Affiliate Managers - be aware of this scam

[CCJ]

Hi All,

Catriona at Paddy Power just cc'd us on an email they received from a website "appearing" to be ours. The website took our domain name and added an "s". They even went so far as to have their domain forward to ours. The domain "appearing" to be ours is xxxhttp://www.casinoscashjourney.co.uk (notice the s after the word casino). It has nothing to do with our company.

Here is the email that was cc'd to us by the affiliate program:

*******

From: Ellen Poole [mailto:ellen@casinoscashjourney.co.uk]
Sent: 03 February 2011 02:18
To: Affiliates
Subject: Casino Cash Journey UK

Importance: High

Hi There,

I am just letting you know that we still have spots available on the homepage. We can guarantee ~50 euro deposits per month for featured casinos. Let me know if you're interested!

Ellen Poole
Sales Department
Casino Cash Journey UK
Skype - casinocashjourney

*******


For the record, our company also does not own or operate the following domains:

xxxhttp://www.casinocashjouney.com (no r in journey)
xxxhttp://www.casinoscashjourney.com (s after the word casino)

[CCJ]

So far we've been contacted by 5 Affiliate Managers in regards to the issue. There's actually a name for this and it's called "Brand Illusion Typo Phishing". This is what their hosting company told us.

[Simmo!]

Sorry to hear that - thanks for posting and hope it resolves OK. Criminals like that annoy the crap out of me. I'm betting the registrant for "casinocashjouney.com" - Andrew Molloy - is a ficttious name. You can report domains that don't have the correct whois info and get them shut down CCJ. Worth looking into if you haven't already.

"casinoscashjourney.com" is anonymous but you can still report it on the offchance. The DNS servers look like Hostgator ones so might be worth letting them know too.

[Gabriel_LCP]

Hey thanks for the notice!! Will be more alert about this issue!

[CCJ]

Hi All,

After corresponding with many, many Affiliate Managers, this is what "Ellen Poole" from xxxwww.casinoscashjourney.co.uk (notice the s after casino) was asking for:

*******
"Hi, Pricing for featured casinos is €6000/3 months with 30% revenure share. We can guarantee you 50 new player deposits per month on the contract. Let me know if this is doable for you.
*******

In some cases they were asking for €4500/3 months. They wanted the payment upfront.

We've contacted most of our database of Affiliate Managers and nearly 90% of them were contacted by "Ellen Poole". We feel our duty is to let everyone we deal with know about the issue. It looks as though this may be the latest type of scam "Brand Illusion Typo Phishing". Hopefully the people we don't already work with, check this forum.

Affiliate Managers are "street smart" and a lot more savvy than the crooks think!

We're going to be putting a notice up on our UK website about the issue.

Sorry to hear that - thanks for posting and hope it resolves OK. Criminals like that annoy the crap out of me. I'm betting the registrant for "casinocashjouney.com" - Andrew Molloy - is a ficttious name. You can report domains that don't have the correct whois info and get them shut down CCJ. Worth looking into if you haven't already.

"casinoscashjourney.com" is anonymous but you can still report it on the offchance. The DNS servers look like Hostgator ones so might be worth letting them know too.

Hi Simmo,

With the two urls (below) our main concern was to let people know that it was not us, in case they do something unethical.

xxxhttp://www.casinocashjouney.com (no r in journey)
xxxhttp://www.casinoscashjourney.com (s after the word casino)

At this point, they have not done anything wrong. I don't like what they did but I should have covered all my bases and bought these urls. Yesterday, when I was speaking with GoDaddy support about the webmaster who bought xxxwww.casinoscashjourney.co.uk, they said they have a "Discount Domain Club" where you can buy all variations of your domain name for $90.

On another note, many Affiliate Managers that are contacting us about the issue are now looking for ad space! That's the positive of this mess! I only wish I had a lot more space!!

[wagerjunction]

We were one of those who received the offer. To be honest we did not notice the additional 's' right away but did think to enquire further about the claim "We can guarantee ~50 euro deposits per month for featured casinos."

That's the reply we got:

Pricing for featured casinos is €6000/3 months with 30% revenure share. We can guarantee you 50 new player deposits per month on the contract. Let me know if this is doable for you!

At this point though we simply declined the offer and were contacted some time afterwards by CCJ to inform us that this did not come from them.

[CCJ]

Hey thanks for the notice!! Will be more alert about this issue!

Hi Gabriel,

Thanks for checking in. We didn't email you directly because we noticed you posted here.

Do you think its a good idea for Affiliate Managers to have a private section or forum that they only can specifically go to for things just like this? Basically to discuss your end of the business. For example, it took me about 2 days to get emails out to all the Affiliate Managers we deal with because they don't all check in here.

[Gabriel_LCP]

Hey no problem!! That's what the forums are for!

And yes, it probably wouldn't be a bad idea, at least be sent through the PM sections!

[AussieDave]

Hi all,

Although this scam is certainly directed toward aff managers - it could go far beyond that point and branch out in other directions - if you get my drift

Thanks CCJ for posting your intel here too

Maybe a thought to consider, is having your email address verified. Don't ask me how it's done but I know it can be. When I was doing the SEO for Fortune Lounge Group, I'd often received emails but these emails were verified (digitally signed or something). They guaranteed they'd come from the fortunelounge.com domain.

People can spoof domains and what not but I don't think they can spoof this scenario.



Cheers



Dave

[PureCommission]

I've dealt with a similar scam if its not the same people...they sent me oodles of bad porn traffic on high CPA. I figured they are either a porn group trying to increase their traffic value, or a gambling group that wants to piggy back their bad porn traffic. PM me if you need specific details.

Kind Regards,
Ron

[Renee]

Hi Gabriel,

Thanks for checking in. We didn't email you directly because we noticed you posted here.

Do you think its a good idea for Affiliate Managers to have a private section or forum that they only can specifically go to for things just like this? Basically to discuss your end of the business. For example, it took me about 2 days to get emails out to all the Affiliate Managers we deal with because they don't all check in here.

There is such a section available to aff managers here for stuff exactly like this, just like the affiliates have the private section. The problem is that there is an affiliate manager who doesn't respect that the forum is private and consequently the rest of us have stopped using it as often for this reason.

[CCJ]

Maybe a thought to consider, is having your email address verified. Don't ask me how it's done but I know it can be. When I was doing the SEO for Fortune Lounge Group, I'd often received emails but these emails were verified (digitally signed or something). They guaranteed they'd come from the fortunelounge.com domain.

People can spoof domains and what not but I don't think they can spoof this scenario.

Hi Aussie Dave,

When we contacted GoDaddy (their registrar), they had said an option could be to go with SPF which means:

"SPF stands for Sender Policy Framework and, as its name implies, allows the e-mail address owner to specify which mail servers they use to send mail from their domain to prevent sender address forgery. The SPF protection is a two-side process that requires the intervention of both the owner of the domain (to which the email address is attached) who specifies some mail sending rules in the domain's DNS zone, and the receiving server that checks whether the message complies with the domain's stated policy."

However like you said, this would not have helped in our situation because they did the email through the slightly variated domain name. The SPF helps with spoofing and I think it's a great idea.

[CCJ]

There is such a section available to aff managers here for stuff exactly like this, just like the affiliates have the private section. The problem is that there is an affiliate manager who doesn't respect that the forum is private and consequently the rest of us have stopped using it as often for this reason.

It's too bad that's happening as it could be quite a useful tool for Affiliate Managers while benefiting affiliates also. For affiliates, the GPWA is great because you can learn of things so quickly.

To us, this is a new scam that is geared primarily towards affiliate programs/casinos and then affecting the credibility of the site they "Brand Illusioned". It's just another thing that Affiliate Managers need to look out for. In this case, how often is anyone going to look that closely at an email address. It did fool some people but no one actually got stung that we know of. We spent a lot of time trying to inform everyone. We're curious if they reached anyone that we don't work with.

[CCJ]

Hi All,

We believe we reached everyone we work with. If there's any company out there that DID sent funds to this webmaster, please PM us as we would like to forward their payment details to the payment processor.

Thank You,