Gambling Casinos

## Description

Casino sites are difficult to categorize: A spamvertised brand may be on a single IP or on a fast flux botnet; it may be spammed as short-lived "throwaway" domains that redirect to the target site, or the throwaway domain may load the target domain in an iframe. Spam may arrive in consistent bunches that would suggest the same mailer is responsible for all, yet promote sites with different brands and different behaviors. There are probably several competing casino operations whose affiliates do not deal exclusively with a single sponsoring casino.

All spam casino sites require the player to be gullible enough to download software onto his/her own computer to play the games. Such programs are identified as adware or malware by various antivirus programs, though it is difficult to tell how malicious they may be nor to know if actually playing the games will download additional executable programs onto the computer. Some sites will attempt to download the software automatically by reloading themselves. Others require a click, but will download no matter what the user clicks, even the "about us" links. Others won't download at all unless the user enables javascript for the entire site, a risky move. Site visitors who have java enabled by default or who are using browsers like Internet Explorer that permit ActiveX controls may not witness this behavior -- because the software is being automatically downloaded and installed without permission from the user.

Many gambling casinos run on an illegally hijacked fast-flux set of botnet machines. The casino botnet being used in early 2008 was primarily located in the US, Romania, and Argentina. There were seats for 24 round robin addresses at a time with a refresh every 5 minutes, though fewer than 24 IP addresses were actually filled.

Legitimate sites which are barely within the law, like offshore casinos, often will have multiple servers due to the risk of Distributed Denial of Service attacks (DDoS). However, it was unlikely these sites were being hosted legitimately, since some of the host ISPs were cable/DSL providers in the U.S., where online gambling is illegal.

Any gambling casino that requires you to provide your identity and credit card information is suspect. It is not uncommon to find that identities and the corresponding credit card information will later be offered for sale on the "carder" black market. Victims will find their credit card being abused perhaps some months after they expose it to the criminals who run these bogus gambling casinos.

A sure sign that a gambling casino is illegal is when it is spammed using the redirection method. The link in the spam does not go directly to the site, but it first goes to an intermediate site. Another common sign is when the link to the site resides on a free hosting service, such as LiveJournal.com.

Example of an incompletely-filled 24-seat botnet: Casino La Scala, April 2008

```
Name: FIRSTPRIMEGAME.NET

Addresses:
194.213.6.245
79.118.207.6
195.189.153.155
79.118.207.6
79.118.207.6
79.118.207.6
84.232.162.13
76.105.29.90
79.118.207.6
79.114.155.59
5.204.84.20
89.35.172.188
79.114.155.59
79.118.207.6
79.118.207.6
79.118.207.6
79.118.207.6
195.189.153.155
78.139.149.132
89.35.172.188
86.105.132.74
79.119.140.4
194.213.6.245
194.213.6.245

```

## Sponsoring Registrars

### NIC.AT

In 2012, after responsible action from other abused registrars, the focus for gambling casino domain registrations moved to Austria. The registrants are inevitably fake, and may be stolen identities. The registrant contact addresses show a distinct pattern, spread over 5 service providers: cutemail.org fxmail.net mail13.com mailae.com and mailti.com

Sample of registrant email addresses

zt@mailti.com
maria@mailae.com
rosa@fxmail.net
loft@cutemail.org
nk@mailae.com
queen@mailae.com
gl@mail13.com
gates@mailti.com
gust@mail13.com
blues@mailae.com
gomez@cutemail.org
bliss@fxmail.net
otis@mailti.com
cried@mailae.com
dana@mailae.com
ys@mailti.com
ufo@mailae.com
mf@mail13.com
foamy@mailae.com
inset@mailti.com
vz@mailae.com
nay@cutemail.org
plugs@fxmail.net
turk@fxmail.net

Sample sites:

bingoclubvip.at
bingostarclubvip.at
bonusgameclubvip.at
clubviplifegame.at
clubvipluxcash.at
extratopclubvip.at
fortunahotgame.at
fortunaluxuryclub.at
fortunamagic.at
goldenrubyclub.at
goldwebclubvip.at
kinghotgaming.at
kingpalacegame.at
kingpalacegames.at
kingsgamingday.at
kingspalacecard.at
kpmagicclub.at
kpmegacash.at
landkingnet.at
landkingspins.at
luxcashclubvip.at
luxurygameclubvip.at
magicplayclubvip.at
megaclubruby.at
mywebclubvip.at
premierbestmoney.at
premierbonusweb.at
premiergameweb.at
premiernetplay.at
premierwinwest.at
premiumclubvip.at
rubyhotmagic.at
rubyluxurygame.at
rubymagiclife.at
rubysilvergame.at
rubyultrabonus.at
silvertopclubvip.at
supernetclubvip.at

### 1API GMBH

In October 2011, the registrar called **1API GmbH** came under attack by these illegal miscreants. The hosting IP address was 141.136.17.130 provided by ABIL ELECTRIC SRL in Bucharest, Romania and then shifted to 86.49.61.208 the Czech Republic.

450casinogames.eu
besteugames.eu
besteugaming.eu
besteuslots.eu
bestonlineslots.eu
eugamingspot.eu
euluckyslots.eu
eumymmysriches.eu
euonlineslots.eu
eurobestgaming.eu
eurogaminga.eu
eurogamingb.eu
eurogamingc.eu
eurogamingd.eu
eurogaminge.eu
eurogamingf.eu
eurogamings.eu
eurrclub.eu
eurubyrewards.eu
euspgaming.eu
extrabonuscasino.eu
gamingeu.eu
gamingthebest.eu
getrichtoday.eu
hoteugaming.eu
kingspbetting.eu
kingspgames.eu
kingspgaming.eu
luckyspslots.eu
mummysrichez.eu
rebyrewcasino.eu
rewardsslots.eu
richmummyslots.eu
rrbetting.eu
rrcasinoclub.eu
ruby-rewards.eu
rubyrew.eu
rubyreward.eu
rubyrewardsclub.eu
rubyrewslots.eu
spbestbets.eu
spbestgaming.eu
spbets.eu
spbettings.eu
spcasinoclub.eu
spclubgaming.eu
spextracash.eu
spgamez.eu
spgaming.eu
spgoldgaming.eu
spgoodcasino.eu
sphotbetting.eu
sphotgames.eu
sphotgaming.eu
spluckyclub.eu
spslots.eu
spsupergames.eu
supereugaming.eu
ulpraspin.eu
ultimatecash.eu
ultraspgaming.eu

### Joker.com

In September/October 2011, the registrar called **CSL COMPUTER SERVICE LANGENBACH GMBH** doing business as **JOKER.COM** was the largest sponsor of these illegal gambling casino domains. A list of some of these is shown below. The hosting IP address was 90.182.175.236 provided by Telefonica o2 Czech Republic, a.s. and then switched to 141.136.17.132 in Romania.

bestccclub.com
bestccgame.com
bestcclux.com
besteurogaming.com
bestfortunaonline.com
bestkpgame.com
bestkptop.com
bestmummycasino.com
bestmummyvip.com
bestmummyweb.com
bestpalacetop.com
bestricheslux.com
bestrubyluxury.com
bestskpgame.com
bigkinggambling.com
bigkingnet.com
bigkpland.com
bigkpvip.com
bigkpweb.com
bigmummyclub.com
bigmummynet.com
bigmummyplay.com
bigmummyprivat.com
bigpalacegold.com
bigpalacevip.com
bigrichesclub.com
bigrichesgold.com
bigricheshot.com
bigrichesland.com
bigrichesnet.com
bigrichesvip.com
bigspalacegame.com
bigspalaceplay.com
bigspinprivat.com
bigvipkingspin.com
bingocclife.com
bingoccline.com
bingofortunaline.com
bingokingcasino.com
bingokpline.com
bingomummycasino.com
bingomummylife.com
bingorichesline.com
bonusfortunabest.com
bonuskpbest.com
bonusrubybest.com
cashccbest.com
casinoonlinerr.com
ccbiggame.com
ccbiggames.com
ccbigplay.com
ccbigplays.com
ccbigplayz.com
ccbigsplay.com
ccbonusbest.com
ccgrandcasino.com
ccluxcyber.com
ccluxstars.com
ccmoneygame.com
ccmoneyplay.com
ccmoneyprivat.com
clubkpgambling.com
clubkpgrand.com
clublandcc.com
cybercclux.com
cybermummyland.com
cybermummyvip.com
cybermummyweb.com
cyberrichesland.com
cyberricheslux.com
elitecclux.com
entergoodgaming.com
eugamepalace.com
eugamerpalace.com
eugamespalace.com
eugamingclub.com
eugamingclubs.com
eugamingpalace.com
euhotbetting.com
euhotgaming.com
euluckygaming.com
eupalacegaming.com
eurogamerpalace.com
eurogamespalace.com
eurogamingcash.com
eurogamingclubs.com
eurogoldenpalace.com
eurohotgaming.com
europalacebets.com
euxgaming.com
fortunagamevip.com
fortunamoneyvip.com
fortunaplayvip.com
gamblingcashkp.com
gamblingccgold.com
gamblingccland.com
gamblingccnet.com
gamblingccweb.com
gamblingkingspin.com
gamblingkpvip.com
gamblingnetking.com
gamblingrubyvip.com
gamblingvipking.com
gamblingwebking.com
gamefortunaelite.com
gamekinglegend.com
gamekplucky.com
gamemummyextra.com
gamericheslegend.com
gamerubyextra.com
gamerubyholidays.com
goldenpalacebets.com
grandbonuscc.com
grandccgame.com
grandclubruby.com
grandclubspin.com
grandfortunagame.com
grandkingspin.com
grandkpcasino.com
grandkpgame.com
grandmagicruby.com
grandmummyland.com
grandnetking.com
grandpalacegame.com
grandrichesland.com
grandrubyclub.com
grandrubygame.com
grandwebking.com
holidayccgame.com
hotcazinoonline.com
hoteurobets.com
hoteurogaming.com
hrandlandpalace.com
kingbestlot.com
kinggamblinghot.com
kinggamehot.com
kinggrandcasino.com
kinggrandlot.com
kingmegabig.com
kingmegaplay.com
kingplayhot.com
kingprivatgambling.com
kingprivatgames.com
kingprivatplays.com
kingsbestbonus.com
kingsbonusbest.com
kingsgrandbonus.com
kingsgrandcasino.com
kingspinbiggold.com
kingspinbighot.com
kingspincyber.com
kingspinlotbest.com
kingspinplaygood.com
kingspintopworld.com
kingspinvipbest.com
kingspinvivagood.com
kingworldcash.com
kingworldcasino.com
kingworldline.com
kpbiggame.com
kpbiggames.com
kpbigline.com
kpbigplays.com
kpbigsplay.com
kpbigsplays.com
kpbigweb.com
kpgamesweb.com
kpnextgrand.com
kpnextland.com
kpplayweb.com
lanammagicruby.com
landbonuscc.com
landccnet.com
landccweb.com
landclubruby.com
landclubspin.com
landfortinavirtual.com
landfortunaonline.com
landgamblingking.com
landkinggambling.com
landkingnet.com
landkingspin.com
landkingspins.com
landkpcyber.com
landkpvip.com
landkpweb.com
landmummyclub.com
landmummynet.com
landmummyvip.com
landpalacebig.com
landpalacegold.com
landrichesclub.com
landrichesgold.com
landrichesvip.com
landrubyclub.com
landrubyvip.com
landrubyvirtual.com
landskingnet.com
landskingspins.com
landsmummyclub.com
landsmummynet.com
landsrichesvip.com
landsvipkingspin.com
landultrariches.com
landvipking.com
landvipkingspin.com
lifegrandcc.com
lifelandcc.com
liferubybingo.com
linekingbingo.com
linekpbingo.com
lineskinggame.com
lotpalacebest.com
lotspalacebingo.com
luckycclux.com
luckyeugaming.com
luckyricheslux.com
luckysrichesgame.com
megapalacecyber.com
megapalaceworld.com
multikpgame.com
multimummygame.com
multirichesgame.com
mummybestcazino.com
mummybignet.com
mummycashbingo.com
mummygamesnet.com
mummygrandcazino.com
mummygrandclub.com
mummygrandgold.com
mummylandclub.com
mummylandgold.com
mummylineworld.com
mummylotbingo.com
mummymoneygame.com
mummymoneyplay.com
mummyplaynet.com
mykingspin.com
netfortinavirtual.com
netfortinaworld.com
netgamblingking.com
netpalacebig.com
netrubyvirtual.com
netrubyworld.com
nicekinggambling.com
nicerubyvip.com
nicevipking.com
palacecashvip.com
palacegamingeu.com
palacegamingeuro.com
palacelandgrand.com
palacelandmagic.com
palacemoneygame.com
palacemoneyplay.com
palacemoneyplays.com
palacemoneyplayz.com
palacemoneyvip.com
playccgold.com
playccnet.com
playccweb.com
playfortinavirtual.com
playfortunaonline.com
playgamblingking.com
playkinggambling.com
playkingnet.com
playkingspin.com
playkpvip.com
playkpweb.com
playmummynet.com
playrichesclub.com
playrichesgold.com
playrichesnet.com
playrubynet.com
playrubyvip.com
playrubyvirtual.com
playskpvip.com
playspalacegold.com
playsrubyvip.com
playvipking.com
playvipkingspin.com
richebestlot.com
richesbiggame.com
richesbiggames.com
richesbigplay.com
richescashworld.com
richesgamesmoney.com
richesgrandlot.com
richesplaymoney.com
richesprivatmoney.com
rrcasinoonline.com
rubygamegood.com
rubygamemoney.com
rubyplaygood.com
rubyplaymoney.com
rubyprivatgood.com
rubyprivatmoney.com
rubyrewards7.com
rubyrewardscasino.com
rubyvivastops.com
shikccgame.com
slotseurogames.com
slotseurogaming.com
spinbestcasino.com
spinbestgame.com
spinbingolife.com
spincybercasino.com
spincybergrand.com
spincyberland.com
spingameelites.com
spingameholidays.com
spingrandcasino.com
spinlotbest.com
spinluckycasino.com
spinluckygame.com
spinsking.com
spinsonline.com
spintopelite.com
spintopworld.com
starskingcyber.com
supereurogaming.com
superkinggame.com
superkingplay.com
superkingprivat.com
topeugaming.com
topeurogaming.com
topkinggrand.com
topkingland.com
topmummyworld.com
toprubybest.com
toprubyworld.com
ultraccworld.com
ultralandpalace.com
ultramummyextra.com
ultramummyworld.com
ultrarubybest.com
ultrarubycyber.com
ultrarubyextra.com
ultrarubyland.com
ultrarubynice.com
ultrarubyplay.com
ultrarubyvirtual.com
ultrarubyworld.com
ultrarubyworlds.com
vegaskpgame.com
vipcclegend.com
vipccworld.com
vipfortunaworld.com
vipkpcyber.com
vipkpextra.com
vipkpgame.com
vipkpworld.com
vipkpworlds.com
vippalacebig.com
vippalaceland.com
viprubyworld.com
virtualfortunaonline.com
vivaccworld.com
vivafortunacyber.com
vivafortunaelite.com
vivafortunastars.com
vivafortunaworld.com
vivakingbest.com
vivakingcyber.com
vivakinglegend.com
vivakingworld.com
vivakpworld.com
vivamummyworld.com
vivapalaceworld.com
vivaricheslegend.com
vivarichesworld.com
vivarubycyber.com
vivarubyland.com
vivarubynice.com
vivarubyplay.com
vivarubyvirtual.com
vivarubyworld.com
webkpbest.com
webkpcyber.com
webkpelite.com
webkplucky.com
webkpworld.com
westkpgame.com
westrichesgame.com
worldcclux.com
worldmummyweb.com
worldpalacetop.com

### Trunkoz

In September 2011, the Indian registrar called **TRUNKOZ TECHNOLOGIES PVT LTD.** doing business as **OWNREGISTRAR.COM** was heavily into sponsoring these illegal gambling sites. A list of reported web sites for which they have taken registration fees is shown below. The hosting IP address was 95.64.51.5 located in Romania, or 90.182.175.234 located in the Czech Republic.

777richesgame.com
888fortunagame.com
888kingspin.com
888palaceweb.com
888richesvip.com
bestkingsbets.com
bestmummygame.com
bestplacebets.com
bestrubybet.com
bestrubybets.com
bestspincasino.com
bestspincazino.com
betmummy.com
betsgoldcash.com
betsmummy.com
betspalacecasino.com
betssuperbets.com
bettingpalacex.com
biggameruby.com
bigplaycc.com
bonuskingvip.com
bonusrichesgame.com
cashfortunagame.com
cashpalaceonline.com
cc777net.com
cc777play.com
cc888club.com
cc888game.com
cc888online.com
cc888web.com
ccbigstars.com
ccextracash.com
ccgamecash.com
ccgoldenclub.com
ccgoldenplays.com
ccgoldenstars.com
ccgoldmagic.com
cchot777.com
cchotcasino.com
cchotgame.com
cchotlife.com
cchotplay.com
ccluxlife.com
ccsilvergame.com
ccskylife.com
ccstargame.com
ccstarline.com
ccstylebet.com
ccstylebets.com
ccsupercash.com
ccultranet.com
ccultravip.com
ccultraweb.com
ccvipcash.com
ccvipcasino.com
ccvipnet.com
ccvivagame.com
ccvivaplay.com
ccwebgame.com
ccweblife.com
ccwebnet.com
ccwingame.com
clubccnet.com
clubccplay.com
clubkinggame.com
clubkpgold.com
clubluxurycc.com
clubrichesvip.com
elitepalaceplay.com
espielenonline.com
eurogamingclub.com
eurogamingpalace.com
extrabestbets.com
extracashslots.com
extrarichesplay.com
extraspinonline.com
extravipbets.com
fortonavipslots.com
fortuna777club.com
fortuna888vip.com
fortunabigstar.com
fortunaff.com
fortunagamez.com
fortunagoldenplay.com
fortunagoldenstars.com
fortunahotgame.com
fortunajj.com
fortunaluxgame.com
fortunaluxuryclub.com
fortunamagic.com
fortunaonline777.com
fortunaroyalnet.com
fortunavupbets.com
fortunawebcasino.com
fortunawebplay.com
fortunazz.com
funnygamecc.com
gamenetspin.com
gameplayspin.com
gamerubymagic.com
gameskingnet.com
gamesrubyweb.com
gamingruby.com
goldbetsway.com
goldccnet.com
goldencashspin.com
goldenkingsbets.com
goldenluxking.com
goldenrichesnet.com
goldenrubyclub.com
goldenwebcc.com
goldrichescasino.com
goldrichesgame.com
goldspingames.com
goldspingaming.com
golgkpvip.com
grandtkingspalace.com
greatccbet.com
greatccbets.com
greatkingspalace.com
hotkingsplay.com
jackpot-treasures.com
jtgamingdot.com
jtpokies.com
jtsunnycash.com
king777casino.com
king777game.com
king777net.com
king777play.com
king888hot.com
kingbigstar.com
kingbonuscasino.com
kingcardgaming.com
kingcartcasino.com
kingcasino777.com
kingcasinoline.com
kinggame888.com
kinggameweb.com
kinggspincasino.com
kinggspinnclub.com
kinghotlife.com
kinghotmagic.com
kinglineclub.com
kingluxurygame.com
kingmagiclife.com
kingmega888.com
kingmegabonus.com
kingmegacash.com
kingmegalife.com
kingmegaonline.com
kingmegaweb.com
kingsbetsonline.com
kingsdcasino.com
kingshotgaming.com
kingsilverweb.com
kingslotgaming.com
kingsnetgame.com
kingsopengame.com
kingspalace888.com
kingspalacegg.com
kingspalacelux.com
kingspalacemm.com
kingspalaceplay.com
kingspalacett.com
kingspalacevip.com
kingspalaceww.com
kingspin7.com
kingspin777hot.com
kingspin888online.com
kingspinboot.com
kingspingoldennet.com
kingspingoldenplay.com
kingspingood.com
kingspinlife.com
kingspinluxgame.com
kingspinmagic777.com
kingspinmagicgold.com
kingspinmaster.com
kingspinmegahot.com
kingspinncasino.com
kingspinnclub.com
kingspinopenstars.com
kingspinriches.com
kingspinstars.com
kingspinvipcash.com
kingspinvipcasino.com
kingspinviva888.com
kingsspellen.com
kingstarsgame.com
kingstarsline.com
kingultraclub.com
kingvipmagic.com
kingweb888.com
kinsgpalacelife.com
kp777game.com
kp777web.com
kp888hotline.com
kp888net.com
kpbigstars.com
kpgamecash.com
kpgamemagic.com
kpgoldencash.com
kpgoldenplays.com
kpgoldenstars.com
kphotnet.com
kphotweb.com
kplifenet.com
kpluxurynet.com
kpmagiclife.com
kpmagicvip.com
kpmagicweb.com
kpmegaweb.com
kpnetcasino.com
kpnetonline.com
kpnextclub.com
kpprivatclub.com
kpprivatgame.com
kpprivatweb.com
kpsilvermagic.com
kpstarsclub.com
kpultracash.com
kpultracasino.com
kpultragold.com
kpultramagic.com
kpvipbet.com
kpvipbetting.com
kpvipclub.com
kpvipslots.com
kpvivagame.com
kpvivamagic.com
kpvivaplays.com
kpvivastars.com
ksbettingvip.com
ksvipbets.com
ksvipslots.com
lifeclubcc.com
lifekingspin.com
lifemummycasino.com
linekingspin.com
loadrubygame.com
luckycashclub.com
luckykingspin.com
luckyrichcasino.com
luckyrichclub.com
luckyspincash.com
luckyspinclub.com
luxclubcc.com
luxkingspalace.com
luxkingspin.com
luxurykingweb.com
luxuryrubyclub.com
magickingspin.com
magickingvip.com
megaccgame.com
megaclubruby.com
megafortunalife.com
megakinglux.com
megakingspin.com
megalifemummy.com
megamummygame.com
meganetcc.com
megapalacecash.com
megapalacegame.com
megarichesline.com
megarubygame.com
mrichcasino.com
mrichgambling.com
mrichgaming.com
mummy777casino.com
mummy777net.com
mummy777play.com
mummy888casino.com
mummy888game.com
mummy888net.com
mummybigstars.com
mummycashcasino.com
mummygamevip.com
mummygameweb.com
mummygoldbets.com
mummygoldenbets.com
mummygoldenclub.com
mummygoldengame.com
mummygoldenpalace.com
mummyhotlife.com
mummyhotline.com
mummylifenet.com
mummylinecasino.com
mummylinenet.com
mummyluxgame.com
mummymagic.com
mummymagicweb.com
mummynextclub.com
mummyonline777.com
mummyplayweb.com
mummyprivatnet.com
mummysbets.com
mummysilvernet.com
mummysilverplay.com
mummysrichesbet.com
mummysrichescasino.com
mummysrichesplay.com
mummysrichplay.com
mummystarline.com
mummystarsgold.com
mummystarsplay.com
mummyultranet.com
mummyultraweb.com
mybonuscc.com
mymummyriches.com
myultrariches.com
netccgold.com
netccvip.com
netfortinagold.com
netking777.com
netkingspinclub.com
netkingspinvip.com
netkpweb.com
netmummugame.com
netpalacegold.com
netrichesclub.com
netrubyclub.com
netrubygold.com
netrubyvip.com
netvipking.com
newkpgame.com
newpalaceclub.com
newpalacegame.com
newrubygame.com
nextkingspin.com
nextmagicruby.com
onlinekbets.com
onlineking777.com
onlinekingbonus.com
onlinekingplay.com
onlinekingspin.com
onlinemummyriches.com
onlinepalaceweb.com
onlinerichesgame.com
onlinericheslife.com
onlinerichesnet.com
onlinerubynet.com
onlinerubyprivat.com
openclubruby.com
opengamespin.com
opennetking.com
palace777club.com
palace777game.com
palace777play.com
palace888game.com
palace888net.com
palacebigstar.com
palaceclubmagic.com
palacefunclub.com
palacegaldenclub.com
palacegreatbet.com
palacegreatebet.com
palacehotline.com
palaceluxgame.com
palacemagiclife.com
palacemeganet.com
palacenextclub.com
palaceplaystars.com
palaceredgame.com
palaceredplay.com
palacesilverstars.com
palacestarline.com
palaceultranet.com
palaceultraweb.com
playcasinoking.com
playgamecc.com
playkingvip.com
playluxking.com
playmummygame.com
playpokerok.com
playrubytour.com
privatfortunagame.com
privatkinggame.com
privatkingnet.com
privatkinspalace.com
privatmummugame.com
privatmummynet.com
privatrubynet.com
redkingplay.com
redkingspin.com
redmummygame.com
rfortcasino.com
rfortodds.com
riches777online.com
riches777web.com
riches888game.com
riches888net.com
richesbigstars.com
richescashonline.com
richesclublux.com
richesclubstars.com
richesgamegold.com
richesgamenet.com
richesgamestars.com
richesgoldlife.com
richeshot777.com
richeshotgame.com
richesluxuryclub.com
richesmagicgold.com
richesmeganile.com
richesplayhot.com
richesplaymum.com
richesprivatweb.com
richessilverclub.com
richesslots.com
richesstarsnet.com
richesvipgold.com
richrichgames.com
royalvipking.com
royalvipkingspin.com
rrfortuna.com
ruby777club.com
ruby777game.com
ruby888club.com
ruby888play.com
rubybestbet.com
rubybestbetting.com
rubybestnet.com
rubybetsvip.com
rubyfortunastars.com
rubygoldbet.com
rubygoldenbet.com
rubygoldenplays.com
rubygoldenstars.com
rubyhotgame.com
rubyhotmagic.com
rubyhotplay.com
rubyhotweb.com
rubyluxurygame.com
rubymagiclife.com
rubymagicline.com
rubymegacash.com
rubymegacasino.com
rubyplayclub.com
rubyroyalnet.com
rubyroyalplay.com
rubysilverclub.com
rubysilvergame.com
rubystargame.com
rubystarline.com
rubystarplay.com
rubystarvip.com
rubystarweb.com
rubysupergames.com
rubyultrabonus.com
rubyultragame.com
rubyultramagic.com
rubyvipbet.com
rubyvivaclub.com
rubyvivaplay.com
rubywingame.com
silverkpvip.com
silverkpweb.com
silvernetking.com
silverplayking.com
simplikingspin.com
skykingnet.com
skyplaycc.com
slotsfortunavip.com
spellenkingspin.com
spin888casino.com
spineurogame.com
spinhotgame.com
spinhotprivat.com
spinhotroyal.com
spinroyalcasino.com
starsfortuna.com
starspalacenet.com
starspalaceplay.com
stylerichesgame.com
superbetson.com
superkingspalace.com
superspinonline.com
ukingspin.com
ultracashkp.com
ultracasinoking.com
ultraccgame.com
ultracclife.com
ultraccvip.com
ultraclubspin.com
ultrakingcasino.com
ultrakinglife.com
ultrakingnet.com
ultramummycasino.com
ultramummynet.com
ultranetking.com
ultrapalacenet.com
ultrarichesgame.com
ultrarubycash.com
ultrarubygame.com
ultrarubynet.com
ultrawebking.com
ultrawebpalace.com
vipcccasino.com
vipccclub.com
vipccweb.com
vipfortunanet.com
vipkingcasino.com
vipkinggame.com
vipkingnet.com
vipkpcash.com
vipkpcasino.com
vipkpweb.com
vipmummyclub.com
vipmummynet.com
vippalacegold.com
viprubygold.com
viprubynet.com
viprubyroom.com
virtualvegasclub.com
virtualvegasclubs.com
vivaccnet.com
vivaccweb.com
vivafortunanet.com
vivagamecc.com
vivakingnet.com
vivakingspin.com
vivakpgaame.com
vivamummygame.com
vivapalacenet.com
vivarichesclub.com
vivarubyclub.com
vivarubymagic.com
webcconline.com
webfortunagame.com
webkpgame.com
webkpline.com
webmummynet.com
webpalacegold.com
webrichesgold.com
webrubyclub.com
webrubynet.com
winbetshere.com
yourclubcc.com

### Examples

An example of the name servers used to resolve access to these unlawful domains, with IP addresses and ISPs:

 ns4.buoog.ru | 86.121.73.0 | RO | RDSNET RCS & RDS S.A. - (see above)

#### Typical site 1

```
Domain Name: STYLECASHKP.COM
Registrar: CSL Computer Service LANGENBACH GMBH D/B/A JOKER.COM

```

```
STYLECASHKP.COM has address 90.182.175.236

```

**Registrant**

```
Lidia Davide,  xo@mail13.com
Piazza San Carlo 50,  Quarona, 13017, IT
+39.03495013210

```

**Name Servers**: ns1.buoog.ru ns2.buoog.ru ns3.buoog.ru ns4.buoog.ru

```
Domain Name: BUOOG.RU
Registrar: NAUNET-REG-RIPN

```

#### Typical site 2

```
Domain Name: PREMIERSUPERCLUB.NET
Registrar: CENTER OF UKRAINIAN INTERNET NAMES (UKRNAMES.COM)

```

```
PREMIERSUPERCLUB.NET has address 91.226.97.171 in Russia

```

**Registrant**

```
Svetlana Poltavceva poltavtzeva.svetlana@yandex.ru
141090, Yubilejnyj, Leninskaya, 17, 43
Yubilejnyj, 141090
RUSSIAN FEDERATION
+7.84956548754

```

**Name Servers**: ns1.jsienraas.ru ns2.jsienraas.ru ns3.jsienraas.ru in Romania

```
Domain Name: JSIENRAAS.RU
Registrar: NAUNET-REG-RIPN in Russia

```

#### Typical site 3

```
Domain Name: CASINOVEGASPLUS.COM
Registrar: ENOM, INC.

```

**Registrant**:

```
 Alex Basovski (goldgame@mail.by)
 +375.85627345
 Fax: +1.11111111111
 Marksa str. 19
 Pinsk, PI 213121
 BY

```

**Name servers**: ns1.mycandydns.com ns2.mycandydns.com ns3.mycandydns.com ns4.mycandydns.com ns5.mycandydns.com

```
Domain Name: MYCANDYDNS.COM
Registrar: BEIJING INNOVATIVE LINKAGE TECHNOLOGY LTD. DBA DNS.COM.CN

```

#### Typical site 4

```
Domain Name: CASINOPLAYGAME.COM
Registrar: REGTIME LTD.

```

**Registrant**:

```
bella kotz
Email: bella2007@newmail.ru
Organization: Private person
Address: prospekt 60-letiya sssr, 18
City: birobidzhan
State: birobidzhan
ZIP: 679017
Country: RU
Phone: +7.4262268811
Fax:

```

**Name servers**: ns1.f942b690.com ns2.f942b690.com ns3.f942b690.com ns4.f942b690.com

```
Domain Name: F942B690.COM
Registrar: BEIJING INNOVATIVE LINKAGE TECHNOLOGY LTD. DBA DNS.COM.CN

```

## History

The botnet hosting these sites has also been used for bank phishing and money mule scams.

One example is the domain name arfcu.us, February 2008, which was an attempt to run a phishing operation against the Atlantic Regional Federal Credit Union site.

The bank phishing botnet is predominantly located on machines infected in Romania, USA, and Argentina.

The same botnet has been seen being used for fake escrow business scams using domains like bigeurocargo.com in February 2008. This has been exposed and again exposed and yet again.

## Sample Spam

```
Subject: Enjoy our MASSIVE $2400 bonus.........

Amazing $2400 bonuses..... Amazing Customer Support...... Amazing  games.....
Play at the world's most prestigious online casino.....
Come and get your MASSIVE $2400 BONUS NOW!
Fair Gaming, Fast Payouts unrivalled customer support: GUARANTEED!!!
Join the superstars and some of the world’s BIGGEST winners........ ENTER HERE http://dokofuko73864.blogspot.com/ TO
DOWNLOAD NOW!

```

## April 2008 casino nameservers and representative domains

```
nameserver: ns1.cameltrophier.com
24 seat botnet
7 unique bots

"Casino La Scala :: Elegant Gaming"
firstprimegame.net
loads site in an iframe from gamez-downloadz.com/lascala/en/
executable download = gamez-downloadz.com/lascala/SetupCasino.exe

":: Euro Dice Casino ::"
gamingnewsite.net
loads site in an iframe from gamez-downloadz.com/eurodice
executable download = gamez-downloadz.com/eurodice/SetupCasino.exe

"Welcome to the Euro VIP Casino"
newfirstplaying.com
loads site in an iframe from gamez-downloadz.com/eurovip
executable download = gamez-downloadz.com/eurovip/SetupCasino.exe

"Welcome to the Royal Casino!"
gamblingnewplace.com
loads site in an iframe from gamez-downloadz.com/royalvip/
executable download = gamez-downloadz.com/royalvip/SetupCasino.exe

"EURO PRIME CASINO"
casinoprimevip.net
loads site in an iframe from gamez-downloadz.com/europrime/index.html
executable download = gamez-downloadz.com/europrime/download/casinoen.exe (depending on language chosen;
requires javascript enabled)

"***EURO VIP CASINO*** Amazing Games, Big Winnings, Fantastic Promotions! PLAY NOW & WIN!"
newvipgambling.net
loads site in an iframe from gamez-downloadz.com/eurovip/
executable download = gamez-downloadz.com/eurovip/SetupCasino.exe

"Casino Club V.I.P"
vipgamingworld.net
executable download = vipgamingworld.net/smartdownload.exe
no iframe

target domain for some of the above sites:
GAMEZ-DOWNLOADZ.COM
single IP address 217.20.209.180, shared only with a Russian tax software site
Host = InformTelecom, Moscow

```

```
nameserver: ns1.worlddwins.com and ns1.worldewins.com (Xin Net)
sites hosted on IP address 210.14.131.10 with ZBYD Technology Co.,Ltd, Beijing (LACNIC)

"Jackpot Casino/Gambling Online Casino"
fjdiif.com.cn
executable download = fjdiif.com.cn/go.php => InstallCasinoV2.exe

"Welcome to the Euro VIP Casino"
jksudia.cn
executable download = jksudia.cn/SetupCasino.exe

"Welcome to the Vegas Casino!"
cniijid.cn
executable download = meta refresh to cniijid.cn/SetupCasino.exe

same nameservers/IP also have domains for "E2 Finance" and "Freedom From Debt Forever!/Freedom4U"

```

```
nameservers: ns1.slim25.com and ns1.fort23.com
sites hosted on IP address 118.216.29.237 Hanaro Telecom, Korea

"world_casino_out"/"World Casino"
kingscasinoworld.com
executable download = kingscasinoworld.com/SmartDownload.exe

"Golden Gate Casino"
goldfirstplaying.com
executable download = goldfirstplaying.com/SmartDownload.exe

```

```
nameserver: ns1.teetns.com
sites hosted at 118.216.29.237 (see above)

"Welcome to the Royal Casino !"
eurocasinoafy.com
executable download = eurocasinoafy.com/SetupCasinoR.exe

```

## How to Report this Spam

The Complainterator is configured to report this spamming operation. When preparing the report, add a link to this page for evidence.

## Further reading

* Dancho Danchev - Don't play poker on an infected table - Part 1
* Part 2
* Part 3