BetcoinCasino.com-Betcoin.ag-DICE - 100% Bonus!480 BTC jackpots

[Betcoin.AG]

DAILY DICE FREEROLL TOURNAMENTS at Betcoin Casino

There is no excuse to beg for free btc when you can come win it at Betcoin.ag.  The tournament only lasts an hour and you may not even need to play to win free btc!

1. Betcoin.ag Dice 10 Chip Freeroll - 1 Hour EVERYDAY at 03:00pm ET - For a free buyin you receive 1,000 chips to use on dice. You can bet as little or as much as you want during the duration of the tournament with a cap win per roll of mb100. Prizes will be awarded based on the players with the most chips after the tournament end time. Because we are in beta we are capping this freeroll at 25 max players and you can signup now!

We are working hard to bringing many more innovations and we appreciate your support and are here anytime. Good luck and join us today at www.Betcoin.ag!

https://www.betcoin.ag/tournaments

https://www.betcoin.ag/tournaments

[kpitti]

Today I received mail saying:

kpitti,

We are fixing the cases of unauthorized access to user accounts Betcoin and funds theft.

If you want to protect your account, you need to change password of your Betcoin account and make client update ....

There is a link attached to some url which smell fishy.

Are you Betcoin sending such message?

[Dissonance]

Today I received mail saying:

kpitti,

We are fixing the cases of unauthorized access to user accounts Betcoin and funds theft.

If you want to protect your account, you need to change password of your Betcoin account and make client update ....

There is a link attached to some url which smell fishy.

Are you Betcoin sending such message?

The site is down ...that e-mail sounds very fishy.  They would never ask you to do that.  Can betcoin comment on this?

[nomnomnom]

Also received such a mail, headers also look fishy (terms-google.com?)

Code:

Return-Path: <support@betcoin.ag>
X-Original-To: myemailaddresse@arcor.de
Received: from mail-in-05.arcor-online.net (mail-in-05.arcor-online.net [151.189.21.45])
        by mail-in-16-z2.arcor-online.net (Postfix) with ESMTP id C75112167B2
        for <myemailaddress@arcor.de>; Wed, 13 Jan 2016 18:49:33 +0100 (CET)
Received: from host.terms-google.com (unknown [185.49.68.106])
        by mx.arcor.de (Postfix) with ESMTPS id 3pgbrF1Brvz2xFx
        for <myemailaddress@arcor.de>; Wed, 13 Jan 2016 18:49:33 +0100 (CET)
Received: from user1 by host.terms-google.com with local (Exim 4.72)
        (envelope-from <support@betcoin.ag>)
        id 1aJPY3-0000P4-Hf
        for myemailaddress@arcor.de; Wed, 13 Jan 2016 17:49:31 +0000
To: "myemailaddress@arcor.de" <myemailaddress@arcor.de>
Subject: Important security update.
Date: Wed, 13 Jan 2016 17:49:31 +0000
From: Betcoin <support@betcoin.ag>
Message-ID: <f00d00eb7afcd0cdb023a77497b83e70@185.49.68.106>
X-Priority: 3
MIME-Version: 1.0
Content-Type: multipart/alternative;
        boundary="b1_f00d00eb7afcd0cdb023a77497b83e70"
Content-Transfer-Encoding: 8bit
X-Arcor-Antispam:  SPF_NONE RECEIVED_FROM_UNKNOWN URL_IN_DBL  HTML_CLOAKED_SPAM
X-ArcorSpamBlocker: Spamcount: 10 Sensitivity: 13

the text version links to https://www.betcoin.ag/auupdate?token=...
but in the html version it links to: http://141.105.69.206/dn/?e=... (that ip is from russia  )

[Pony789]

The site is down ...

Their poker is down but I have no problem loading betcoin.ag at this moment. Are you still unable to access the site now?

[Dissonance]

The site is down ...

Their poker is down but I have no problem loading betcoin.ag at this moment. Are you still unable to access the site now?

Correct its only poker.

[TwitchySeal]

Also received such a mail, headers also look fishy (terms-google.com?)

If it wasn't betcoin, they did a good job immitating Betcoin Jessicas writing style.


Example:

In an attempt to be more responsive, yet still keep customer support inquires at the site www.betcoin.ag/support we are wondering if this is a complaint or how to respond here?  Should we not have thank a poster after a certain time period?  May we point out that you are commenting on a post from over 2 months ago as well.

Email:

We are fixing the cases of unauthorized access to user accounts Betcoin and funds theft.

If you want to protect your account, you need to change password of your Betcoin account and make client update ....

[DarkDays]

Today I received mail saying:

kpitti,

We are fixing the cases of unauthorized access to user accounts Betcoin and funds theft.

If you want to protect your account, you need to change password of your Betcoin account and make client update ....

There is a link attached to some url which smell fishy.

Are you Betcoin sending such message?

The site is down ...that e-mail sounds very fishy.  They would never ask you to do that.  Can betcoin comment on this?

Support is saying in their on-site chat box that those emails aren't from them and contain a virus and you shouldn't open it.

No answer yet as to why they aren't contacting players themselves to warn them or how someone was able to access their email list to scam their players.

[crazywack]

I always wait for the site to prompt me to change something not emails.

[DuddlyDoRight]

Today I received mail saying:

kpitti,

We are fixing the cases of unauthorized access to user accounts Betcoin and funds theft.

If you want to protect your account, you need to change password of your Betcoin account and make client update ....

There is a link attached to some url which smell fishy.

Are you Betcoin sending such message?

The site is down ...that e-mail sounds very fishy.  They would never ask you to do that.  Can betcoin comment on this?

Support is saying in their on-site chat box that those emails aren't from them and contain a virus and you shouldn't open it.

No answer yet as to why they aren't contacting players themselves to warn them or how someone was able to access their email list to scam their players.

Maybe you and the other technical wizards here didn't notice.. Those emails have your username in them which means whoever sent them has not only access to your username, but your email address.. Both unencrypted in betcoin.ag user database table..

All those backlinks go to
hxxp://141.105.69.206/dn/?e=[base64 string was here] which is the betcoin.ag server IP. Why would attackers/phishers put nothing but links to the official site in the email? Then.. if the site isn't hacked how do they have every single users email and username which, by the way, are stored with all your other data like encrypted password and likely BTC keys.

Either way betcoin.ag has been hacked. You and whoever represents the site have overwhelming technical evidence against you, so please do try and argue..

[Shogen]

I have no idea if the email is legit and if betcoin was hacked, but a good habit is to never click a link in email no matter what. If you want to change your password, you could simply go to betcoin as usual and log in to change it without clicking the link (be it legit or not).

[DuddlyDoRight]

Again.. They have the usernames and emails of every user.. How is this hard to understand? You can't even scrape that data off pages it's only in a internal DB table.. Are people here retarded or something? It's hacked..

By the way I just confirmed my account data there has been modified. Even more solid evidence it's been hacked..

[TwitchySeal]

Today I received mail saying:

kpitti,

We are fixing the cases of unauthorized access to user accounts Betcoin and funds theft.

If you want to protect your account, you need to change password of your Betcoin account and make client update ....

There is a link attached to some url which smell fishy.

Are you Betcoin sending such message?

The site is down ...that e-mail sounds very fishy.  They would never ask you to do that.  Can betcoin comment on this?

Support is saying in their on-site chat box that those emails aren't from them and contain a virus and you shouldn't open it.

No answer yet as to why they aren't contacting players themselves to warn them or how someone was able to access their email list to scam their players.

Maybe you and the other technical wizards here didn't notice.. Those emails have your username in them which means whoever sent them has not only access to your username, but your email address.. Both unencrypted in betcoin.ag user database table..

All those backlinks go to
hxxp://141.105.69.206/dn/?e=[base64 string was here] which is the betcoin.ag server IP. Why would attackers/phishers put nothing but links to the official site in the email? Then.. if the site isn't hacked how do they have every single users email and username which, by the way, are stored with all your other data like encrypted password and likely BTC keys.

Either way betcoin.ag has been hacked. You and whoever represents the site have overwhelming evidence against you, so please do try and argue..

What they tell us/admit will be 100% based on whatever they think they can get most to believe - not the truth.
They will throw a hundred dollars worth of chips out to help bury the issue with pro-betcoin comments.

The Password Change/FreeRoll announcement last week must be related right?

https://www.betcoin.ag/mandatory-password-reset-upcoming-5-btc-players-club-freeroll

Mandatory Password Reset & Upcoming 5 BTC Players Club Freeroll

For the new year, with a new update starting on December 30, 2015, Betcoin.ag is requiring you to change your password since we got hacked for your security and to properly sync you with the new backend system.


Betcoin is excited to present the Betcoin Poker Players Club 5 BTC New Years Freeroll on January 10, 2016. This is a ticket only event and all players with Bronze I level or higher VIP / Player's Club status will receive a ticket by January 8, 2016. Players that have been active on Betcoin may also receive a ticket at the managers sole discretion.

https://www.betcoin.ag/betcoin-poker-players-club-vip-5-btc-new-years-fr...

Password Change
For the new year, with a new update starting on December 30, 2015, Betcoin.ag is requiring you to change your password for your security and to properly sync you with the new backend system. Please us a password that is not your current or previous password at Betcoin.ag for the utmost security.


Poker
In addition to the 5 BTC Freeroll, Betcoin Poker offers up to 150% rakeback for starting cash and ring game tables as well as tournaments with up to $1,000,000 worth of bitcoin in GTD prizepools. There is no better place to play poker.

Sportsbook
We will continue to bring you the best prematch and thousands of live events every month to Betcoin Sports including an extended eSports section and many new promotions.

Casino
We have expanded our mobile casino, live and regular casino offerings and will continue to add new providers throughout 2016. Please also be sure to checkout our dice tournaments which include a daily freeroll.

It has been an exciting year for Betcoin.ag and we look forward to providing a wonderful experience in 2016 and beyond. As always, we appreciate your feedback and thank you for your support. Good luck in the 5 BTC Freeroll!

[DuddlyDoRight]

What is in the zip the emails have, that again are coming from the official server with data in them only in the internal database:

"Theft Stead Psos Personal 50"
"RasterVect Software Copyright 2006"
"8.5.4.3"
"PasifikaRecalculate"
FILE:betcoinpoker_com.exe
SIZE:528,384 bytes
CRC32:BFBB2B80
MD5:5B6CD128C1DFBEF6F872CB12B337BB22
ANALYSIS:
https://anubis.iseclab.org/?action=result&task_id=117f2e096ffb38a54a9fcb9332b9791e0
https://www.virustotal.com/en/file/141f1ce1c714efa94f738529ce9a6f56544ac4904864d72bfa8b62b90c662b0a/analysis/

It does nothing under VM and sandbox so it's likely malware. I'm not going to reverse engineer the binary to show it's malware.

[sbrzol]

Today I received mail saying:

kpitti,

We are fixing the cases of unauthorized access to user accounts Betcoin and funds theft.

If you want to protect your account, you need to change password of your Betcoin account and make client update ....

There is a link attached to some url which smell fishy.

Are you Betcoin sending such message?

I also got this email 2 times yesterday (19, 22 hours ago)

So I agree we can say that betcoin has been hacked.

But i stopped playing at betcoin more than 3-5 months.  (Aftert betcoin became a pinnacle clone with lower margin.  )

[dooglus]

I'm a day late to this, but I received the same:



The link goes to hxxp://141.105.69.206/dn/?e=V2tjNWRsb3llREZqTUVKdVlsZEdjR0pETldwaU1qQTk=

It's a Russian IP address:

inetnum:        141.105.64.0 - 141.105.71.255
netname:        RU-HOSTKEY-20110627
descr:          Mir Telematiki Ltd
country:        RU
org:            ORG-MTL21-RIPE
admin-c:        PC7356-RIPE
tech-c:         PC7356-RIPE
tech-c:         PC7356-RIPE
status:         ALLOCATED PA
mnt-by:         RIPE-NCC-HM-MNT
mnt-lower:      MTLM-MNT
mnt-routes:     MTLM-MNT
remarks:        abuse-mailbox: abuse@hostkey.com
created:        2011-06-27T08:53:56Z
last-modified:  2011-08-01T14:53:33Z
source:         RIPE # Filtered

organisation:   ORG-MTL21-RIPE
org-name:       Mir Telematiki Ltd
org-type:       LIR
address:        Lva Tolstogo, 19/2
address:        119021
address:        Moscow
address:        RUSSIAN FEDERATION
phone:          +74953699796
fax-no:         +74953699796
mnt-ref:        MTLM-MNT
mnt-ref:        RIPE-NCC-HM-MNT
mnt-by:         RIPE-NCC-HM-MNT
abuse-mailbox:  abuse@hostkey.ru
abuse-c:        HA2800-RIPE
created:        2010-10-06T10:46:46Z
last-modified:  2015-12-25T05:46:40Z
source:         RIPE # Filtered

person:         Peter Chayanov
address:        Moscow, Russia
phone:          +7 495 369 97 96
nic-hdl:        PC7356-RIPE
mnt-by:         MTLM-MNT
abuse-mailbox:  abuse@hostkey.ru
created:        2008-10-19T20:57:02Z
last-modified:  2015-12-25T05:44:46Z
source:         RIPE # Filtered

The link goes to a Windows executable which contains malware:



Someone scanned the same binary yesterday with virustotal, and only 2 antiviruses detected anything:



Repeating the scan today shows that many more antiviruses now recognise the malware, suggesting it's some new variant:



Edit: a betcoin customer helpfully posted a couple of links to articles about this on the site:

Due to recent phishing emails which look nearly identical to authentic support emails please visit this page for more info and stay safe:

https://www.betcoin.ag/increased-email-security-email-verification-code-betcoinag

https://www.betcoin.ag/phishing-attempt-warning-do-not-open-link-e-mail

I wonder why there are no official warnings from the site on this thread.

Also, what happened? How did 'they' get everyone's account name and email address? Were funds stolen?

[kpitti]

Today I received mail saying:

kpitti,

We are fixing the cases of unauthorized access to user accounts Betcoin and funds theft.

If you want to protect your account, you need to change password of your Betcoin account and make client update ....

There is a link attached to some url which smell fishy.

Are you Betcoin sending such message?

Can someone from Betcoin comment and explain what happen?
Was site hacked? As we seen that our email and userid were compromised.
What was/will be done to improve Betcoin?

I was't playing there for a long time. I did not lost any btc there. I did not open any link or attachment from mail I received. There is any harm of myself.

[Humbertin19_]

I try play the best casino voted!

[DuddlyDoRight]

Russian hackers dumped their database tables..

Irony: I developed and own a casino too and mentioned here weeks ago how I get Russians trying to hack my back-end all the time. They do it with big-name fiat online casinos too. It's almost always China, Western Europe, or Russians.

Mine is binary socket servers and SQL Lite behind layers of network filters..

[Betcoin.AG]

Increased Email Security With Email Verification Code at Betcoin.ag

In order to increase our player security and prevent against phishing attempts and unauthorized messages going to players we have instituted an Email verification system.

https://www.betcoin.ag/increased-email-security-email-verification-code-betcoinag

To ensure that emails received to your email address are sent from Betcoin.ag and not an impersonator we include an email security code with every email that is sent to you. This security code is unique to your account. You can verify the authenticity of any email from us by pasting the security code in the following textarea here:

https://www.betcoin.ag/mail_security_verify

or clicking the verify button directly from your email. If your email does not have a security code or it is unable to be verified here DO NOT PROCEED FURTHER WITH THE EMAIL. Please contact us if you have any questions.

At the bottom of each email you will have the following unique verification code:



You must be logged into Betcoin.ag to verify the email and clicking the link will take you to the email verification page. The message give will be the code matches and the email is legitimate if the email was sent out from Betcoin.ag

We remind you that Betcoin.ag will never ask for your password or ask you to download any link direct from an email at anytime nor ask you to login to a page that isn't directly at www.betcoin.ag. As we continue to increase in size, unscrupulous people will try to game, scam, steal and do whatever they can, but we remain committed to providing you exceptional service and security and we are here for you anytime.