The FinTelegram research team has identified a suspicious domain https://app-paymentgw.pgws2b.com currently deployed by several anonymously operated online casinos of Liernin Enterprises, including Malina Casino, Talismania, SlotUna, and others. This domain has been flagged due to its association with activities that potentially violate financial regulations and legal standards for online gambling.

Details of the Warning

1. Anonymous Operations and Lack of Transparency:
   • The domain app-paymentgw.pgws2b.com is anonymously registered, which conceals the identity of its operators and raises significant red flags regarding its legitimacy. This lack of transparency is a common tactic employed by entities involved in illegal or unauthorized activities to evade detection by law enforcement and regulatory bodies.
2. Association with Illicit Online Gambling:
   • Investigations have linked this domain to Liernin Enterprises (previously known as Rabidi), a group operating a network of online casinos without proper regulatory oversight. These casinos are suspected of engaging in illegal gambling operations, which often include fraudulent activities, money laundering, and other financial crimes. Similarweb statistics show that in the last 28 days before August 30, 2024, alone, the domain was visited more than 557,000 times. Most of the visitors to the website are likely to be players at illegal online casinos. Almost 40% of them come from Germany, but also from Greece, the UK, Ireland, and Portugal (see screenshot on the right below).
3. Risk of Financial Crime and Legal Liability:
   • Engaging in transactions with domains linked to unauthorized or illegal operations can expose payment processors to significant financial and legal risks. There is a heightened risk of involvement in money laundering activities, which can lead to severe regulatory penalties and reputational damage.
4. Potential Customer Harm and Data Breach Risks:
   • Customers transacting through these platforms may be at risk of financial loss and data breaches. Anonymous domains are often used to obfuscate the true nature of their operations, leading to potential consumer fraud and theft of sensitive personal and financial information.

Download the Rabidi Report here.

Recommended Actions

• Immediate Suspension of Transactions: We strongly advise all payment processors to suspend any ongoing transactions associated with app-paymentgw.pgws2b.com and prevent future transactions to this domain until further notice.
• Enhanced Due Diligence: Conduct enhanced due diligence on any associated accounts or entities that have interacted with this domain to ensure compliance with anti-money laundering (AML) and counter-terrorism financing (CTF) regulations.
• Collaboration with Law Enforcement: Coordinate with relevant law enforcement agencies to report any suspicious activity linked to this domain and assist in ongoing investigations to dismantle illegal operations.
• Consumer Protection Measures: Inform your customers and clients about the risks associated with this domain and similar operations, and advise them to be cautious about their transactions online.

Conclusion

This warning serves as a critical reminder of the importance of vigilance and due diligence in preventing financial crimes and protecting consumers. By taking swift action against suspicious domains like app-paymentgw.pgws2b.com, payment processors can help safeguard the integrity of financial systems and contribute to the fight against cybercrime.

Share Information

If you have any information about the domain operators, associated casinos, or facilitating payment processors, please share it with FinTelegram via our whistleblower platform, Whistle42.