Spam for Vegas Red / Casino Partners

[Maxfalcon]

I've received a ton of them at practically all my email addresses, including nongambling related, and frankly I'm tired of this.

Return-path: <56maceo@about.com>
Envelope-to: xxxketxxxxxxxxxxnlinecasinos.com
Delivery-date: Mon, 22 May 2006 08:15:41 -0700
Received: from [209.163.127.203] (helo=norfolk-209-163-127-203.dynamic-dialup.coretel.net)
by xxxxxxxxxxxxxxx with smtp (Exim 4.52)
id 1FiC89-00012C-BF
for xxxketxxxxxxxxxxnlinecasinos.com; Mon, 22 May 2006 08:15:41 -0700
Message-ID: <1cb501c67da9$269d8e32$586c30c2@about.com>
From: Henry Wright <56maceo@about.com>
To: xxxketxxxxxxxxxxnlinecasinos.com
Subject: Poker, roulette, blackjack, etc.
Date: Mon, 22 May 2006 17:10:37 +0300
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0000_C3FB21FE.ECAA375A"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express V6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180

Where is lcoated the affiliate username in the Setup.EXE file? Towards the beginning or the end of the file?

The spammer use a custom template at x-http://www.chishow.net/wow/.

[Maxfalcon]

Here is the information about the affiliate found in the exe:

source:week1706
vegas1
main

one of the should be the username.

[Maxfalcon]

Some of the spam:

You've been selected to Play at the HI-ROLLER CASIN0!
Benefits include:
* Up to $888 real money to gamble with
* Fastest growing/most trusted online company
* Play all your favorite games: Poker, Hold'em, Black Jack, Slots, etc.
* Play at no-cost to see how exciting and easy it is
* Rapid payouts to all clientele & 24/7 support
* Great games, Big Winnings, & thousands of players This is a limited chance that expires at the end of the month.
x-http://dewago.com/casino/

pantile lath stone marten stern tube
pond-scum parasite talha gum day clothes drill twister stud chain spelling reformer quasi-sanguine Caela sculptoris phosphorus oxide rude-spun Pseudo-republican sandwich beam two-handled ill-understood Hog latin Phil-african prison house clip hook track sprocket supra-esophagal strain normal

VEGAS CASINO ONLINE

- Superb Graphics
- All Games (Poker, Roulette, Blackjack, etc.)

x-http://www.chishow.net/wow/

Special feature:
- Gamble with a live dealer (video stream)


________________________________
To change your mail preferences, go here <http://www.chishow.net/uns.htm>

[universal4]

Here are a number of the other domains that this same spammer is using.

xxhttp://cureorder.com/d1/now/ worked 5-14
xxhttp://famonra.com/d1/total/ worked 5-14
xxhttp://cazelun.com/d1/total/ worked 5-14
xxhttp://xakeron.com/d1/total/ worked 5-14
xxhttp://periolo.com/d1/total/ worked 5-16-06 (created 5-13-06)
xxhttp://nerauta.com/d1/total mailed 5-18-06 (DEAD)
xxhttp://ikelia.com/d1/total mailed late 5-18-06
xxhttp://zagrol.com/d1/total mailed 5-19-06 (created 5-11-06)
xxhttp://kolared.com/d1/hot mailed 5-20-06 (created 5-10-06)
xxhttp://fetalgo.com/d1/hot
xxhttp://dewago.com/casino/ mailed 5-22-06
xxhttp://paliada.com/d1/total mailed 5-22-06
xxhttp://berligo.com/casino/ mailed 5-22-06


Often this spammer will be mailing with domains that are only days old. From the list above some of the domains have been turned off or their dns entries have been removed.

The support staff has been aware of this issue for a long time.

Rick
Universal4

[Maxfalcon]

Do they make any profit with this? When I see how hard it is to convert someone and to make a good job, that kind of loosy emails have to be sent to millions to make any real profit, really...

That's great to hear that Casino Partners is working on the issue.

The spam makes me mad everyday I turn on the computer , and despite having a spam barrier on the server itself, a spam barrier between my mailbox and the sender, and two spam filters directly into the email client, PLUS having coded my email tags in javascripts on my website, I still have hundreds of emails to delete every day...

[universal4]

2 More

xxhttp://germip.com/d1/total mailed 5-23-06
xxhttp://oilproc.com/d1/total mailed 5-27-06


Rick
Universal4

[Maxfalcon]

I've received lots of them again this week.

[universal4]

This mailer has graduated to trying to hide by using a redirect...

xxhttp://jimleg.com/casino/ mailed 5-28-06 Domain Creation Date: 25-May-2006
redirects to
xxhttp://sparso.com/d1/top

Rick
Universal4

[Maxfalcon]

I'm forwarding the URL of this thread at spam@casinopartners.com.

[Maxfalcon]

I've just sent this email to Casino Partners.

Hi there,

I'm affiliate maxxxxxxxx.

There's a class one spammer for Vegas Red Casino spamming hundreds of emails everyday to all my email boxes, even those that I never use with online gambling. Here is some information we've gathered as well as the username of this spammer:

https://www.gpwa.org/forum/spam-vegas-red-casino-partners-167057.html#post465303

I hope you will take the appropriate actions such as closing the offender's account and holding all commissions.

"Anti-Spam Policy
Please remember that neither we, nor our ISP, tolerate spam of any kind. Any affiliate caught spamming will be placed on probation from the affiliate programs and all earnings will be void."

In this case this affiliate has really spammed like hell...

Sincerely,
Cedric A. - Marketing Manager (GPWA/CAP member)
http://www.Gambling-Pro.com
http://www.SortOnlineCasinos.com
__________________________________________________ _________
WEBMASTERS - CHECK OUR 100% FREE GAMBLING NEWSFEED SERVICE:
RSS: http://www.gambling-pro.com/gambling_news/rssnews.xml
JS: http://www.gambling-pro.com/services/news_feed.php
************************************************** *********

[universal4]

Two New ones this morning.

xxhttp://acprods.com/d1/amazing/
xxhttp://merlog.com/d1/super

Rick
Universal4

[universal4]

One more tonight, one domain was created 25th of May and one was created the 26th

xxhttp://advcsys.com/d1/play
xxhttp://reglef.com/casino/

Rck
Universal4

[universal4]

Another new one for the day.

Created 25th of May

xxhttp://kofger.com/d1/total

Rick
Universal4

[universal4]

Another new one for today.

xxhttp://csprof.com/d1/total mailed 5-31-06 created 5-25-06

Rick
Universal4

[Maxfalcon]

no comments...

What really annoys me also is the image that these spammers give to online gambling.

[universal4]

Another new one for today.

xxhttp://saregum.com/casino/

Rick
Universal4

[universal4]

So to recap this thread for the time being....

In less than 30 days we have the following list.

xxhttp://cureorder.com/d1/now/ worked 5-14
xxhttp://famonra.com/d1/total/ worked 5-14
xxhttp://cazelun.com/d1/total/ worked 5-14
xxhttp://xakeron.com/d1/total/ worked 5-14
xxhttp://periolo.com/d1/total/ worked 5-16-06 (created 5-13-06)
xxhttp://nerauta.com/d1/total mailed 5-18-06 (DEAD)
xxhttp://ikelia.com/d1/total mailed late 5-18-06
xxhttp://zagrol.com/d1/total mailed 5-19-06 (created 5-11-06)
xxhttp://kolared.com/d1/hot mailed 5-20-06 (created 5-10-06)
xxhttp://fetalgo.com/d1/hot
xxhttp://dewago.com/casino/ mailed 5-22-06
xxhttp://paliada.com/d1/total mailed 5-22-06
xxhttp://berligo.com/casino/ mailed 5-22-06
xxhttp://germip.com/d1/total mailed 5-23-06
xxhttp://oilproc.com/d1/total mailed 5-27-06
xxhttp://acprods.com/d1/amazing/
xxhttp://merlog.com/d1/super
xxhttp://advcsys.com/d1/amazing mailed 5-30-06
xxahttp://dvcsys.com/d1/super mailed 5-30-06 same as above
xxhttp://reglef.com/casino/ mailed 5-30-06
xxhttp://kofger.com/d1/total mailed 5-30-06 created 5-25-06
xxhttp://csprof.com/d1/total mailed 5-31-06 created 5-25-06
xxhttp://saregum.com/casino/ mailed 6-01-06

Rick
Universal4

[universal4]

3 new ones for the weekend.

xxhttp://lessoku.com/casino/ mailed 6-03-06
xxhttp://dlaea.com/d1/super/ mailed 6-03-06
xxhttp://nesdoj.com/casino/ mailed 6-04-06


Rick
Universal4

[universal4]

How about a recap of the entire list

xxhttp://cureorder.com/d1/now/ worked 5-14
xxhttp://famonra.com/d1/total/ worked 5-14
xxhttp://cazelun.com/d1/total/ worked 5-14
xxhttp://xakeron.com/d1/total/ worked 5-14
xxhttp://periolo.com/d1/total/ worked 5-16-06 (created 5-13-06)
xxhttp://nerauta.com/d1/total mailed 5-18-06 (DEAD)
xxhttp://ikelia.com/d1/total mailed late 5-18-06
xxhttp://zagrol.com/d1/total mailed 5-19-06 (created 5-11-06)
xxhttp://kolared.com/d1/hot mailed 5-20-06 (created 5-10-06)
xxhttp://fetalgo.com/d1/hot
xxhttp://dewago.com/casino/ mailed 5-22-06
xxhttp://paliada.com/d1/total mailed 5-22-06
xxhttp://berligo.com/casino/ mailed 5-22-06
xxhttp://germip.com/d1/total mailed 5-23-06
xxhttp://oilproc.com/d1/total mailed 5-27-06
xxhttp://acprods.com/d1/amazing/
xxhttp://merlog.com/d1/super
xxhttp://advcsys.com/d1/amazing mailed 5-30-06
xxahttp://dvcsys.com/d1/super mailed 5-30-06 same as above
xxhttp://reglef.com/casino/ mailed 5-30-06
xxhttp://kofger.com/d1/total mailed 5-30-06 created 5-25-06
xxhttp://csprof.com/d1/total mailed 5-31-06 created 5-25-06
xxhttp://saregum.com/casino/ mailed 6-01-06
xxhttp://lessoku.com/casino/ mailed 6-03-06
xxhttp://dlaea.com/d1/super/ mailed 6-03-06
xxhttp://nesdoj.com/casino/ mailed 6-04-06
xxhttp://erilg.com/d1/amazing
xxhttp://gradotl.com/casino/
xxhttp://inftas.org/casino/ mailed 6-08-06
xxhttp://pkklop.com/d1/super/ mailed 6-09-06
xxhttp://kopolok.com/d1/games mailed 6-12-06
xxhttp://refern.com/casino/ mailed 6-12-06


Certainly a list worthy of some sort of action from the affiliate program.

Rick
Universal4

[Maxfalcon]

Here is an interesting turn of events. There's someone linking me as the person sending this spam...

There are comics everywhere, or is this guy the spammer itself?

Received from my online form:

Subject: UNSUBSCRIBE SPAM NOW
Email: xxxxxxxxxxxx@pol.com
Message: I HAVE RECEIVED 20 SPAM EMAILS FROM YOUR COMPANY TODAY. UNSUBSCRIBLE ME IMMEDIATELY FROM ALL LISTS OR I WILL SUBMIT A COMPLAINT TO THE US ATTORNEY GENERAL.

Then

Hi there,

We never spammed anyone, nor we have your email address in any of our lists.

The problem with spammers, is that they often 'fake' their email addresses to look for another ones. They may use our domain name (or the Yahoo one, etc...), for example, but the email is sent from a server on their own which we have no control, and nobody else has any control on them.

To show the real path of the email, then you may display the 'headers' of the message using your email client.

Have a good day,

Sincerely,
Cedric A. - Marketing Manager (GPWA/CAP member)

and

Hi again,

Could you please forward us one of those emails? I will look into it. Thank you.

Sincerely,
Cedric A. - Marketing Manager (GPWA/CAP member)

then I receive this today:

Here's one of the emails. I got 5 more today. Whether they come from you or a third party spam agent using a spoofed IP, it all leads back to your company so I am still holding you responsible.
------------------
FROM: "Thanh " <nvsqxialiqfxdn@norikomail.com>
TO: "Shmokeybear" <xxxxxxxxxx@pol.com>
DATE: 06/12/2006 MON 03:40 AM
SUBJECT: Gamble for fun!

>You've been selected to play at the.. HI-ROLLER CASIN0!
>Your promotional ID is IIZ02525103
>
>http://pkklop.com/d1/money
>
>Benefits include:
>* Up to $888 real money to gamble with
>* Fastest growing/most trusted online company
>* Play all your favorite games: Poker, Hold'em, Black Jack, Slots, etc.
>* Play at no-cost to see how exciting and easy it is
>* Rapid payouts to all clientele & 24/7 support
>* Great games, Big Winnings, & thousands of players
>
>
>

So whether or not this guy is a joke, I hold Casino Partners responsible of this situation, by not stopping the offender affiliate. It seems also that this affiliate hosts itself the installation files for the casino.