URGENT: ALL Affiliate programs: BAN VERIFIEDCASINOS.COM For Serious Hacking! (proof)

[Triple7]

Anthony thank you for replying. Are there any programs that have not cooperated? I'm interested in knowing this as I'm sure others are also.

Yep. I would like too if there are programs that didn't even try to act like they cooperate....

[GCG]

Michael has asked me to gather the various tracking links and to contact the sponsor programs and make recommendations if any should be removed for not cooperating. I have submitted several affiliate accounts to programs and have had those accounts closed. Currently the hacker(s) have dozens of accounts for each brand and the task of identifying and closing is a time consuming process that is difficult to show progress when several new accounts appear after one is terminated or link redirected. I am in the process of putting together a list of affiliate accounts that have been closed. To show the accounts that have been affected through my efforts. There has been cooperation from the sponsor programs, but it does not stop the cycle.

Once I finish this next round I will update each account and program interaction. I should have outlined everything here, as it was going on instead of waiting till there was a noticeable change to the sites. Will have more soon.

Thanks for the update.

The hackers can not have 10-100s valid payment options/accounts so this is where to look for not the names etc specifically.

In other words the money flow needs to be examined.

[Triple7]

Thanks for the update.

The hackers can not have 10-100s valid payment options/accounts so this is where to look for not the names etc specifically.

In other words the money flow needs to be examined.

Exactly. It's also typical that always the same brands do appear when this sort of things are happening...

[GCG]

There is no excuse for working with hackers and it is NOT a daunting task to find the criminals when examining the money flow.

[iGamingWriter]

I think an important question has to be asked - has anyone actually seen any of the programs that we're now talking about listed with a link that redirects to dead space? If not I'm afraid the evidence doesn't support these programs cooperating in the enthusiastic way they're presenting to Anthony.

Looking at AffEdge and Ace Revenue, when they redirected it was immediately apparent as the pages I highlighted one day weren't loading the next. I've had a quick look and I don't see a single one of the programs that I've mentioned in the past redirecting in the way that both AE and AR managed.

I'm sorry to be a negative Nancy, but until I see examples of links actually redirecting I simply don't accept that these programs have done anything other than feed the lines that we've been demanding for months.

I'll be frank and say I also find it very concerning that none of these programs have a rep stepping forward to ensure this issue is getting dealt with and questions are answered. Given the supposedly fast moving pace of this group of hackers, surely a proactive response that takes into account the feedback of the community would have allowed for a far faster response? I can't think of any faster or more cost effective way of gathering information than to utilise a large and engaged community who have their own reasons for helping.

Unless the idea is not to respond quickly.......(9 months and counting)

[Anthony]

As far as the GPWA sponsor programs all have responded and taken action (some faster than others). Seeing that they have done something is difficult. For example, Winner Affiliates just terminated an affiliate account and had the hacker remove the listing from a hacked site http://ammobank.com/log/system/winst...use-rules.html
but there are a several other accounts now on dozen of other sites and the perception is winner is not responding since they are on hacked sites even though they have closed multiple accounts and have the listings removed. I have tried to suggest a way for affiliate programs to identify the various accounts, like matching the hackers payment information with new accounts, but the hacker is not listing payment info on the new accounts and it seems he is savvy enough to make them different enough that they don't get easily identified. Incorporating a redirect worked one time for Affiliate Edge, but Ace Revenue did a redirect and he opened additional accounts before stopping. The hacker has some programs he prefers because no matter how many accounts get closed he keeps opening new ones and some he will only open 3 or 4 additional accounts.

For the non-sponsor programs, the ones that I would put in the non-cooperated camp are AffPower and 888. There has been a long back and forth with AffPower, they finally agreed to have the hacker removed listings from hacked sites if we send them a list of the various hacked sites, we will see if it happens. 888 recognizes the problem, doesn't like that it has caused issues for them and has gotten complaints from several affiliates, but has not taken any action that I have seen. I have not followed back up with them, since now I am focusing on the GPWA sponsors that are still being promoted.

[GCG]

I have tried to suggest a way for affiliate programs to identify the various accounts, like matching the hackers payment information with new accounts, but the hacker is not listing payment info on the new accounts and it seems he is savvy enough to make them different enough that they don't get easily identified. he hacker has some programs he prefers because no matter how many accounts get closed he keeps opening new ones and some he will only open 3 or 4 additional accounts.

888 recognizes the problem, doesn't like that it has caused issues for them and has gotten complaints from several affiliates, but has not taken any action that I have seen. I have not followed back up with them, since now I am focusing on the GPWA sponsors that are still being promoted.

Thanks Anthony for this update. However forgive me the liberty to post some remarks as I find the "unability" to identify the hackers account very questionable.

• how many NEW affiliate accounts are we talking about these days 10-100 a month? how much time will it cost 1 hour tops?
• If there is no payment information listed the account should not be approved in the first place. When signing up this field should be mandatory, any changes to be manually approved by the affiliate manager.
• this hacker has not even a website : The affiliate manager could ask : show me where you are going to promote us.....
• the casinos that are on the hackers pages will be remembered as a bad memory for players / affiliates, it will not help your reputation to say the least.

Affiliate Edge does not want to identify themselves with criminals and are vastly determined not accept any affiliate involved in cybercrime as Buffalo partners does not really care, Affiliate Edge value their business ethics and their partners who work with them. This is not the case with Buffalo partners, 888 and some others as they could care less to break the law.

[Triple7]

Thanks for the update. Good to hear that things are moving. I don't doubt on the good will of GPWA, but I do doubt on some affiliate programs. I mean: "the hacker has some favourite programs" is quite an understatement. Those programs are his favourites for something. Another understatement is that it are not the best casino's we know. This are casinos that also always appear if it's about problems with affiliates, problems with players, not paying winners, etc. Let's say that he's got a certain type of casino's on his website.

I don't think this are his favourite programs because he considers this the best casino's or it are the best converting brands. I think this casino's are just not making things too difficult for him.

[iGamingWriter]

I got to agree with GCG here - if you're suggesting strategies that could help with the prevention of the registration of new accounts and these groups are not taking this advice on board then they're not doing everything that they could to disassociate themselves with this individual.

There's also a complete failing in the logic being used when considering the financial information the hacker is or is not providing. I don't think anyone here would accept that this is still going on after 9 months if the hacker/s have never received payments from these "preferred" programs. They wouldn't keep going back to these programs if they weren't getting some money out. Therefore there must have been some accounts where valid payment information has been provided to receive payment.

The bottom line is these accounts should have been identified before payment was made and as I've been saying for months, if there are programs that are not catching these accounts that's a failure in their verification procedures rather than a valid excuse for continuing to turn up. Any credible operation would have by this stage acknowledged failings in their procedures and invested time and resources in finding solutions. Instead we have operators pitching what can best be described as sob stories as justification for their failure to get on top of this issue. Even if they are struggling to stop the hacker, this situation makes them look guilty.

[Anthony]

I agree, it would be tremendous for the programs to identify these accounts themselves instead of having to provide them each with a tracking link and a hacked site for them to review. I would think the affiliate programs should be able to make some association based on the accounts they know were being used, but the program would know exactly what data they have to work from and what would be the best method for that identification. I don't know what URL is listed for the hacker's site or payment info. I also thought payment method would be a quick way to associate the accounts and when I inquired about it I heard from multiple programs that the accounts in question did not have payment information filled out.

I have gone back to GPWA programs that said they have terminated accounts and asked them to send the links to a blank page. I will post what programs say they are unable to do that.

Note, Buffalo Partners reps will be out of the office until 26 May, so I will not have a quick reply from them.

[iGamingWriter]

I agree, it would be tremendous for the programs to identify these accounts themselves instead of having to provide them each with a tracking link and a hacked site for them to review. I would think the affiliate programs should be able to make some association based on the accounts they know were being used, but the program would know exactly what data they have to work from and what would be the best method for that identification. I don't know what URL is listed for the hacker's site or payment info. I also thought payment method would be a quick way to associate the accounts and when I inquired about it I heard from multiple programs that the accounts in question did not have payment information filled out.

Honestly Anthony, you sound as sceptical as me.

Ultimately there has to be money flowing to this otherwise even the most determined prankster would have thrown in the towel by now. Reading between the lines the involved programs don't want to admit this. Whether this is due to complicity or simply concern about implicating themselves (they have paid a criminal) isn't really possible to distinguish. When they fail to pursue every available option to prevent future occurrences that certainly gives the impression of complicity.

Personally I think payment method is a reasonable way of identifying accounts. I also strongly believe that decent verification processes are the best method of catching this group - there's a reason why they've stopped targeting some programs and it's not just personal preference. I also think that if these programs where actually interested in stopping this it would be relatively straight forward to get a good number of members here on board to help them out in identifying new sites as we go about our day to day roles. This would have the added benefit of making them look proactive. Instead we have a very negative situation that month after month is coming back to damage the same brands.

[Triple7]

We all know 888 and AffPowers are not transferring 10 bucks a month to this hacker... If it's about huge amounts of money and so huge amounts of traffic, they should have an idea where it's coming from. If it's about not paying players, many brands that appear on the websites have to most advanced methodes and tools to find players than didn't comply their terms & conditions.

Also in my opinion programs had more than sufficient time to take action. Others succeeded to not appear anymore on this hacked websites. I don't think they do not appear anymore because the hacker didn't get a good revenue deal of the brand wasn't converting well. So, it's not impossible to no appear on those websites anymore.

Also I think if you should make a bingo card for this kind of situations the brands that appear on the sites, would be on many people's bingo card.

I think they will just continue with their windowdressing and they will remain on that websites.

[GCG]

If these groups state they can not find the hackers by the money flow they are basically do not want to cooperate as in accounting it is really easy to find amounts paid to suspicious bank accounts / e-wallets and what have you.

Skip the small affiliates with pennies in their accounts and voila you have to investigate just a few NEW accounts.

[TheGooner]

Skip the small affiliates with pennies in their accounts and voila you have to investigate just a few NEW accounts.

I think that this is the simplest solution ... and very workable.
It's a one-step solution.

STEP ONE : Got a new account that suddenly appears or jumps from zero to 100's of registrations?
Investigate it !!

How hard is that? It's not going to be a time-killer.

FFS - I would expect AM's that suddenly get a good performing affiliate account appear would be contacting them anyway to provide encouragement, specialised help, and site specific promotions.

Check the declared website,
Check the payment information,
Check the front man.

Squash the money-flow from a program to the hacker-group ... and the hacker-group will move to the scummy programs.

[Triple7]

hxttp://www.zugaroni.it/casino-org/
hxttp://theohiocountynews.com/csn/casino-org-pokerstars.html

I dont see affpower anymore. I still see 888, Winner and a new one... Klaver Casino.

[Anthony]

Thanks for the update.

Just because AffPower is off those sites doesn't mean they are off them all.

As far as 888, I don't see them taking any action soon, they sent this message out to affiliates, but won't stop the hacker:

Dear marketing affiliate,

It has recently come to our attention that certain marketing affiliates have been carrying out marketing campaigns which are not compliant with British Privacy and Electronic Communications Regulations, as well as our agreed upon contract. Some of these campaigns have included use of spam emails and text messages as means of advertisement.

You are hereby reminded that you are obligated to be compliant with advertising laws and regulations in the jurisdiction where you are operating, as you are the one carrying out the marketing activity.

We also wish remind you that you are to identify yourselves in your advertising material, and not present yourself as 888.

Finally, please note that if you are found to be in breach of your contract with 888, 888 will reserve the right to seek any remedy available to it existing under contract, at law, in equity, or otherwise.

I will contact Winner regarding these two sites.

A couple updates:

I heard back from Best Pay Partners that closed the affiliate accounts I showed them and they are looking into redirecting the links. They also let me know that the accounts were through a network and not directly through them, they feel they have removed all of the direct accounts.

I heard back from Buffalo Partners, they have terminated the affiliate account and are looking into disabling the links, will update when they get back to me after consulting with their IT department.

I heard back from AffActive, they had the affiliate remove their listings but did not address the link redirect, I sent them a follow up.

[iGamingWriter]

I'm still seeing AffPower on every hacked site I come across. See hxxp://nl-kyokushin.co.uk/government_on/deposit/no-deposit-bonus-microgaming-casinos-2015.html

Aff tags;

hxxp://www.cosmicasinomarketing.com/templates/shine/?aff=5515&lang=en&utm_source=a_3659b_1074c_&utm_me dium=LandingPage&utm_campaign=150per-5515-17
hxxp://www.deuceclubmarketing.com/templates/sliders/?aff=5515&lang=en&utm_source=a_3659b_1074c_&utm_me dium=LandingPage&utm_campaign=150per-5515-17

On a side note, I am noticing significantly less of these hacked sites in the rankings than previously. I don't know if the exploit being used is becoming more difficult to find or programs are actually starting to make this less worthwhile, though I would suggest that the same programs are still turning up consistently so the second option looks unlikely.

[iGamingWriter]

Here's another two sites;

hxxp://www.milanox.eu/84-highest-payout-microgaming-casino.html
hxxp://ferryvanleeuwen.nl/891-best-microgaming-casino.html

Same aff tags on both those sites;

hxxp://www.osiriscasinomarketing.com/templates/shine2/?aff=8888&lang=en&utm_source=a_5013b_1540c_&utm_me dium=LandingPage&utm_campaign=300per-8888-17
hxxp://www.cosmicasinomarketing.com/templates/shine/?aff=8888&lang=en&utm_source=a_5013b_1061c_&utm_me dium=LandingPage&utm_campaign=150per-8888-17

[dfiocch]

Is bad to say but... this guy has a lot of skills in programming/coding...

What I mean: just go to the link provided by ThePogg

hxxp://nl-kyokushin.co.uk/government_on/deposit/no-deposit-bonus-microgaming-casinos-2015.html

Open it in a new window/panel. Let the page load in full.
Then, press the "back button" of your browser.

You will be redirected here:

hxxp://orangedisaster.net/it/google.html

or

hxxp://potatoeaters.net/it/google.html

(it folder in my case)



Google fake pages, with many outgoing links.
Every link is in this format:

hxxp://orangedisaster.net/it/parisvegascasino
hxxp://orangedisaster.net/it/deucecasino

etc...

This guy is not only a simple affiliate... no no no...

[CasinoPlusBonus]

Hi,

as thePogg exlpained in detail, it is very simple and easy to block this whole thing via payment. You just do not pay out incriminated accounts each time you find out that traffic comes from black hat or non legit activity (and the affiliate IDs are really easy to get). You do not pay the hacker one, twice and a third time and the whole story is over.

But the issue is a totally different one. Everyone that has some personal contacts in the industry will find out... that the casinos ALL know who those hackers are and which affiliate manager deals with them (or at least they have the contact details) and which affiliate accounts they use.

We all know that there is already more than one active hacker. And we all know that those hackers are not kiddies from high school. This is serious, industrial stuff.

And we all know that the casinos would get the same traffic from normal affiliates as well.

Every click on a hacked site is a click stolen from a proper affiliate. So why do casinos bother with this **** at all?
Does this hack really bring significant traffic?

I have the following hypothesis

1) either the hackers are asking dumping prices and working on low revenue share or cpa so that they are much cheaper than normal affiliates.

2) or the hackers have negotiation power, meaning they are running also big normal affiliate sites. So some casinos cannot afford to loose the entire traffic

I have no other explanation for casinos engaging in criminal activity, which this hack simply is.

I mean, do those casinos not risk their license at a certain point? Perhaps gpwa should make an offical letter to the licensing authorites?

I could immagine that the LGA Malta would be thrilled to hear that their licensees are supporting a wordwide hacking scam...