| abstract
| - Casino sites are difficult to categorize: A spamvertised brand may be on a single IP or on a fast flux botnet; it may be spammed as short-lived "throwaway" domains that redirect to the target site, or the throwaway domain may load the target domain in an iframe. Spam may arrive in consistent bunches that would suggest the same mailer is responsible for all, yet promote sites with different brands and different behaviors. There are probably several competing casino operations whose affiliates do not deal exclusively with a single sponsoring casino. All spam casino sites require the player to be gullible enough to download software onto his/her own computer to play the games. Such programs are identified as adware or malware by various antivirus programs, though it is difficult to tell how malicious they may be nor to know if actually playing the games will download additional executable programs onto the computer. Some sites will attempt to download the software automatically by reloading themselves. Others require a click, but will download no matter what the user clicks, even the "about us" links. Others won't download at all unless the user enables javascript for the entire site, a risky move. Site visitors who have java enabled by default or who are using browsers like Internet Explorer that permit ActiveX controls may not witness this behavior -- because the software is being automatically downloaded and installed without permission from the user. Many gambling casinos run on an illegally hijacked fast-flux set of botnet machines. The casino botnet being used in early 2008 was primarily located in the US, Romania, and Argentina. There were seats for 24 round robin addresses at a time with a refresh every 5 minutes, though fewer than 24 IP addresses were actually filled. Legitimate sites which are barely within the law, like offshore casinos, often will have multiple servers due to the risk of Distributed Denial of Service attacks (DDoS). However, it was unlikely these sites were being hosted legitimately, since some of the host ISPs were cable/DSL providers in the U.S., where online gambling is illegal. Any gambling casino that requires you to provide your identity and credit card information is suspect. It is not uncommon to find that identities and the corresponding credit card information will later be offered for sale on the "carder" black market. Victims will find their credit card being abused perhaps some months after they expose it to the criminals who run these bogus gambling casinos. A sure sign that a gambling casino is illegal is when it is spammed using the redirection method. The link in the spam does not go directly to the site, but it first goes to an intermediate site. Another common sign is when the link to the site resides on a free hosting service, such as LiveJournal.com. Example of an incompletely-filled 24-seat botnet: Casino La Scala, April 2008 Name: FIRSTPRIMEGAME.NET Addresses: 194.213.6.245 79.118.207.6 195.189.153.155 79.118.207.6 79.118.207.6 79.118.207.6 84.232.162.13 76.105.29.90 79.118.207.6 79.114.155.59 5.204.84.20 89.35.172.188 79.114.155.59 79.118.207.6 79.118.207.6 79.118.207.6 79.118.207.6 195.189.153.155 78.139.149.132 89.35.172.188 86.105.132.74 79.119.140.4 194.213.6.245 194.213.6.245
|
![[RDF Data]](/fct/images/sw-rdf-blue.png)