Vegas Slot Casino spamming?

[Dangerous53]

Received spam today that leads to Vegas Slot Casino, (accredited, Mini Vegas Group) it's a redirect through tre.emv3.com, and it lands at www2.vegasslotcasino.com/ but oddly enough there is no affiliate ID attached to the url. Is there another way of tracking redirects I don't know about?

Clicking reply sends me to supportATvegasslotcasino.com, but all links in the mail are redirects through tre.emv3.com. A whois of the originating IP resolves to Emailvision and a further search turned up numerous reports of spam from the sites associated with tre.emv3.com, leading to other MVG casinos.

emv3.com is a domain controlled by four nameservers at ns.emailvision.net. Some of them are on the same IP network. Incoming mail for emv3.com is handled by two mailservers at emv3.com themselves. They are on the same IP network. emv3.com has one IP number , but the reverse is www.emailvision.com. emv6.net and emv3.net point to the same IP and also shares both nameservers and mailservers. emv8.com, emv4.com, emv4.net, emv8.net, emv1.com and at least five other hosts point to the same IP and also shares nameservers. emv7.net, ccemails.net, cccampaigns.net and ccmdcampaigns.net point to the same IP and also shares mailservers. nmp6.com, emv5.com, emv5.net, emv2.net, nmp1.net and at least 31 other hosts point to the same IP. news.192.com and news.getgo.de share both nameservers and mailservers with this domain. emv5.com, emv7.com, emv9.net, emv2.com, emv2.net and at least 17 other hosts share nameservers with this domain. privats.net, dby.emv3.com, ccmdemail.net, dnse1.emv3.com, savourclub.net and at least 46 other hosts share mailservers with this domain. gw.emv3.com, ase.emv3.com, tre.emv3.com, fse.emv3.com, lb2.emv3.com and at least 39 other hosts are subdomains to this hostname. emv3.com is ranked #6164 world wide and is hosted on a server in France.

The lack of an affiliate ID leads me to believe this campaign is being run by the casino itself, or someone hired to do it for them. Nobody spams for free do they? Perhaps the forum rep would like to shed some light on this.

They did have my full name and email address, and I have never signed up at any Mini Vegas Group casino that I can remember.

[vinylweatherman]

Received spam today that leads to Vegas Slot Casino, (accredited, Mini Vegas Group) it's a redirect through tre.emv3.com, and it lands at www2.vegasslotcasino.com/ but oddly enough there is no affiliate ID attached to the url. Is there another way of tracking redirects I don't know about?

Clicking reply sends me to supportATvegasslotcasino.com, but all links in the mail are redirects through tre.emv3.com. A whois of the originating IP resolves to Emailvision and a further search turned up numerous reports of spam from the sites associated with tre.emv3.com, leading to other MVG casinos.



The lack of an affiliate ID leads me to believe this campaign is being run by the casino itself, or someone hired to do it for them. Nobody spams for free do they? Perhaps the forum rep would like to shed some light on this.

They did have my full name and email address, and I have never signed up at any Mini Vegas Group casino that I can remember.

Some affiliates are getting clever by disguising their tags. They know that if the tag can be extracted from a spam, the casino affiliate scheme knows who is responsible when a complaint is made.

There are "other ways" of extracting the affiliate tag though, even if it is cloaked in the spam itself. Using a redirect site means the tag does not have to be present in the spam link itself, but can be added by the redirect site before forwarding to the casino site itself.

The "other way" can also detect whether there is an affiliate tag in the first place, and if there is none, then it IS a marketing push bought directly by the casino itself, so the casino can reasonably be held responsible by contracting the work out to a spammer.

[Dangerous53]

I know they use redirects so you can't actually see the AffId in the email, but usually the ID shows up in the url when you land at the casino's site. When these redirect links were clicked, they landed at Vegas Slot with no AffId on the end of the url, just the parent site address, www2.vegasslotcasino.com/. Is it possible it's redirecting through another site that's registering the AffId, then forwarding to the site without an ID?

[vinylweatherman]

I know they use redirects so you can't actually see the AffId in the email, but usually the ID shows up in the url when you land at the casino's site. When these redirect links were clicked, they landed at Vegas Slot with no AffId on the end of the url, just the parent site address, www2.vegasslotcasino.com/. Is it possible it's redirecting through another site that's registering the AffId, then forwarding to the site without an ID?

I believe the Affid is stored in a cookie in your browser, normally, this would be done by the casino site itself, but maybe the redirect site drops the cookie, and then removes the tag from the URL. The tag would still be picked up by the installer, and stored in the registry, which is where you will find it

[Dangerous53]

Ah, like this reg entry under HKCU/Software/MGS/Thumper/Casino/vegasslot?

cookie REG_SZ 446_210_312_113_563

[vinylweatherman]

Ah, like this reg entry under HKCU/Software/MGS/Thumper/Casino/vegasslot?

Yes, but that doesn't look like an affiliate tag. It would take an affiliate for this group to confirm whether this is the format, but I doubt it.

This looks like it was not tracked to an affiliate, so maybe this IS a direct marketing buy by the casino, who have tasked the company to send the mailer to it's mailing lists. If you have not subscribed to these lists, this is indeed spamming.