I noticed that you are easily one of the most vigilant members of this forum who spots these things at a blazing fast pace.
thanks,
Seen this thread still getting attention and getting bumped, with a few members actually thinking OP will be back. Pretty sure he won't come back.
Last night, I decided to check the site again. I didn't expect clicking the duck logo on the homepage a few times would open the admin panel, so it was kind of a lucky catch. I didn't expect much since it was password protected, but I still decided to enter something and check the API requests, since it's a habit atp because I'm a bug hunter.
And bingo, the username and password were literally sitting there in the API like a gold mine, and ofc... had to check in myself
The first thing I saw in the panel was the user list. They had a whopping 22 users lol, while the site's frontend showed hundreds of people playing lmao.
Apparently, they even had an option to add users to the list, which is odd because I'm pretty sure some of those 22 accounts were made using that generator too. (I still blurred the emails since I don't want to leak anything, just in case any of them were real.)
The second thing I saw was the big-win generator. It literally says "generate big-wins for social proof" loll, and there's even a timer interval option too.
Then comes the games section, and all the games had made 0 in wagers and 0 in profit. There was a slider too to set all the games to 1 RTP, which is funny as well. By default, all the games were set to 80% RTP lmao.
Here comes the cashier section. All the withdrawals were rejected, and one was approved, but the ID provided wasn't a TXID, so I'm pretty sure it was just some sort of test. There was also a pending withdrawal.
I decided to approve it and see what would happen. A pop-up asked me to paste anything into the box to approve it, so I entered a random letter and clicked enter. It got approved loll.
There was a support chat and a partnership inquiry section too, and there were a lot of messages from Bitcointalk members and managers making inquiries on promoting this scam casino . Sorry, I can't show those for obvious privacy reasons.
Lastly, they had the fake lottery draw, where you could press a button and draw the jackpot immediately. The amounts were absurd, like $50–70 million, and the more I clicked on "Execute Draw," the higher the jackpot went lmao.
To sum everything up, they had a fake win generator, fake games, an RTP slider that could be set to anything, all the way down to 1%, a fake user generator, and a fake lottery system. All of this was accessible through an admin panel, with the username and password literally sitting in the API in plain text.
That's literally a scam casino, not even just red flags. Please avoid it.
Before leaving, I deleted every user, disabled all the games, deleted all the blogs, and even removed the partnership inquiries made by Bitcointalk members, since they contained phone numbers and email addresses. I didn't want any bad actor to access that information. Looking back, I thought deleting everything was the best thing to do, but I probably should have handled the data more carefully.
By the next morning, as I'm writing this, they had regained access, removed the password from the API, and re-enabled all the games. Too bad for them, I'd already taken snapshots of everything, with enough evidence to proof them as scam and add a red flag to the casino.
Please avoid signing up or interacting with this casino in any way.
