Earlier this week CL forum member Panders became suspicious of Winnermillion Casino, asking why they would request your credit card CVV number when you make a withdrawal.
Looking into the casino, our own CL-Ed noticed that the site is using knockoff Net Entertainment games. We know this because the games are served from a fraudulent domain, casinomodulle.com, which is very similar to the original used by the legitimate Swedish company, casinomodule.com (note the double LL in the fraudulent domain). The casino still offers games such as South Park, which has been discontinued by Net Entertainment for the last six months, along with others that are currently still on Net Ent's roster. This makes Winnermillion a terrible choice in and of itself, but the black marks kept on coming as the investigation continued.
CL-Ed looked up the fraudulent domain's registry information and found that it is registered out of Russia. Running a casino out of Russia is always suspicious, as many of the sites using pirated games hail from the region. The domain's WHOIS information is as follows:
Domain Name: CASINOMODULLE.COM
Registry Domain ID: 2027139114_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.reg.com
Registrar URL: http: // www . reg . ru
Updated Date: 2017-04-03T12:11:29Z
Creation Date: 2016-05-10T10:30:06Z
Registry Expiry Date: 2018-05-10T10:30:06Z
Registrar: REGISTRAR OF DOMAIN NAMES REG.RU LLC
Registrar IANA ID: 1606
Registrar Abuse Contact Email: abuse @ reg.ru
Registrar Abuse Contact Phone: +74955801111
Domain Status: clientTransferProhibited
Name Server: BRUCE.NS.CLOUDFLARE.COM
Name Server: VERA.NS.CLOUDFLARE.COM
Last update of whois database: 2017-10-11T00:16:48Z
Fake licensing and auditing claims
The casino claims to be running under a Curacao licence no. 8048/JAZ, granted by the Government of Curaçao. While such licenses are virtually useless in and of themselves, we can find no corroborating evidence that the casino really is licensed at all. There is no regulatory body holding them responsible for their actions.
The site also features the text "Game Payout Validation Security" and a logo for iTech Labs, an independent auditing firm that tests the randomness and integrity of games of chance. However the link on the iTech Labs logo goes nowhere, instead of to a valid auditing certificate.
The credit card CVV number scam
Upon submitting a withdrawal request, our member Panders was asked to provide a photo of their credit card for verification. This is not unusual. What is unusual though is that the casino also asked for the crucial CVV number on the back of the card to be fully visible. Normally you are encouraged to obfuscate or remove this number from your scans. This would, combined with your name, address, and other credit card information, give Winnermillion Casino carte blanche to use your personal information for identity theft and/or your credit card for fraudulent purposes. This makes Winnermillion one of the bolder rogue operations we've seen recently.
We urge all players to avoid playing at this site, no matter where they hail from. If you have given this casino your credit card information we strongly encourage you to contact your bank, file a chargeback for any deposits made to the site, and cancel your card as soon as possible.