URGENT: ALL Affiliate programs: BAN VERIFIEDCASINOS.COM For Serious Hacking! (proof)

[dfiocch]

Keyphrase "casino deposit bonus", location US (.com), Google (top 5)

1. johna-music.com/shop/?p=online-casino-no-deposit-bonus
2. www.bootierart.com/?p=no-deposit-casino
3. Clean (not hacked website)
4. www.zenatienda.es/zh/?p=no-deposit-casino
5. graftonbarbers.com/gb/?p=no-deposit-casino-bonus

Keyphrase "casino deposit bonus", location IT (.it), Google (top 5)

1.Clean
2. www.assistenzaweb.com/no-deposit-casino (yes, hacked!)
3. Clean
4. www.hotelcentralesiena.com/?p=casino-bonus
5. astoriabiella.com/?p=no-deposit-casino


This guy is outranking all major affiliate websites. Not fair.
Me too, i'm loosing traffic also due to this "domino effect". I can find my site, for different keywords, after many hacked pages (7 in US, 19 in IT, 12 in DE, 4 in AU).

Thanks also to gooyugle... what was the story? "Build a good website, don't use black hat techniques and you will rank!". Yes, of course...

[-Shay-]

Will search and "submit report" as appropriate, suggest others do the same...

[antihacker]

Keyphrase "casino deposit bonus", location US (.com), Google (top 5)

1. johna-music.com/shop/?p=online-casino-no-deposit-bonus
2. www.bootierart.com/?p=no-deposit-casino
3. Clean (not hacked website)
4. www.zenatienda.es/zh/?p=no-deposit-casino
5. graftonbarbers.com/gb/?p=no-deposit-casino-bonus

Keyphrase "casino deposit bonus", location IT (.it), Google (top 5)

1.Clean
2. www.assistenzaweb.com/no-deposit-casino (yes, hacked!)
3. Clean
4. www.hotelcentralesiena.com/?p=casino-bonus
5. astoriabiella.com/?p=no-deposit-casino


This guy is outranking all major affiliate websites. Not fair.
Me too, i'm loosing traffic also due to this "domino effect". I can find my site, for different keywords, after many hacked pages (7 in US, 19 in IT, 12 in DE, 4 in AU).

Thanks also to gooyugle... what was the story? "Build a good website, don't use black hat techniques and you will rank!". Yes, of course...

Told you so... He has them all, or most of 'em...

If I was all of you who is 'reporting it' I'd take out your signature links or at least consider it. Besides the strange phone calls I was getting, I've noticed quite a few odd malicious things going on with my sites which I can't explain.. The sites thing was going on for a while so it seems and for as far as my phone goes: I've now disconnected my phone. I was getting sick of it.

I'm going to have to start all over again, with new domains, new server, and all under a different name, so that he can't shoot mine anymore and I will have a chance again on making an income I was used to. With other words - all is through the drain for me. Don't let it happen to you.

Just a warning. - Be anonymous. Don't be a duck drenched in superglue, waiting to be shot and stuck like concrete blocks. You all may be ontime, it seems to focus is on me. (Thanks to the person who shared my personal details with the hacker, or however he got his dirty hands on them.)

Walter

[antihacker]

I've spoken to the affiliate manager from which program my details were leaked. I had a lengthy conversation discussing what has happened. The affiliate manager assures me that in no way she has shared my details.

However, although I tend to trust her enough to say that it wasn't her, there are colleagues there who could have. And, words are one thing, on skype these things are said easy.

I can't look anyone in the eyes so, am I sure? Unfortunately I have to say no.

But, I do tend to think it was not her. But, I'm just not sure. Fact is, my details were out in the open, shared / stolen from their files. That is what I know for certain.

She has assured me that she will have a thorough investigation on this and will go through all of the facts and details of said occurrence.

She also says that 'if it happened from them' which it did, it must have been a hack in their system. I asked if she trusted her collegues and of course the answer was yes. In my humble opinion, trust should ALWAYS be a base of a good working relationship, so I could have expected that answer.

I also told her that 'money changes people' to do the oddest most unthinkable things. If anyone inside of that organization was offered money, or commissions then things change rapidly. And, she agreed.

Anyways, I won't name the program's name, as I am awaiting the results of her investigation on this. She will order the IT department and their security to do a thorough search of any break-ins in to their system and she will share all details with me regarding her investigation. Although I think that the hacker won't have left any trails for them to find, IF it was a case of stealing my details.

If nothing comes out of that, then I don't know what way to go.

Bottom line is, my personal details are in hands of someone or someones. Someone(s) who also knows most of my domains, which clearly have been / are being targeted. This person has no shame, and that is a reason why I advise all of you to be vigilant. I don't want any of you to see the damages I am seeing now, just because I've started this thread and you decided to be part of it.

NEVER ever did I deem it to be possible for my personal details to be hung out like dirty laundry for anyone to pick up and do with whatever they like. It is a horrible situation.

I myself am also doing a lot trying to find out just what happened and how. For all I know, it could be anyone attacking me. Anyone who has seen these details while they were out in the open.

Stephen King could not have written a better script.

Walter

[antihacker]

Guys, protect yourself!

I am now noticing a ton of 'bad links' pointing to several of my sites...

Nice.

What do I mean with bad links? Links to my sites are being placed on tons of gibberish sites with porn and other unspeakable content.

I best await the dreaded 'Unnatural inbound links' mail from Google on all of the affected sites.. That is exactly what is going to happen sooner rather than later.

I am going to disavow all links I can find. Damn, there goes another night of sleep.

As said before, get rid of your signature links if you don't want the chance to have to experiencing the same kind of crap.

I've had this going on before. One of my main sites was targeted with 'bad seo by third party' practices and indeed, Google did what it should do in our hacker case. The dreaded message I've got:

Unnatural inbound links

We've detected that some of the links pointing to your site are using techniques outside Google's Webmaster Guidelines.

We don't want to put any trust in links that are unnatural or artificial, and we recommend removing any unnatural links to your site. However, we do realize that some links may be outside of your control. As a result, for this specific incident we are taking very targeted action to reduce trust in the unnatural links. If you are able to remove any of the links, you can submit a reconsideration request, including the actions that you took.

If you have any questions, please visit our Webmaster Help Forum.

Sincerely,

Google Search Quality Team

It took me months to get it back in the rankings, and although the site is back, it NEVER ranked as it used to.

More and more I am starting to feel that I wished I never started this whole thing.

[Roulette Zeitung]

This is the solution for victims: https://www.gpwa.org/forum/leopolds-...tml#post767317

Leopold

Watch this free rider on the virtual road making some money with the hack instead publishing and spreading solutions for free as I did and everyone with decent would do:

How to remove Verified Casino spam page on WordPress

Apr 4, 2014 | Category: Google

Have you been attacked?

Googlebig staff solve your problem
in 1 – 4 hours for 50 $

[...]

Payment via Paypal
admin {at} googlebig {d0t} com

Source: googlebig.com/2014/04/04/how-to-remove-verified-casino-spam-page-on-wordpress/

Leopold

[Roulette Zeitung]

This is the solution for victims: https://www.gpwa.org/forum/leopolds-...tml#post767317

Leopold

Full version for a permanent solution ... and it's free!:

1. Make a backup of your files and database.

2. The problem is Askimet! I never used it. This plugin will be abused by hacker to infiltrate your wordpress system, and now you know, why so many pages are hacked. It's one of the most popular plugins of the world.

3. Check your folders for files like social.png, social0.png, social1.png, social2.png ... These with Base64 encoded "image" files includes hidden codes for the casino hack. You will find them most likely in the theme folder.

4. The evil images will be loaded through added lines in the functions.php. Delete the following lines:

if (!defined(‘WP_OPTION_KEY’)) {
include_once ‘social.png’;
}
if (!defined(‘WP_OPTION_KEY’)) {
include_once ‘social0.png’;
}
if (!defined(‘WP_OPTION_KEY’)) {
include_once ‘social1.png’;
}
if (!defined(‘WP_OPTION_KEY’)) {
include_once ‘social2.png’;

[...]

5. Delete the following line from wp_options with sql command:

DELETE FROM `wp_options` WHERE `option_name` = ’1′;

7. Run the script from the quote at the beginning of this post.

8. Delete all unused plugins and themes.

---

Leopold

[TheGooner]

Finally - a simple explanation that's easy to understand and implement.
Hardly a mastermind hack ...

[universal4]

Yep, and since they were able to add their own code to your website, I'm sure they didn't add anything else like code to run a query on the database for the passwords or anything.

I still encourage EVERYONE who has been hacked in any way to change all appropriate passwords, including the database password.

Rick
Universal4

[Roulette Zeitung]

Full version for a permanent solution ... and it's free!:

1. Make a backup of your files and database.

2. The problem is Askimet! I never used it. This plugin will be abused by hacker to infiltrate your wordpress system, and now you know, why so many pages are hacked. It's one of the most popular plugins of the world.

3. Check your folders for files like social.png, social0.png, social1.png, social2.png ... These with Base64 encoded "image" files includes hidden codes for the casino hack. You will find them most likely in the theme folder.

4. The evil images will be loaded through added lines in the functions.php. Delete the following lines:

if (!defined(‘WP_OPTION_KEY’)) {
include_once ‘social.png’;
}
if (!defined(‘WP_OPTION_KEY’)) {
include_once ‘social0.png’;
}
if (!defined(‘WP_OPTION_KEY’)) {
include_once ‘social1.png’;
}
if (!defined(‘WP_OPTION_KEY’)) {
include_once ‘social2.png’;

[...]

5. Delete the following line from wp_options with sql command:

DELETE FROM `wp_options` WHERE `option_name` = ’1′;

7. Run the script from the quote at the beginning of this post.

8. Delete all unused plugins and themes.

---

Leopold

The casino hack is not the first hack, who used a popular plugin to come through the closed door.
And it will be not the last hack, that goes around.

Some Wordpress plugins can help you to detect very early, if something is wrong with your system.

Here is a very good one:

---

Theme Authenticity Checker (TAC)

TAC stands for Theme Authenticity Checker. TAC searches the source files of every installed theme for signs of malicious code. If such code is found, TAC displays the path to the theme file, the line number, and a small snippet of the suspect code. As of v1.3 TAC also searches for and displays static links.

More information & download: https://wordpress.org/plugins/tac/

---

Another very important is to set permissions of all files to 644 and folders to 755 with the exception of those, who must (!) have a special permission.

If your FTP client don't let you enter numbers, only checkboxes for READ (R), WRITE (W) and EXECUTE (X), then here are the equivalents:

644 = User: R+W | Group: R | World: R

755 = User: R+W+X | Group: R+X | World: R+X

The counting system behind permission is very easy. R has a value of 4, W of 2 and X of 1.
So if you add for User R (4) + W (2) + X (1) you get 7, Group R + X = 4 + 1 = 5, the same with World, finally 755.

0 = [nothing]
1 = X
2 = W
3 = W+X
4 = R
5 = R+X
6 = R+W
7 = R+W+X

---

A general hint:

I am using since a long time this plugin: https://wordpress.org/plugins/limit-login-attempts/

It's old but working very well. If you set the attemps to 4 and the blocking time to 9.999 hours, then you will see after some months, that the attempts of intruders, who tries to hack your Wordpress password, are regressing.

Leopold

[antihacker]

Although it is nice to see there is a fix for the hack, we need to affiliate programs to ban this person and state they did so. Period.

So far, 1 did.

Chapeau

[celena]

Hello,

I found this in the First page of .FR.

I think it's the same thing. I'm afraid to click on the links,

hoteldelapyramide. fr/?p= casino-en-ligne-bonus-sans-depot
cgoa. ca/?p= casino-en-ligne-bonus-sans-depot
tablettesurface .fr/?p= casino-en-ligne-bonus-sans-depot
jardindesmodes. fr/?p= casino-en-ligne-bonus-sans-depot
kids-fest .ca/?p= casino-sans-depot

[antihacker]

Are we still having fun in waiting until the affiliate programs grace us with banning the affiliate and stating it here?

I don't.

Despicable. The whole lot.

(Besides the odd one or two who did take appropriate action.)

Take care online casino industry. I'm out.

[antihacker]

Hi all,

Apologies for not responding earlier, for some reason I stopped getting alerts on posts on GPWA, will fix that now.

We will be in touch with this specific affiliate to find out more details.

If we find that this affiliate (or any other affiliate for that matter) has infringed any of the clauses mentioned under "Terms and Termination" on our T&Cs, we will terminate our agreement.

Thanks,

A new case on which your brand is on too:

warsztatyszczecinek. eu/ ?p=Deuces-wild-video-poker

Obviously http:// warsztatyszczecinek. eu/ has nothing to do with casinos.


http:// ads2.williamhill. com/redirect.aspx?pid=182609514&bid=1487410909&lpid=14 87410763 is the affiliate in this particular one.

Perpetrating site: http:// promocasino. ru/

Could be the same.

[antihacker]

Spoken to Slotocash aff program (Deckmedia) They will ban him tomorrow.

[antihacker]

Folks,

We are now NEARLY one month further. One month.

Results so far? It's simple. Next to NO ONE has banned him, and I've lost just about everything I've worked for. (Do me a favor, read that twice...)

Many many many years of work down the drain. Where I was earning several thousands, I now will have earned a few hundred if I'm lucky this month. I've lost nearly all my websites, a full dedicated server has been COMPLETELY wiped out by someone, (gee I wonder how, and by who) and I'm getting threats left right and center. On top of that, the sites that are still online are getting bad seo links sent by the thousands. I'll lose them too so.

I have to start ALL over again. From scratch. With just a few hundred dollars made this month so far..

How the hell am I going to manage??

Why did this all happen you wonder? Because I stuck my neck out for our 'beloved' industry. And this is my thanks.

Our industry is as polluted as The Citarum - Puke worthy..

I promise this: Once I get back on my feet, I will return! Every single affiliate program and casino that is then still on the hacker's sites WILL be reported to law enforcement.

Seriously. No talking then, no waiting either. I'll boot them all to the FBI, and any other law enforcement that will listen!!

To be very honest: I would love to do that right now, but I need day and night to see if I can improve my own horrible situation.

Maybe people don't see what I mean: I've lost everything over this creep. I don't know HOW to feed my family right now.

But, I shall overcome. And once I do, it is too late for those still condoning the hacker.

Since my situation is so bad right now it will take me a lot of time to recover, meaning y'all have a few months I am afraid.

But, I think no changes will be made even then.

So, if you want to risk it: wait for me. Don't ban him! But, be warned: I'll grab you by the balls with a huge rat trap when I can. Not only will I go for law enforcement, I'll report the crap out of any affiliate business still condoning the hacker when I can, due to not abiding by your own TOS, for condoning theft, criminal activity and whatever more I can come up with. If I find out I can sue, I'll sue.

Bottom line is: You SHOULD NOT be in our business.

I am BEYOND HUGELY disappointed over how this whole thing has gone. Not just because I've been exposed and lost it all, but even more so in the support that has been given by those that COULD have made a difference. Despicable. You should be ashamed of yourselves. Deeply too. (Obviously this goes out to the forum owner here, who is a big boy affiliate himself, big enough to have 'em all listen, but, they pay sponsor money, so he can't say much it seems)

I thank those who did help me trying to get this hacker down.

I will so now and then pop in and see if something is happening or not. I won't have time to do anything else BUT to save my ass, if I still can.

Respectfully, and thanks to those that supported me.

Walter

[antihacker]

Spoken to Slotocash aff program (Deckmedia) They will ban him tomorrow.

Oh, this hasn't happened either..

[dfiocch]

I just say this and then I'll silence ... the not-ban of the affiliate in question is above all a lack of respect towards all the affiliates who do not sleep at night to work on their own sites to try to make them go up in ranking of search engines (all).

Just take a look to SERPS: this guy is dominating SEs for various keywords, high traffic related. This guy is outranking a lot of LEGIT websites. (btw, I see also large issues in Goggggole algorithm... where is the duplicate content penalty? I see this pattern since a lot of months ago...)


At this point: I'm stupid, all other affiliates are stupid.


Crime calls crime? No, thanks... I prefer to leave...

Silence.

[universal4]

I would not be so quick to accuse affiliate programs of not closing an account if they say they have.

First, the affiliate in question might not get the hacked pages updated quickly after he does lose his account.
The affiliate in question might not monitor his email closely and may not know he lost the account for a while.
The affiliate in question might not believe that he can and will lose access to his accounts.
The affiliate in question might have additional accounts at the programs and could switch codes.
The affiliate in question might be contacting the programs pleading his case BEFORE changing the pages or links.

I can think of a number of other scenarios where the links or codes might not get updated as fast as you think they should if in fact he does lose access to his accounts, but I am not ready to claim that what the management of the programs are telling us concerning this individual is false either.

I DO agree that this individual can and should have his accounts frozen/closed/access removed etc.

I also do agree that if a program tells us that it is being dealt with and we find out later it hasn't been, then we have a case against them.

I also agree that the programs that refuse to at least discuss what is going on, is a slap in the face to hard working affiliates and a bit disrespectful, but we should be willing to respectfully and professionally enter into discussions with them, about the problem, instead of making threats or throwing accusations at them.

In some cases, maybe the programs or the rep doesn't quite understand the issue. (I know we have tried to make it understandable, but maybe a few of them aren't getting it)

I think that most of us agree that at least a portion of the traffic this individual is delivering is being generated by less than ethical means, and I think we will get much more positive responses from the programs by stating the case better and by the reduction of accusations and threats.

In addition, I am also a bit confused as to why the pages continue to rank since they are CLEARLY duplicated and should be thrown out just for that simple fact.

Rick
Universal4

[dfiocch]

In addition, I am also a bit confused as to why the pages continue to rank since they are CLEARLY duplicated and should be thrown out just for that simple fact.

Rick
Universal4

Just because "thebigG", since April 2012, is a "broken thing"