Affiliate Program Notice of the Criminal Activity of Verifiedcasinos.com

For those not already familiar with this matter, there is a thread within the GPWA forum started by member antihacker on the 27th of August bringing the criminal activity of the affiliate operating the website verifiedcasinos.com to the attention of affiliates and affiliate programs. This thread, which contains hundreds of responses, can be found here: URGENT: ALL Affiliate programs: BAN VERIFIEDCASINOS.COM For Serious Hacking! (proof). We all owe a debt of gratitude to antihacker for uncovering this criminal activity and bringing it to our attention.

Because of the very serious and pervasive criminal activity of the verifiedcasinos.com affiliate, we decided it made sense to notify and warn as many affiliate programs and affiliate program representatives as possible about this unscrupulous affiliate. Accordingly, we are sending the email below to our entire database of affiliate programs and their representatives, which includes over 1,600 contacts including the over 1,000 affiliate programs listed on our iGamingAffiliatePrograms.com website and all of the affiliate program contacts we know through the GPWA.

Quote:

---

Subject: Criminal Activity by an Affiliate

This email is being sent to you as an affiliate program representative to let you know about the widespread criminal activity of a rogue gaming affiliate. The affiliate operates a number of websites including verifiedcasinos.com, and the extent and nature of the criminal activity of this affiliate has served to enrage online gaming affiliates worldwide.

Succinctly, the affiliate operating verifiedcasinos.com has hacked an extremely large number of websites by systematically exploiting a vulnerability in the Akismet WordPress plugin to insert iframes promoting online gaming sites under his affiliate codes, thereby illegally diverting both traffic and revenue from the webmasters whose sites have been hacked.

There is currently a concerted effort by the affiliate community to do everything possible to put a stop to this situation. In addition to making contact with individual webmasters whose sites have been hacked, the affiliate community is working to stop the problem at its root by making sure the affiliate cannot profit from his illegal activity.

From the perspective of the GPWA, the ethics of the situation for an affiliate program are quite simple. Our affiliate program code of conduct states that an affiliate program “will not use unethical methods of promotion either directly or indirectly through others.” Working with this affiliate violates the code of conduct since it constitutes indirectly supporting and directly benefiting from very deliberate criminal hacking activity, which is an unethical method of promotion. Additionally, depending on you licensing jurisdiction, engaging with this affiliate may not be permitted under the terms of your operating license.

We know that successful affiliate program managers understand their business success depends upon the affiliate community viewing that they and their affiliate program are trustworthy and ethical. And they also know that prompt action to resolve issues is rewarded, and that inaction or delays can cause serious reputation issues.

On this basis, the response of almost every program we have spoken with who was working with this criminal has been to take prompt action to sever the relationship. But we have not yet reached every affiliate program who is unwittingly working with this affiliate, and the affiliate is adding new programs as existing relationships are severed. The affiliate is also using geotargeting, making the task of identifying all of the affiliate relationships more difficult.

We request that you verify that your program does not have a relationship with this affiliate, and if you do have a relationship we request that it be terminated for cause and that any unpaid affiliate earnings be forfeited. And we also ask that you be diligent in avoiding working with this affiliate in the future. If you have any questions, please let us know.

Finally, if you should know an affiliate manager at any site still listed on the verifiedcasinos.com website, we urge you to forward a copy of this email to them, and to let us know so we can follow up with them as well and answer any questions they might have.

In addition to supporting the affiliate community in this effort, our goal is to work with the affiliate program community to stop this criminal, and for those affiliate programs that help to be recognized for their support in this effort. And we also want to do whatever we can to help programs act promptly so they can avoid the criticism that is predictably associated with being indecisive.

Further information can be found in the GPWA forum in the thread where we announced sending this email: www.gpwa.org/forum/affiliate-program-notice-criminal-activity-verifiedcasinos-com-219772.html

Yours truly,

Michael Corfman
GPWA Executive Director

---

Distribution of this email to our database of contacts should be completed before the week is out. I would like to thank thepogg for making the suggestion to do this mailing. In addition to the discussion in the public GPWA forums regarding the criminal activity of this affiliate, there is also discussion in the private forums, and it was out of discussion in the private forums that this suggestion arose in the past few days.

Please note that this is the thread we are directing affiliate program representatives to when the read the email we are sending. For this reason, if the thread becomes long or contains comments that are not directly related to what will be most important for affiliate programs to understand, we may move posts made in this thread to a supplemental thread if we determine that best facilitates making forward progress.

Michael

Hi Michael,

Thanks for the email. I’d been following the threads on GPWA and I’ve checked and fortunately this affiliate does not work with WBX.

I appreciate your efforts in raising awareness of the situation, as dishonest behaviour like that deprives genuine affiliates of their earnings and tarnishes the industry as a whole.

I think those that organize the conferences should tell programs like Affpower you are not welcome because you are a disgrace and a threat to our industry.

You Affpower scare our players with your affiliate that hacks/mutates peoples sites (breaking into people homes) without their permission.

Absolutely amazing. My jaw just dropped on my desk seeing this. Thank you from the bottom of my heart and a whole lot deeper than that. I truly, truly truly appreciate this, and I am sure all other affiliates and affiliate programs too. I am beginning to think that sacrificing my whole business over this has not been for nothing. For me it's practically too late after having been exposed.. I need to start all over as you know...

But at least, it now seems it was for a reason: Cleaning our industry from these folks has commenced on a very serious level. I can not express my gratitude enough. Thank you Michael / GPWA and all those who participated / are participating.

To all affiliate programs: May I recommend to all affiliate programs managers that prevention is better than curing?

Is there a way that the affiliate programs take action to PREVENT this type of behavior in the future?

Please everybody who is anybody: Brainstorm on how this can be prevented. As the verifiedcasinos hacker is not the only one currently actively hacking..

In my humble opinion there should be a clause in all and any of the TOS / Rules and regulations from the aff programs, stating that criminal behavior like hacking etc should be punishable with a penalty of $xxxxxxxx. And, this should be enforced too. Perhaps then, they might think twice then. All affiliates (new and existing ones) should sign an agreement to not use these type of illegal activities, in essence binding them to it, and making enforcing it a lot easier.

If you think it is too hard to find them, think about employing me. I'd love to watch over it, and get paid for all of this instead of losing all as I did. I could set up a 'central reporting point' where all can be reported / investigated etc. I'll be glad to give it my best and fulltime attention.

Quote:

---

Originally Posted by MichaelCorfman

Accordingly, we are sending the email below to our entire database of affiliate programs and their representatives, which includes over 1,600 contacts including the over 1,000 affiliate programs listed on our iGamingAffiliatePrograms.com website and all of the affiliate program contacts we know through the GPWA.

---

I feel it's important to acknowledge what a resource we have at the GPWA. Whether you are an affiliate or a program. The database of every program and contact is invaluable and takes a lot of work and research. We are lucky to have Mr C and team on our side.

Not to mention the handsome Anthony and Rick in the trenches every day. :hug:

Thank you!

finally .. 6 Months ago i gave notice to my Manager about this and noone really wanted to listen

Quote:

---

Originally Posted by antihacker

Absolutely amazing. My jaw just dropped on my desk seeing this. Thank you from the bottom of my heart and a whole lot deeper than that. I truly, truly truly appreciate this, and I am sure all other affiliates and affiliate programs too. I am beginning to think that sacrificing my whole business over this has not been for nothing. For me it's practically too late after having been exposed.. I need to start all over as you know...

But at least, it now seems it was for a reason: Cleaning our industry from these folks has commenced on a very serious level. I can not express my gratitude enough. Thank you Michael / GPWA and all those who participated / are participating.

To all affiliate programs: May I recommend to all affiliate programs managers that prevention is better than curing?

Is there a way that the affiliate programs take action to PREVENT this type of behavior in the future?

Please everybody who is anybody: Brainstorm on how this can be prevented. As the verifiedcasinos hacker is not the only one currently actively hacking..

In my humble opinion there should be a clause in all and any of the TOS / Rules and regulations from the aff programs, stating that criminal behavior like hacking etc should be punishable with a penalty of $xxxxxxxx. And, this should be enforced too. Perhaps then, they might think twice then. All affiliates (new and existing ones) should sign an agreement to not use these type of illegal activities, in essence binding them to it, and making enforcing it a lot easier.

If you think it is too hard to find them, think about employing me. I'd love to watch over it, and get paid for all of this instead of losing all as I did. I could set up a 'central reporting point' where all can be reported / investigated etc. I'll be glad to give it my best and fulltime attention.

---

With all referalls expected to be coming for a certain site. i.e my aff code would expect referalls from my domain footy-tipster.co.uk.

I would expect that a database query could be run upon sign up.

affiliate site : footy-tipster.co.uk
reffering site: verifiedcasinos.com

String mismatch.

Which would trigger a warning, or a points system, where x points = a flag raised.

Quote:

---

Originally Posted by Voids

With all referalls expected to be coming for a certain site. i.e my aff code would expect referalls from my domain footy-tipster.co.uk.

I would expect that a database query could be run upon sign up.

affiliate site : footy-tipster.co.uk
reffering site: verifiedcasinos.com

String mismatch.

Which would trigger a warning, or a points system, where x points = a flag raised.

---

Would there be a mismatch though if they were using an iframe to insert their page?

Quote:

---

Originally Posted by MichaelCorfman

Accordingly, we are sending the email below to our entire database of affiliate programs and their representatives, which includes over 1,600 contacts including the over 1,000 affiliate programs listed on our iGamingAffiliatePrograms.com website and all of the affiliate program contacts we know through the GPWA.

---

Well roar'd Lion.

I have two points and one question.

Point 1:

"Sigurd, of course, bathed in the blood of the dragon but while he was doing it the autumn leaf of a lime tree fell on his back, leaving a vulnerable spot which was to be decisive in the outcome of the legend."

The following is (and was from the very first day) the vulnerable spot in the current case: https://www.gpwa.org/forum/leopolds-...tml#post770418

---

Point 2:

"we are sending the email below to our entire database of affiliate programs and their representatives, [...] including the [...] affiliate programs listed on our iGamingAffiliatePrograms.com website"

===> igamingaffiliateprograms.com/affiliate-program/affeurope/

===> igamingaffiliateprograms.com/affiliate-program/affpower/

Obviously, at some places on Earth the roar went unheard in the storm of shame: https://www.gpwa.org/forum/leopolds-...tml#post770530

---

Question:

Why I have the feelings, -regarding this case- that time seems to elapse faster than ever before and the true knowledge decreases in increasing shorter periods of time?

---

In one week is Halloween, but it is already possible to find hollowed out pumpkins ... at any time ... in some program offices around the world.

https://www.gpwa.org/forum/images/im...ilies_0150.gif


By the way: I am sure, your email was marked as "spam" after it reached AffPower's little offshore computer in the sleeping room, the so called "office" with hundreds of different "departments". All "departments" in one room, a room with spotted dragon-like creatures, painted on the naked and cold walls.

Leopold

Hey Michael how can we tell if ur site has been hijacked by this? Most wordpress sites i know of use the Askimet plugin. Is there a simple test to make sure this is not happening to our sites?

Brian I a sending a pm,

Rick
Universal4

Quote:

---

Originally Posted by islandmaan

Hey Michael how can we tell if ur site has been hijacked by this? Most wordpress sites i know of use the Askimet plugin. Is there a simple test to make sure this is not happening to our sites?

---

That is no secret!

More than one month before I wrote the detection/solution here public on GPWA:

---

19. September 2014

Full version for a permanent solution ... and it's free!:

1. Make a backup of your files and database.

2. The problem is Askimet! I never used it. This plugin will be abused by hacker to infiltrate your wordpress system, and now you know, why so many pages are hacked. It's one of the most popular plugins of the world.

3. Check your folders for files like social.png, social0.png, social1.png, social2.png ... These with Base64 encoded "image" files includes hidden codes for the casino hack. You will find them most likely in the theme folder.

4. The evil images will be loaded through added lines in the functions.php. Delete the following lines:

if (!defined(‘WP_OPTION_KEY’)) {
include_once ‘social.png’;
}
if (!defined(‘WP_OPTION_KEY’)) {
include_once ‘social0.png’;
}
if (!defined(‘WP_OPTION_KEY’)) {
include_once ‘social1.png’;
}
if (!defined(‘WP_OPTION_KEY’)) {
include_once ‘social2.png’;

[...]

5. Delete the following line from wp_options with sql command:

DELETE FROM `wp_options` WHERE `option_name` = ’1′;

7. Run the script from the quote at the beginning of this post.

8. Delete all unused plugins and themes.

Leopold

Source: https://www.gpwa.org/forum/urgent-al...tml#post767493

---

The script from point 7 can be found here: https://www.gpwa.org/forum/leopolds-...tml#post767317

If you don't find the images or the code lines in function.php with the search function of your text editor, then your site should be clean.

For 9 of 10 casino webmaster Askimet is absolutely worthless, because either comments are disabled or self written. If they are real, it takes 5 minutes a day to organize them by hand. No need for hacker playgrounds like Askimet. This hacker case is no suprise. The so called "Pharma Hack" with the same pattern started years ago.

The 10 second test
https://www.gpwa.org/forum/images/im...e_blackhat.gif

I am writing for the audience!

You need 10 seconds to see if your site is infected:

Enter the following into Google search box:

site:yourdomain.xxx ?p=

An example with a real victim, that have nothing to do with this industry:

site:johna-music.com ?p=

Result: https://www.google.de/search?q=site%....0.rVY3Ii5n29A

Leopold

I am not user of WordPress but thanks for this post above. many persons find it usefull :)
"This hacker case is no suprise. The so called "Pharma Hack" with the same pattern started years ago."
You are right! I heard about this "pharma" case, some time ago.
Well, people are lazy, they do not want to learn or "waste" time to write html/css code by themselves.
So, they use easy-going WordPress with (too??) many plugins and do not care even, how such plugins works!! Horrible!

Leopold, you know a lot about php, etc. I am going to hire you as a head for my hacking department. :evillaug:

I am not sure if the Akismet exploit is true, can it be proven 100% that is the main exploit that is being used by these hackers?

Also, can it be determined that it is a current version of Akismet, or is it a version that was not updated since a security patch came out in March 2014?

Rick
Universal4

"I am not user of WordPress but thanks for this post above"

https://www.gpwa.org/forum/images/im...om/2dhy9at.jpg

I have to thank you, Gamer. Some things should never change of course, and the luxurious, spacious and practical accommodation of cloud-cuckoo-land is not the place, I want to live in. Simple life is better than its reputation. Decent people, who have character and sense of humour, you cannot find everywhere, but they exist everywhere. You have to wear the right eyeglasses to be able to see them. The Keymaker knows the right track to this special optician.

We all should enter into a dialogue with ourselves, look at ourselves in the mirror and search honestly for him.

---

"I am not sure if the Akismet exploit is true"

Well, knowledge is power. Based on current information Akismet was the entrance door for many hacks and also for the "Pharma Hack". This current hack is from the same Akismet hack family. At least 3 years now Akismet is an entrance door for different hacks. The reason is easy: It's widely used! The hack history is no secret and public on internet, so I really recommend to remove this plugin. Yes, removing, not only disabling. Other members, who are using Wordpress like me and have an idea about Wordpress, know why it's important to remove Akismet immediately, because that was for sure not the last Akismet hack, and an update always comes too late. Health comes after infection.

It's very easy: No Akismet = No Akismet hack infection = No anger, no need for health and no money of criminal origin

Leopold

I have a bit of knowledge about wordpress as well, and some of that really strange goofy stuff people call computer code, although I do not use the Akismet plugin since I did not see that it added value to my sites.

If it is later proven that this was the attack vector used, I still question whether it is due to a lack of updating to a more recent version since one vulnerability was patched more than 7 months ago.

Most of us should realize, that using any outdated plugins, website server platforms, os's, or software after vulnerabilities have been patched is risky at the least.

Rick
Universal4

Hello,

three little things:

1. I miss "yoosocial.com" in the title thread, because verifiedcasinos.com is only the catalyst. The root of the hacking is yoosocial.com.

2. Despite the email a new member is on the casino list. This is further evidence of some program's guilt.
Details: https://www.gpwa.org/forum/leopolds-...tml#post771003

3. It's no secret, that I love to create short fan-made promotion trailers for hand-picked programs. Now it was time to create one for an ex-sponsor of GPWA, the main accomplice of this hacking.
Just in time for Halloween: "GPWA Ouija Board Session: The Day After" (https://www.gpwa.org/forum/leopolds-...tml#post771050)

https://www.gpwa.org/forum/images/im...ie_hal_067.gif

Leopold

It actually makes sense that some new programs or properties show up on the hackers lists.

I am not condoning the practice, but as the hackers find out they will NOT be paid promoting some groups, they replace them with others that have not caught the hacker promoting them ..... yet......

Hopefully, the push from all of us, as well as the email notifications and the general industry outcry that this is an unacceptable practice will see quicker reactions than in previous weeks.

Rick
Universal4

Two weeks ago the email was sent out. I am dismayed that -regarding thousands of German speaking victims- GPWA Gold sponsor Prime Partners is still on place 1 (!) of the criminal casino list.

It is becoming more and more difficult for programs to explain why they don't published at least a public statement like "Yesterday we terminated the business relationship with the criminal and expect banner removal shortly.".

Prime Partners should hurry up, because the question "What time does the boarding gate close?" is a dangerous one, and it is also the responsibility of GPWA staff to avoid the answer "One hour ago.".

Career criminals from AffPower (Place 2) and Affiliate Guard Dog main sponsor AffEurope (Place 7) no longer have a chance of finding a proper final excuse. They missed the boat.

Leopold

This is why we need an organized independent central point / office (as I described earlier in this post) which will actually be able to DO something about it.

Otherwise, IMHO we might as well forget about it!