "about us" links. Others won't download at all unless the user enables javascript for the entire site, a risky move. Site visitors who have java enabled by default or who are using browsers like Internet Explorer that permit ActiveX controls may not witness this behavior -- because the software is being automatically downloaded and installed without permission from the user.
Many gambling casinos run on an illegally hijacked fast-flux set of botnet machines. The casino botnet being used in early 2008 was primarily located in the US, Romania, and Argentina. There were seats for 24 round robin addresses at a time with a refresh every 5 minutes, though fewer than 24 IP addresses were actually filled.
Legitimate sites which are barely within the law, like offshore casinos, often will have multiple servers due to the risk of Distributed Denial of Service attacks (DDoS). However, it was unlikely these sites were being hosted legitimately, since some of the host ISPs were cable/DSL providers in the U.S., where online gambling is illegal.
Any gambling casino that requires you to provide your identity and credit card information is suspect. It is not uncommon to find that identities and the corresponding credit card information will later be offered for sale on the "carder" black market. Victims will find their credit card being abused perhaps some months after they expose it to the criminals who run these bogus gambling casinos.
A sure sign that a gambling casino is illegal is when it is spammed using the redirection method. The link in the spam does not go directly to the site, but it first goes to an intermediate site. Another common sign is when the link to the site resides on a free hosting service, such as LiveJournal.com.
Example of an incompletely-filled 24-seat botnet: Casino La Scala, April 2008
Name: FIRSTPRIMEGAME.NET Addresses: 194.213.6.245 79.118.207.6 195.189.153.155 79.118.207.6 79.118.207.6 79.118.207.6 84.232.162.13 76.105.29.90 79.118.207.6 79.114.155.59 5.204.84.20 89.35.172.188 79.114.155.59 79.118.207.6 79.118.207.6 79.118.207.6 79.118.207.6 195.189.153.155 78.139.149.132 89.35.172.188 86.105.132.74 79.119.140.4 194.213.6.245 194.213.6.245
Sponsoring Registrars[]
NIC.AT[]
In 2012, after responsible action from other abused registrars, the focus for gambling casino domain registrations moved to Austria. The registrants are inevitably fake, and may be stolen identities. The registrant contact addresses show a distinct pattern, spread over 5 service providers: cutemail.org fxmail.net mail13.com mailae.com and mailti.com
Sample of registrant email addresses
zt@mailti.com maria@mailae.com rosa@fxmail.net loft@cutemail.org nk@mailae.com queen@mailae.com gl@mail13.com gates@mailti.com gust@mail13.com blues@mailae.com gomez@cutemail.org bliss@fxmail.net otis@mailti.com cried@mailae.com dana@mailae.com ys@mailti.com ufo@mailae.com mf@mail13.com foamy@mailae.com inset@mailti.com vz@mailae.com nay@cutemail.org plugs@fxmail.net turk@fxmail.net
Sample sites:
bingoclubvip.at bingostarclubvip.at bonusgameclubvip.at clubviplifegame.at clubvipluxcash.at extratopclubvip.at fortunahotgame.at fortunaluxuryclub.at fortunamagic.at goldenrubyclub.at goldwebclubvip.at kinghotgaming.at kingpalacegame.at kingpalacegames.at kingsgamingday.at kingspalacecard.at kpmagicclub.at kpmegacash.at landkingnet.at landkingspins.at luxcashclubvip.at luxurygameclubvip.at magicplayclubvip.at megaclubruby.at mywebclubvip.at premierbestmoney.at premierbonusweb.at premiergameweb.at premiernetplay.at premierwinwest.at premiumclubvip.at rubyhotmagic.at rubyluxurygame.at rubymagiclife.at rubysilvergame.at rubyultrabonus.at silvertopclubvip.at supernetclubvip.at
1API GMBH[]
In October 2011, the registrar called 1API GmbH came under attack by these illegal miscreants. The hosting IP address was 141.136.17.130 provided by ABIL ELECTRIC SRL in Bucharest, Romania and then shifted to 86.49.61.208 the Czech Republic.
450casinogames.eu besteugames.eu besteugaming.eu besteuslots.eu bestonlineslots.eu eugamingspot.eu euluckyslots.eu eumymmysriches.eu euonlineslots.eu eurobestgaming.eu eurogaminga.eu eurogamingb.eu eurogamingc.eu eurogamingd.eu eurogaminge.eu eurogamingf.eu eurogamings.eu eurrclub.eu eurubyrewards.eu euspgaming.eu extrabonuscasino.eu gamingeu.eu gamingthebest.eu getrichtoday.eu hoteugaming.eu kingspbetting.eu kingspgames.eu kingspgaming.eu luckyspslots.eu mummysrichez.eu rebyrewcasino.eu rewardsslots.eu richmummyslots.eu rrbetting.eu rrcasinoclub.eu ruby-rewards.eu rubyrew.eu rubyreward.eu rubyrewardsclub.eu rubyrewslots.eu spbestbets.eu spbestgaming.eu spbets.eu spbettings.eu spcasinoclub.eu spclubgaming.eu spextracash.eu spgamez.eu spgaming.eu spgoldgaming.eu spgoodcasino.eu sphotbetting.eu sphotgames.eu sphotgaming.eu spluckyclub.eu spslots.eu spsupergames.eu supereugaming.eu ulpraspin.eu ultimatecash.eu ultraspgaming.eu
Joker.com[]
In September/October 2011, the registrar called CSL COMPUTER SERVICE LANGENBACH GMBH doing business as JOKER.COM was the largest sponsor of these illegal gambling casino domains. A list of some of these is shown below. The hosting IP address was 90.182.175.236 provided by Telefonica o2 Czech Republic, a.s. and then switched to 141.136.17.132 in Romania.
bestccclub.com bestccgame.com bestcclux.com besteurogaming.com bestfortunaonline.com bestkpgame.com bestkptop.com bestmummycasino.com bestmummyvip.com bestmummyweb.com bestpalacetop.com bestricheslux.com bestrubyluxury.com bestskpgame.com bigkinggambling.com bigkingnet.com bigkpland.com bigkpvip.com bigkpweb.com bigmummyclub.com bigmummynet.com bigmummyplay.com bigmummyprivat.com bigpalacegold.com bigpalacevip.com bigrichesclub.com bigrichesgold.com bigricheshot.com bigrichesland.com bigrichesnet.com bigrichesvip.com bigspalacegame.com bigspalaceplay.com bigspinprivat.com bigvipkingspin.com bingocclife.com bingoccline.com bingofortunaline.com bingokingcasino.com bingokpline.com bingomummycasino.com bingomummylife.com bingorichesline.com bonusfortunabest.com bonuskpbest.com bonusrubybest.com cashccbest.com casinoonlinerr.com ccbiggame.com ccbiggames.com ccbigplay.com ccbigplays.com ccbigplayz.com ccbigsplay.com ccbonusbest.com ccgrandcasino.com ccluxcyber.com ccluxstars.com ccmoneygame.com ccmoneyplay.com ccmoneyprivat.com clubkpgambling.com clubkpgrand.com clublandcc.com cybercclux.com cybermummyland.com cybermummyvip.com cybermummyweb.com cyberrichesland.com cyberricheslux.com elitecclux.com entergoodgaming.com eugamepalace.com eugamerpalace.com eugamespalace.com eugamingclub.com eugamingclubs.com eugamingpalace.com euhotbetting.com euhotgaming.com euluckygaming.com eupalacegaming.com eurogamerpalace.com eurogamespalace.com eurogamingcash.com eurogamingclubs.com eurogoldenpalace.com eurohotgaming.com europalacebets.com euxgaming.com fortunagamevip.com fortunamoneyvip.com fortunaplayvip.com gamblingcashkp.com gamblingccgold.com gamblingccland.com gamblingccnet.com gamblingccweb.com gamblingkingspin.com gamblingkpvip.com gamblingnetking.com gamblingrubyvip.com gamblingvipking.com gamblingwebking.com gamefortunaelite.com gamekinglegend.com gamekplucky.com gamemummyextra.com gamericheslegend.com gamerubyextra.com gamerubyholidays.com goldenpalacebets.com grandbonuscc.com grandccgame.com grandclubruby.com grandclubspin.com grandfortunagame.com grandkingspin.com grandkpcasino.com grandkpgame.com grandmagicruby.com grandmummyland.com grandnetking.com grandpalacegame.com grandrichesland.com grandrubyclub.com grandrubygame.com grandwebking.com holidayccgame.com hotcazinoonline.com hoteurobets.com hoteurogaming.com hrandlandpalace.com kingbestlot.com kinggamblinghot.com kinggamehot.com kinggrandcasino.com kinggrandlot.com kingmegabig.com kingmegaplay.com kingplayhot.com kingprivatgambling.com kingprivatgames.com kingprivatplays.com kingsbestbonus.com kingsbonusbest.com kingsgrandbonus.com kingsgrandcasino.com kingspinbiggold.com kingspinbighot.com kingspincyber.com kingspinlotbest.com kingspinplaygood.com kingspintopworld.com kingspinvipbest.com kingspinvivagood.com kingworldcash.com kingworldcasino.com kingworldline.com kpbiggame.com kpbiggames.com kpbigline.com kpbigplays.com kpbigsplay.com kpbigsplays.com kpbigweb.com kpgamesweb.com kpnextgrand.com kpnextland.com kpplayweb.com lanammagicruby.com landbonuscc.com landccnet.com landccweb.com landclubruby.com landclubspin.com landfortinavirtual.com landfortunaonline.com landgamblingking.com landkinggambling.com landkingnet.com landkingspin.com landkingspins.com landkpcyber.com landkpvip.com landkpweb.com landmummyclub.com landmummynet.com landmummyvip.com landpalacebig.com landpalacegold.com landrichesclub.com landrichesgold.com landrichesvip.com landrubyclub.com landrubyvip.com landrubyvirtual.com landskingnet.com landskingspins.com landsmummyclub.com landsmummynet.com landsrichesvip.com landsvipkingspin.com landultrariches.com landvipking.com landvipkingspin.com lifegrandcc.com lifelandcc.com liferubybingo.com linekingbingo.com linekpbingo.com lineskinggame.com lotpalacebest.com lotspalacebingo.com luckycclux.com luckyeugaming.com luckyricheslux.com luckysrichesgame.com megapalacecyber.com megapalaceworld.com multikpgame.com multimummygame.com multirichesgame.com mummybestcazino.com mummybignet.com mummycashbingo.com mummygamesnet.com mummygrandcazino.com mummygrandclub.com mummygrandgold.com mummylandclub.com mummylandgold.com mummylineworld.com mummylotbingo.com mummymoneygame.com mummymoneyplay.com mummyplaynet.com mykingspin.com netfortinavirtual.com netfortinaworld.com netgamblingking.com netpalacebig.com netrubyvirtual.com netrubyworld.com nicekinggambling.com nicerubyvip.com nicevipking.com palacecashvip.com palacegamingeu.com palacegamingeuro.com palacelandgrand.com palacelandmagic.com palacemoneygame.com palacemoneyplay.com palacemoneyplays.com palacemoneyplayz.com palacemoneyvip.com playccgold.com playccnet.com playccweb.com playfortinavirtual.com playfortunaonline.com playgamblingking.com playkinggambling.com playkingnet.com playkingspin.com playkpvip.com playkpweb.com playmummynet.com playrichesclub.com playrichesgold.com playrichesnet.com playrubynet.com playrubyvip.com playrubyvirtual.com playskpvip.com playspalacegold.com playsrubyvip.com playvipking.com playvipkingspin.com richebestlot.com richesbiggame.com richesbiggames.com richesbigplay.com richescashworld.com richesgamesmoney.com richesgrandlot.com richesplaymoney.com richesprivatmoney.com rrcasinoonline.com rubygamegood.com rubygamemoney.com rubyplaygood.com rubyplaymoney.com rubyprivatgood.com rubyprivatmoney.com rubyrewards7.com rubyrewardscasino.com rubyvivastops.com shikccgame.com slotseurogames.com slotseurogaming.com spinbestcasino.com spinbestgame.com spinbingolife.com spincybercasino.com spincybergrand.com spincyberland.com spingameelites.com spingameholidays.com spingrandcasino.com spinlotbest.com spinluckycasino.com spinluckygame.com spinsking.com spinsonline.com spintopelite.com spintopworld.com starskingcyber.com supereurogaming.com superkinggame.com superkingplay.com superkingprivat.com topeugaming.com topeurogaming.com topkinggrand.com topkingland.com topmummyworld.com toprubybest.com toprubyworld.com ultraccworld.com ultralandpalace.com ultramummyextra.com ultramummyworld.com ultrarubybest.com ultrarubycyber.com ultrarubyextra.com ultrarubyland.com ultrarubynice.com ultrarubyplay.com ultrarubyvirtual.com ultrarubyworld.com ultrarubyworlds.com vegaskpgame.com vipcclegend.com vipccworld.com vipfortunaworld.com vipkpcyber.com vipkpextra.com vipkpgame.com vipkpworld.com vipkpworlds.com vippalacebig.com vippalaceland.com viprubyworld.com virtualfortunaonline.com vivaccworld.com vivafortunacyber.com vivafortunaelite.com vivafortunastars.com vivafortunaworld.com vivakingbest.com vivakingcyber.com vivakinglegend.com vivakingworld.com vivakpworld.com vivamummyworld.com vivapalaceworld.com vivaricheslegend.com vivarichesworld.com vivarubycyber.com vivarubyland.com vivarubynice.com vivarubyplay.com vivarubyvirtual.com vivarubyworld.com webkpbest.com webkpcyber.com webkpelite.com webkplucky.com webkpworld.com westkpgame.com westrichesgame.com worldcclux.com worldmummyweb.com worldpalacetop.com
Trunkoz[]
In September 2011, the Indian registrar called TRUNKOZ TECHNOLOGIES PVT LTD. doing business as OWNREGISTRAR.COM was heavily into sponsoring these illegal gambling sites. A list of reported web sites for which they have taken registration fees is shown below. The hosting IP address was 95.64.51.5 located in Romania, or 90.182.175.234 located in the Czech Republic.
777richesgame.com 888fortunagame.com 888kingspin.com 888palaceweb.com 888richesvip.com bestkingsbets.com bestmummygame.com bestplacebets.com bestrubybet.com bestrubybets.com bestspincasino.com bestspincazino.com betmummy.com betsgoldcash.com betsmummy.com betspalacecasino.com betssuperbets.com bettingpalacex.com biggameruby.com bigplaycc.com bonuskingvip.com bonusrichesgame.com cashfortunagame.com cashpalaceonline.com cc777net.com cc777play.com cc888club.com cc888game.com cc888online.com cc888web.com ccbigstars.com ccextracash.com ccgamecash.com ccgoldenclub.com ccgoldenplays.com ccgoldenstars.com ccgoldmagic.com cchot777.com cchotcasino.com cchotgame.com cchotlife.com cchotplay.com ccluxlife.com ccsilvergame.com ccskylife.com ccstargame.com ccstarline.com ccstylebet.com ccstylebets.com ccsupercash.com ccultranet.com ccultravip.com ccultraweb.com ccvipcash.com ccvipcasino.com ccvipnet.com ccvivagame.com ccvivaplay.com ccwebgame.com ccweblife.com ccwebnet.com ccwingame.com clubccnet.com clubccplay.com clubkinggame.com clubkpgold.com clubluxurycc.com clubrichesvip.com elitepalaceplay.com espielenonline.com eurogamingclub.com eurogamingpalace.com extrabestbets.com extracashslots.com extrarichesplay.com extraspinonline.com extravipbets.com fortonavipslots.com fortuna777club.com fortuna888vip.com fortunabigstar.com fortunaff.com fortunagamez.com fortunagoldenplay.com fortunagoldenstars.com fortunahotgame.com fortunajj.com fortunaluxgame.com fortunaluxuryclub.com fortunamagic.com fortunaonline777.com fortunaroyalnet.com fortunavupbets.com fortunawebcasino.com fortunawebplay.com fortunazz.com funnygamecc.com gamenetspin.com gameplayspin.com gamerubymagic.com gameskingnet.com gamesrubyweb.com gamingruby.com goldbetsway.com goldccnet.com goldencashspin.com goldenkingsbets.com goldenluxking.com goldenrichesnet.com goldenrubyclub.com goldenwebcc.com goldrichescasino.com goldrichesgame.com goldspingames.com goldspingaming.com golgkpvip.com grandtkingspalace.com greatccbet.com greatccbets.com greatkingspalace.com hotkingsplay.com jackpot-treasures.com jtgamingdot.com jtpokies.com jtsunnycash.com king777casino.com king777game.com king777net.com king777play.com king888hot.com kingbigstar.com kingbonuscasino.com kingcardgaming.com kingcartcasino.com kingcasino777.com kingcasinoline.com kinggame888.com kinggameweb.com kinggspincasino.com kinggspinnclub.com kinghotlife.com kinghotmagic.com kinglineclub.com kingluxurygame.com kingmagiclife.com kingmega888.com kingmegabonus.com kingmegacash.com kingmegalife.com kingmegaonline.com kingmegaweb.com kingsbetsonline.com kingsdcasino.com kingshotgaming.com kingsilverweb.com kingslotgaming.com kingsnetgame.com kingsopengame.com kingspalace888.com kingspalacegg.com kingspalacelux.com kingspalacemm.com kingspalaceplay.com kingspalacett.com kingspalacevip.com kingspalaceww.com kingspin7.com kingspin777hot.com kingspin888online.com kingspinboot.com kingspingoldennet.com kingspingoldenplay.com kingspingood.com kingspinlife.com kingspinluxgame.com kingspinmagic777.com kingspinmagicgold.com kingspinmaster.com kingspinmegahot.com kingspinncasino.com kingspinnclub.com kingspinopenstars.com kingspinriches.com kingspinstars.com kingspinvipcash.com kingspinvipcasino.com kingspinviva888.com kingsspellen.com kingstarsgame.com kingstarsline.com kingultraclub.com kingvipmagic.com kingweb888.com kinsgpalacelife.com kp777game.com kp777web.com kp888hotline.com kp888net.com kpbigstars.com kpgamecash.com kpgamemagic.com kpgoldencash.com kpgoldenplays.com kpgoldenstars.com kphotnet.com kphotweb.com kplifenet.com kpluxurynet.com kpmagiclife.com kpmagicvip.com kpmagicweb.com kpmegaweb.com kpnetcasino.com kpnetonline.com kpnextclub.com kpprivatclub.com kpprivatgame.com kpprivatweb.com kpsilvermagic.com kpstarsclub.com kpultracash.com kpultracasino.com kpultragold.com kpultramagic.com kpvipbet.com kpvipbetting.com kpvipclub.com kpvipslots.com kpvivagame.com kpvivamagic.com kpvivaplays.com kpvivastars.com ksbettingvip.com ksvipbets.com ksvipslots.com lifeclubcc.com lifekingspin.com lifemummycasino.com linekingspin.com loadrubygame.com luckycashclub.com luckykingspin.com luckyrichcasino.com luckyrichclub.com luckyspincash.com luckyspinclub.com luxclubcc.com luxkingspalace.com luxkingspin.com luxurykingweb.com luxuryrubyclub.com magickingspin.com magickingvip.com megaccgame.com megaclubruby.com megafortunalife.com megakinglux.com megakingspin.com megalifemummy.com megamummygame.com meganetcc.com megapalacecash.com megapalacegame.com megarichesline.com megarubygame.com mrichcasino.com mrichgambling.com mrichgaming.com mummy777casino.com mummy777net.com mummy777play.com mummy888casino.com mummy888game.com mummy888net.com mummybigstars.com mummycashcasino.com mummygamevip.com mummygameweb.com mummygoldbets.com mummygoldenbets.com mummygoldenclub.com mummygoldengame.com mummygoldenpalace.com mummyhotlife.com mummyhotline.com mummylifenet.com mummylinecasino.com mummylinenet.com mummyluxgame.com mummymagic.com mummymagicweb.com mummynextclub.com mummyonline777.com mummyplayweb.com mummyprivatnet.com mummysbets.com mummysilvernet.com mummysilverplay.com mummysrichesbet.com mummysrichescasino.com mummysrichesplay.com mummysrichplay.com mummystarline.com mummystarsgold.com mummystarsplay.com mummyultranet.com mummyultraweb.com mybonuscc.com mymummyriches.com myultrariches.com netccgold.com netccvip.com netfortinagold.com netking777.com netkingspinclub.com netkingspinvip.com netkpweb.com netmummugame.com netpalacegold.com netrichesclub.com netrubyclub.com netrubygold.com netrubyvip.com netvipking.com newkpgame.com newpalaceclub.com newpalacegame.com newrubygame.com nextkingspin.com nextmagicruby.com onlinekbets.com onlineking777.com onlinekingbonus.com onlinekingplay.com onlinekingspin.com onlinemummyriches.com onlinepalaceweb.com onlinerichesgame.com onlinericheslife.com onlinerichesnet.com onlinerubynet.com onlinerubyprivat.com openclubruby.com opengamespin.com opennetking.com palace777club.com palace777game.com palace777play.com palace888game.com palace888net.com palacebigstar.com palaceclubmagic.com palacefunclub.com palacegaldenclub.com palacegreatbet.com palacegreatebet.com palacehotline.com palaceluxgame.com palacemagiclife.com palacemeganet.com palacenextclub.com palaceplaystars.com palaceredgame.com palaceredplay.com palacesilverstars.com palacestarline.com palaceultranet.com palaceultraweb.com playcasinoking.com playgamecc.com playkingvip.com playluxking.com playmummygame.com playpokerok.com playrubytour.com privatfortunagame.com privatkinggame.com privatkingnet.com privatkinspalace.com privatmummugame.com privatmummynet.com privatrubynet.com redkingplay.com redkingspin.com redmummygame.com rfortcasino.com rfortodds.com riches777online.com riches777web.com riches888game.com riches888net.com richesbigstars.com richescashonline.com richesclublux.com richesclubstars.com richesgamegold.com richesgamenet.com richesgamestars.com richesgoldlife.com richeshot777.com richeshotgame.com richesluxuryclub.com richesmagicgold.com richesmeganile.com richesplayhot.com richesplaymum.com richesprivatweb.com richessilverclub.com richesslots.com richesstarsnet.com richesvipgold.com richrichgames.com royalvipking.com royalvipkingspin.com rrfortuna.com ruby777club.com ruby777game.com ruby888club.com ruby888play.com rubybestbet.com rubybestbetting.com rubybestnet.com rubybetsvip.com rubyfortunastars.com rubygoldbet.com rubygoldenbet.com rubygoldenplays.com rubygoldenstars.com rubyhotgame.com rubyhotmagic.com rubyhotplay.com rubyhotweb.com rubyluxurygame.com rubymagiclife.com rubymagicline.com rubymegacash.com rubymegacasino.com rubyplayclub.com rubyroyalnet.com rubyroyalplay.com rubysilverclub.com rubysilvergame.com rubystargame.com rubystarline.com rubystarplay.com rubystarvip.com rubystarweb.com rubysupergames.com rubyultrabonus.com rubyultragame.com rubyultramagic.com rubyvipbet.com rubyvivaclub.com rubyvivaplay.com rubywingame.com silverkpvip.com silverkpweb.com silvernetking.com silverplayking.com simplikingspin.com skykingnet.com skyplaycc.com slotsfortunavip.com spellenkingspin.com spin888casino.com spineurogame.com spinhotgame.com spinhotprivat.com spinhotroyal.com spinroyalcasino.com starsfortuna.com starspalacenet.com starspalaceplay.com stylerichesgame.com superbetson.com superkingspalace.com superspinonline.com ukingspin.com ultracashkp.com ultracasinoking.com ultraccgame.com ultracclife.com ultraccvip.com ultraclubspin.com ultrakingcasino.com ultrakinglife.com ultrakingnet.com ultramummycasino.com ultramummynet.com ultranetking.com ultrapalacenet.com ultrarichesgame.com ultrarubycash.com ultrarubygame.com ultrarubynet.com ultrawebking.com ultrawebpalace.com vipcccasino.com vipccclub.com vipccweb.com vipfortunanet.com vipkingcasino.com vipkinggame.com vipkingnet.com vipkpcash.com vipkpcasino.com vipkpweb.com vipmummyclub.com vipmummynet.com vippalacegold.com viprubygold.com viprubynet.com viprubyroom.com virtualvegasclub.com virtualvegasclubs.com vivaccnet.com vivaccweb.com vivafortunanet.com vivagamecc.com vivakingnet.com vivakingspin.com vivakpgaame.com vivamummygame.com vivapalacenet.com vivarichesclub.com vivarubyclub.com vivarubymagic.com webcconline.com webfortunagame.com webkpgame.com webkpline.com webmummynet.com webpalacegold.com webrichesgold.com webrubyclub.com webrubynet.com winbetshere.com yourclubcc.com
Examples[]
An example of the name servers used to resolve access to these unlawful domains, with IP addresses and ISPs:
| -- Name Server -- | -- IP Address -- | Country | -- Internet Service Provider |
| ns1.buoog.ru | 188.25.183.195 | RO | RDSNET RCS & RDS S.A. - complain to:abuse@rcs-rds.ro |
| ns2.buoog.ru | 90.182.175.235 | CZ | TO2-CZECH-REPUBLIC Telefonica o2 Czech Republic, a.s. - complain to:abuse.cz@o2.com |
| ns3.buoog.ru | 86.121.72.49 | RO | RDSNET RCS & RDS S.A. - (see above) |
| ns4.buoog.ru | 86.121.73.0 | RO | RDSNET RCS & RDS S.A. - (see above) |
Typical site 1[]
Domain Name: STYLECASHKP.COM Registrar: CSL Computer Service LANGENBACH GMBH D/B/A JOKER.COM
STYLECASHKP.COM has address 90.182.175.236
Registrant
Lidia Davide, xo@mail13.com Piazza San Carlo 50, Quarona, 13017, IT +39.03495013210
Name Servers: ns1.buoog.ru ns2.buoog.ru ns3.buoog.ru ns4.buoog.ru
Domain Name: BUOOG.RU Registrar: NAUNET-REG-RIPN
Typical site 2[]
Domain Name: PREMIERSUPERCLUB.NET Registrar: CENTER OF UKRAINIAN INTERNET NAMES (UKRNAMES.COM)
PREMIERSUPERCLUB.NET has address 91.226.97.171 in Russia
Registrant
Svetlana Poltavceva poltavtzeva.svetlana@yandex.ru 141090, Yubilejnyj, Leninskaya, 17, 43 Yubilejnyj, 141090 RUSSIAN FEDERATION +7.84956548754
Name Servers: ns1.jsienraas.ru ns2.jsienraas.ru ns3.jsienraas.ru in Romania
Domain Name: JSIENRAAS.RU Registrar: NAUNET-REG-RIPN in Russia
Typical site 3[]
Domain Name: CASINOVEGASPLUS.COM Registrar: ENOM, INC.
Registrant:
Alex Basovski (goldgame@mail.by) +375.85627345 Fax: +1.11111111111 Marksa str. 19 Pinsk, PI 213121 BY
Name servers: ns1.mycandydns.com ns2.mycandydns.com ns3.mycandydns.com ns4.mycandydns.com ns5.mycandydns.com
Domain Name: MYCANDYDNS.COM Registrar: BEIJING INNOVATIVE LINKAGE TECHNOLOGY LTD. DBA DNS.COM.CN
Typical site 4[]
Domain Name: CASINOPLAYGAME.COM Registrar: REGTIME LTD.
Registrant:
bella kotz Email: bella2007@newmail.ru Organization: Private person Address: prospekt 60-letiya sssr, 18 City: birobidzhan State: birobidzhan ZIP: 679017 Country: RU Phone: +7.4262268811 Fax:
Name servers: ns1.f942b690.com ns2.f942b690.com ns3.f942b690.com ns4.f942b690.com
Domain Name: F942B690.COM Registrar: BEIJING INNOVATIVE LINKAGE TECHNOLOGY LTD. DBA DNS.COM.CN
History[]
The botnet hosting these sites has also been used for bank phishing and money mule scams.
One example is the domain name arfcu.us, February 2008, which was an attempt to run a phishing operation against the Atlantic Regional Federal Credit Union site.
The bank phishing botnet is predominantly located on machines infected in Romania, USA, and Argentina.
The same botnet has been seen being used for fake escrow business scams using domains like bigeurocargo.com in February 2008. This has been exposed and again exposed and yet again.
Sample Spam[]
Subject: Enjoy our MASSIVE $2400 bonus......... Amazing $2400 bonuses..... Amazing Customer Support...... Amazing games..... Play at the world's most prestigious online casino..... Come and get your MASSIVE $2400 BONUS NOW! Fair Gaming, Fast Payouts unrivalled customer support: GUARANTEED!!! Join the superstars and some of the world’s BIGGEST winners........ ENTER HERE http://dokofuko73864.blogspot.com/ TO DOWNLOAD NOW!
April 2008 casino nameservers and representative domains[]
nameserver: ns1.cameltrophier.com 24 seat botnet 7 unique bots "Casino La Scala :: Elegant Gaming" firstprimegame.net loads site in an iframe from gamez-downloadz.com/lascala/en/ executable download = gamez-downloadz.com/lascala/SetupCasino.exe ":: Euro Dice Casino ::" gamingnewsite.net loads site in an iframe from gamez-downloadz.com/eurodice executable download = gamez-downloadz.com/eurodice/SetupCasino.exe "Welcome to the Euro VIP Casino" newfirstplaying.com loads site in an iframe from gamez-downloadz.com/eurovip executable download = gamez-downloadz.com/eurovip/SetupCasino.exe "Welcome to the Royal Casino!" gamblingnewplace.com loads site in an iframe from gamez-downloadz.com/royalvip/ executable download = gamez-downloadz.com/royalvip/SetupCasino.exe "EURO PRIME CASINO" casinoprimevip.net loads site in an iframe from gamez-downloadz.com/europrime/index.html executable download = gamez-downloadz.com/europrime/download/casinoen.exe (depending on language chosen; requires javascript enabled) "***EURO VIP CASINO*** Amazing Games, Big Winnings, Fantastic Promotions! PLAY NOW & WIN!" newvipgambling.net loads site in an iframe from gamez-downloadz.com/eurovip/ executable download = gamez-downloadz.com/eurovip/SetupCasino.exe "Casino Club V.I.P" vipgamingworld.net executable download = vipgamingworld.net/smartdownload.exe no iframe target domain for some of the above sites: GAMEZ-DOWNLOADZ.COM single IP address 217.20.209.180, shared only with a Russian tax software site Host = InformTelecom, Moscow
nameserver: ns1.worlddwins.com and ns1.worldewins.com (Xin Net) sites hosted on IP address 210.14.131.10 with ZBYD Technology Co.,Ltd, Beijing (LACNIC) "Jackpot Casino/Gambling Online Casino" fjdiif.com.cn executable download = fjdiif.com.cn/go.php => InstallCasinoV2.exe "Welcome to the Euro VIP Casino" jksudia.cn executable download = jksudia.cn/SetupCasino.exe "Welcome to the Vegas Casino!" cniijid.cn executable download = meta refresh to cniijid.cn/SetupCasino.exe same nameservers/IP also have domains for "E2 Finance" and "Freedom From Debt Forever!/Freedom4U"
nameservers: ns1.slim25.com and ns1.fort23.com sites hosted on IP address 118.216.29.237 Hanaro Telecom, Korea "world_casino_out"/"World Casino" kingscasinoworld.com executable download = kingscasinoworld.com/SmartDownload.exe "Golden Gate Casino" goldfirstplaying.com executable download = goldfirstplaying.com/SmartDownload.exe
nameserver: ns1.teetns.com sites hosted at 118.216.29.237 (see above) "Welcome to the Royal Casino !" eurocasinoafy.com executable download = eurocasinoafy.com/SetupCasinoR.exe
How to Report this Spam[]
The Complainterator is configured to report this spamming operation. When preparing the report, add a link to this page for evidence.