Carnival Casino? Fiesta Club? What does 32Red have to do with this?

**winbig** · 15th November 2008, 10:50 PM

This one has me stumped...

The email says Carnival Casino, the installer says Carnival Casino, ZoneAlarm says Fiesta Club........."whois" results for that IP come back as being linked to 32Red...

The download defaults to C:\Casino\Carnival Club\ , their website is Carnivalcasino.com.....so, which is it?

It's Playtech, so of course I didn't recognize the installer until later on, but even though they haven't allowed USA players in over 2 years, they still have USA in their sign-up list of countries....

Also, their phone numbers come back with a hit to Giant Vegas...

Read my reply to this to see what I mean about 32Red.................

Delivered-To: xxxxx@gmail.com
Received: by 10.100.216.18 with SMTP id o18cs92137ang;
Sat, 15 Nov 2008 10:38:14 -0800 (PST)
Received: by 10.180.255.1 with SMTP id c1mr593708bki.36.1226774293041;
Sat, 15 Nov 2008 10:38:13 -0800 (PST)
Return-Path: <adannaandarton@gmail.com>
Received: from ayodelehuj (ip-153.net-81-220-113.brest.rev.numericable.fr [81.220.113.153])
by mx.google.com with ESMTP id 28si2384063fkx.1.2008.11.15.10.38.12;
Sat, 15 Nov 2008 10:38:13 -0800 (PST)
Received-SPF: neutral (google.com: 81.220.113.153 is neither permitted nor denied by domain of adannaandarton@gmail.com) client-ip=81.220.113.153;
Authentication-Results: mx.google.com; spf=neutral (google.com: 81.220.113.153 is neither permitted nor denied by domain of adannaandarton@gmail.com) smtp.mail=adannaandarton@gmail.com
From: "Adanna Andarton" <adannaandarton@gmail.com>
To: <beaston@gmail.com>
Subject: =?utf-8?B?W1RpY2tldCBJRCBGaWVzdGFdIFdpbiB0b2RheQ==?=
Date: Sat, 15 Nov 2008 19:38:10 +0100
Message-ID: <001001c94751$4e760410$00000000@ayodelehuj>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_000D_01C94759.B0DD14B0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Office Outlook 11
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198
Status:

This is a multi-part message in MIME format.

------=_NextPart_000_000D_01C94759.B0DD14B0
Content-Type: text/plain;
charset="utf-8"
Content-Transfer-Encoding: 7bit

FIESTA 555! <http://fistourgame.ru>

Join the party with Fiesta Club Casino's fantastic offer: 555, free!

So what must you do to receive this great bonus?

Not very much actually: simply take 5 minutes of your time to open a Fiesta
Club account,

and you will receive a match bonus of at least 100% on each of your first 4
deposits at the casino cashier.

You can use your bonuses on a huge variety of realistic and exciting games,
all designed to give you the best possible online gaming experience.

Click here to join Fiesta Club Casino now!

------=_NextPart_000_000D_01C94759.B0DD14B0
Content-Type: text/html;
charset="utf-8"
Content-Transfer-Encoding: quoted-printable

<html>
<head>
</head>
<body>
<a href=3D"http://fistourgame.ru">FIESTA =
555!</a>
 
Join the party with Fiesta Club Casino's fantastic offer: 555, =
free! 
So what must you do to receive this great bonus? 
Not very much actually: simply take 5 minutes of your time to open a =
Fiesta Club account, 
and you will receive a match bonus of at least 100% on each of your =
first 4 deposits at the casino cashier. 
You can use your bonuses on a huge variety of realistic and exciting =
games, all designed to give you the best possible online gaming =
experience. 
Click here to join Fiesta Club Casino now! 
</body>
</html>
------=_NextPart_000_000D_01C94759.B0DD14B0--

**winbig** · 15th November 2008, 11:07 PM

Ok, so I do a search of that IP listed above from ZA.....

and get the results listed in the first screenshot..... (notice the range of IP's - and the "netname" of RED-PLC)

....then I dig deeper, and click on the "admin contact," which brings us to our second screenshot.....

**winbig** · 15th November 2008, 11:17 PM

Even more confused...lolol

Ok, it seems that this ROGUE OUTFIT cycles through IP's that it uses for their DNS servers when you start the casino, and apparently 32Red is one of those they're using.