+90% iGaming affiliates are going to lose their business in the forthcoming months.

**KazaK** · 6 April 2021, 10:49 am

First off all, i would like to inform, that i am not the author of this thread / text. I get this text today morning (Moscow mean time) by email from GPWA user Oliver155 who can't post thread here, at GPWA, by technical reason. Sorry for my English.

I ask the affiliate community to pay close attention to this message. At stake is the safety of each affiliate’s business. The threat is real and serious. Unfortunately, there is a high probability that at least 90% of affiliates, who receive SEO traffic will lose all of their incomes within the upcoming months or even weeks.

**THE BEGINNING OF THE PROBLEM**

The story began in the Russian-speaking segment of the internet (Russia & CIS countries) in December 2020. Within three weeks, the affiliate business of all the top affiliates was completely destroyed of all the top profitable keyword SERP’s (we are talking about iGaming; casino, sports betting, etc.) in the Russian-speaking segment in the Google search results.

Their websites lost their TOP positions in the search results. Their places were taken by the copies of their websites, but on someone else’s domains with someone else’s affiliate links.

**HOW DOES THE SCHEME WORK?**

No one knows 100% how the scheme is used by the attackers. But what we do know is that the attackers took advantage of Google search engine’s vulnerability, known as the ?01 BUG?

We are certain that for the past 3 months, thousands of Russian-speaking affiliates were not able to develop any protective measures.

301 BUG

Supposedly the scheme looks like following:

-Dropped domains with high indicators are being bought.
-A copy of the victim’s website is placed on the dropped domain.
-With the help of the ‘hreflang?attribute, it indicates that the website is the original for the language it is created on, but for another GEO, and the website is the copy for that GEO, which the original was meant to be for.
-After some time, Google starts to consider the copy as the main website for Geo, and it appears in the search results.
-On the original website, the traffic stops completely.

**WHO IS BEHIND THIS SCHEME**

Investigation made by Russian-speaking affiliates found, that there is at least one group who is in charge of the scheme, physically located in UA. Currently, the specified scheme is a priority for this company, as BUG-301 allows to get traffic without affiliates, but by using their work. We know that there are 500 SEO Professionals and hackers who are working on the scheme, approximately divided into two independent companies.

We know that there are several other affiliate programs, that are also interested in the affiliate website hijacking scheme.

**ATTACK ON THE WESTERN SEGMENT OF THE INTERNET**

In March 2021, attacks using BUG-301 began on the Western markets. We already know of the losses of websites by webmasters in the TOPs of AU, NL, NO, SE, PL, and DK. New losses occur on a daily basis. We have some information, that this attack is only a test attack. An attack on the Western markets in full force is expected in the nearest future. In this thread, we will keep you informed on the new cases of websites losses by affiliates.

**WHAT SHOULD WE DO**

As our practice shows, there is no protection against the BUG-301 attack. This vulnerability can only be fixed by Google. Unfortunately, the Russian-speaking forum on Google support for the webmasters is not checked by Google employees.

1. We need to speak up about this issue on the English-speaking Google forum and other famous English speaking Western forums. For this, we will need the help of our affiliate friends, who are native English speakers as well as those, who speak English at a high level.

2. Also we ask the GPWA management to inform the large international brands about the current situation.

**EXAMPLES OF THE COPIED WEB\\SITES**

www.onlinecasino.co.at - https://casino461.online
casino762.online
echtgeldcasino986.online
casino208-live.club/resources/
livespincasino-202.club/us/online-casinos/

avido.com.au - True Blue Casino
stoptheselloff.org.au - BettingPlanet.com
gamlinroofing.com.au - CasinoShortList.org
eatout-sydney.com.au - Free-pokies.net
bootsphotography.com.au - Aussie Play Casino
coughinggherkin.com.au - CasinoAus.com
redcabbagefoodandwine.com.au - Australia-casino.org
theta-healing.com.au - ThatCasinoBonus.com

casino208-live.club/resources - OnlineCasinoBlueBook.com
coolcat-australia995.club/bitcoin-casino/ - Cool Cat Casino
livespincasino-202.club/us/online-casinos/ - Gambling.com

How to check:

These sites redirect you if you try to visit them directly.
Use this order.

1. Google
2. site name.

**Oliver155** · 6 April 2021, 11:00 am

Hello. I am newbie. This is my text. I try create thread, but it hold on moderation since 02 April? This is very serious problem. Thanks Kazak.

**Maximus325** · 6 April 2021, 11:01 am

There are a lot of them https://www.google.com/search?q=aust...o+site%3A.club

And the most wired thing is that Google put original site content as cash of clone

**kofeinik** · 6 April 2021, 11:18 am

This is problem.
This guys destroy all top affiliate sites in RUnet.

Google translate from Russian to English
source: https://t.me/zanosibablo/958

And so, the representative of Welcome Partners was again banned in the chat, and she could not find anything to say to her. Everything was mixed up for a long time and I know only one thing, that the bug with copies was for a long time, but it was not used massively, so it did not rush into the eyes. Now it is already used by many and it is impossible to say exactly who stole this site here. Yes, there are those who do it more massively, and there are those who are more precise. Google also seems to have been in the know for a long time, but does not move.

I got tired of digging in the dirty linen of companies, two representatives of seo.partners contacted me and for several days they have been convincing me that it is not them and they have nothing to do with the same welcoms. Let's end the game of Sherlock Holmes with this post ...

This is not seo.partners, not evopley and not the other offices that I mentioned. I want to apologize, sleep well, your reputation does not suffer. I don’t know who does this, and I don’t want to know, I just want to return my and your sites to Google. But everyone's opinion will remain their own! In the private chat, in fact, there are a lot of proofs about who it is and what, but I won't post anything, it's easier to apologize and forget.

Yesterday came a private infa that the mass copiers said that they would not give Google away, and soon all Yandex would be theirs. Judging by the fact that copies are already appearing in Yandex, I do not completely exclude the fact that soon we will lose our sites there too.

So, everything they do is tied to the hreflang attribute, they take a bold drop and write these attributes in the sitemap, telling Google that their site is in Russian for ru issuance, and yours in Russian for issuing, for example, Australia. Then they add traffic to their drop and Google itself determines that their mirror is the main thing, there is a stupid gluing of 301 redirects without the redirect itself, which is then very difficult to paste. Your site, by content, links, etc., begins to transfer weight to them, they, in turn, are also glued with hreflanges to svezhereg with the exact entry of the brand into the url and become 1st place in the search results, that's the whole secret.

Read here - https://searchengines.guru/ru/news/2049599 news from December 1, 2020 and here https://www.reddit.com/r/TechSEO/com...hreflang_help/ old already, but here is an excerpt from there :

"When Google encounters the hreflang attribute, there is a two-step process. First, Google retrieves the version of the page that has the strongest ranking signals."

As a result, Google took on the right to determine the most trusted site and give it the main mirror.

How to deal if you are copied? While there are only assumptions and recommendations, some of this worked pointwise for the guys from the private chat:
❗️❗️❗️
1. Change content on the main and landing pages + titles and descriptions. You can add new pages.
2. Change urls of pages and main
3. Pile up a bunch of traffic and links to your site in order to outbid the trust drop that copied you, remember to index the purchased links
4. Make your own sitemaps with hreflanges, where to indicate to the copies different countries of issue. Those. your site is ru-ru, the rest is ru-ch and so on. It is imperative to prescribe canonicals.
5. To feed this whole thing is godless to Google, you can use gindex.me add-url.info bot in the @wmaster_bot cart as well as https://developers.google.com/search...rence/indexing / rest / v3 / urlNotifications / publish

Google hreflang guide - https://developers.google.com/search...versions?hl=en

It still depends on the time, if you were just copied, that is, the chances are to manage only by changing the content and then the sites will not stick together, if for a long time, then nothing may help. DMSA and RKN can also take part in this scheme. If your site is in the top and is rather bold and you can't knock it out with a drop, they are abuses in dmsa and rkn, and while your site is not listed on the dmsa or rkn blog, Google will define their site as the main one.

Everything, if you find something 100% working, write to the LAN. We can only try and monitor Yandex now.

**PROFRBcom** · 6 April 2021, 12:24 pm

There is an ongoing discussion of this on AGD, but there really needs to be much more discussion of this publicly.

https://www.affiliateguarddog.com/co...-copied.16727/

I do not know how to help but I am sure someone here does!

This does seem serious....

**Maximus325** · 6 April 2021, 12:43 pm

I guess this may help

Code:

<link rel="alternate" hreflang="x-default" href="https://example.com/" />
<link rel="alternate" hreflang="en" href="https://example.com/" />
<link rel="alternate" hreflang="en-au" href="https://example.com/" />
<link rel="alternate" hreflang="en-ca" href="https://example.com/" />
<link rel="alternate" hreflang="en-gb" href="https://example.com/" />
<link rel="alternate" hreflang="en-in" href="https://example.com/" />
<link rel="alternate" hreflang="en-nz" href="https://example.com/" />
<link rel="alternate" hreflang="en-us" href="https://example.com/" />
<link rel="alternate" hreflang="en-za" href="https://example.com/" />

**universal4** · 6 April 2021, 1:59 pm

While I do not understand 100% exactly how this is taking place in the listed cases, (as I have not had a chance yet to study or thoroughly read the cases) it is clear that it is a problem that seems to be suddenly increasing in a somewhat explosive way, and is having a huge impact.

We ask first of all that anyone that lists URL's of the bad actors and the programs they are promoting, be sure and obfuscate the URL in some way, such as adding hxxps://domain.com Obviously we do not want to provide valid links to the bad actors.

We will certainly reach out to the affiliate programs to try and help limit the impact of this continuing. The more examples of these programs on these sites helps us to show the programs the scope of the problem.

Obviously links to discussion with thorough explanations and solutions do not necessarily need to be hidden or obfuscated.

Any help or fact based research of the specific bad actors is greatly appreciated.

Rick
Universal4

**Tex Holdem Questions** · 6 April 2021, 2:27 pm

Thanks for sharing this!

Sorry if I am being ignorant but doesn't sites like DMCA protect against the content being copied? If they pick it up, surely it's just a case of taking down the site that has copied the content?

**mediapartner** · 6 April 2021, 2:36 pm

very interesting, almost weird nobody used this method before.

if i understand correctly, the scheme is like this (please correct me if i see this wrong)

- thief buys expired domain with high data (huge amount of backlinks, great da history, etc)
- original site gets copied and placed on the bought expired domain
- google sees two same sites and checks based on ranking data which is the original one
- as expired domain has great google ranking data it is seen by google as original site
- original site is marked as duplicate/spam by google
- duplicate site gets all the top ranking while original site drops to zero traffic due to google spam marking

google should be able to fix this simply. as they just need to check waybackmachine to see which is the original site.

**Maximus325** · 6 April 2021, 2:44 pm

Not so easy dude.
As I understand, they use hreflang in sitemap. So they say to Google that their site is copy for target (tier 1) market and yours is for example chineese.

**Maximus325** · 6 April 2021, 2:57 pm

Some more info:

Here is TDS domain (traffic flow through) xttps://mobywin7.com/

Aff programs:

AU IP
Wild Tornado
xttps://www.wildtornado.org/users/sign_up?stag=28805_606cb55a3bb3a40dfe2028fd

USA IP
Las Atlantis
xttps://lasatlantispromos.com/landing/warmwelcome?token=k-TksAB8ZQ32WD51pEXVaGNd7ZgqdRLk&gaid=55

NZ IP
Rich Prize
xttps://richprize.com/?ref=aqhWQOMi&p1=606cb6ecef53760001b6a0d5&p2=2526

WinsPark
xttps://cdn.winspark.com/LPs/En/WH-style/slot_goldrush/index_usd.html?Inc=93798738&affToken=QJaxOK1qiXq05 xYQkqJ_HmNd7ZgqdRLk&pg=0&payload=2526&clickid=606c b736ef53760001b6a0da&LP=235&referrer=&affiliateID= 8257&media=&ABClicks=1&shorten_link=594a5095be06b& shorten_target=9596&netoClickId=606cb73b5e0f95c325 52bc81

CA IP
Mr Bet
xttps://promo.mr.bet/?lp=mb_reg&trackCode=aff_5eabe3_96&cid=2qr3bin41tc te

Others tested IPs ZA, RU, FR, NL, UK
Russian Vulkan

**mediapartner** · 6 April 2021, 4:31 pm

Originally Posted by Maximus325

Not so easy dude.
As I understand, they use hreflang in sitemap. So they say to Google that their site is copy for target (tier 1) market and yours is for example chineese.

ah ok, didnt understand that part from the original post. thanks for explaining.

**EastTeam** · 6 April 2021, 11:14 pm

Kazak, thanks about your post. This guys steal over 100 sites in CIS gambling community. And its a serious problem for TOP internalional project.

**gm2891** · 7 April 2021, 3:25 pm

So any updates from Google or any more news? I can see the thread on Google Search Help got locked down with no further answers or advice provided.

Well, yeah I know everyone out there hates gambling, but it's a matter of time till it will start happening
to sites with any other subjects too.

Here is an example.

There is a site called Anoox.com a little old search engine with a forum and news.

All Anoox's content is also on smalawfirm.com run by some older lady from California since 2006. The site originally had only 12-15 pages, but now there are over 4000. Probably she is not even aware of it.

And seems like these people there accept paid ads like they are an original Anoox.

**hellokaitlynnn** · 8 April 2021, 3:06 am

Well maybe people should start putting their focus on other ways to earn? Like using games and many other ways to get money. They could even try playing some runescapes to get their fuel going in the long run. Even trying on piegp would give them a fair chance to get better earnings if they do it well in the long run. There are many people out there who give a reason for others to try out the gaming part since it is fun and easy to do for people who have the time to work on their busy lives.

**FintanCostello** · 8 April 2021, 10:47 am

Originally Posted by PROFRBcom

There is an ongoing discussion of this on AGD, but there really needs to be much more discussion of this publicly.

https://www.affiliateguarddog.com/co...-2#post-116493

I do not know how to help but I am sure someone here does!

This does seem serious....

That thread on AGD is loading for me, do you have another link? (I cant find it on search eith)

**YuraK** · 15 April 2021, 1:28 am

I've heard a lot about this problem on Russian market (though didn't suffer it myself). But I thought it was due to gambling site block here and didn't expect it would spread to other countries

. That's a real danger to hard-working affiliates!

**PROFRBcom** · 15 April 2021, 5:40 pm

Originally Posted by BonusFinder

That thread on AGD is loading for me, do you have another link? (I cant find it on search eith)

https://www.affiliateguarddog.com/co...-copied.16727/

**FintanCostello** · 16 April 2021, 4:21 am

Originally Posted by PROFRBcom

https://www.affiliateguarddog.com/co...-copied.16727/

I don't think I have the correct forum permissions to view the thread

**SlotAtHome** · 16 April 2021, 5:35 pm

I'm not sure I understand the method, as I didn't read all comments, but one thing came to my mind first when I read it. As far as I know, Hreflang tags only work if they have a "return" link. I attach an explanation about this (I can not attach links here...so put it together): https yoast.com /hreflang-ultimate-guide/
Scroll down to "Technical Implementations - Basics", and there read the "2.Return links" part.

It means, if a copy of your content links to you as a language version, but you don't link to the copied site, the Google doesn't connect the two. I have never heard of Bug301, but I have a feeling that it can not even exist.

Maybe my last comment is more understandable from this: sitebulb. com/hints/international/missing-reciprocal-hreflang-no-return-tag/

Thread: +90% iGaming affiliates are going to lose their business in the forthcoming months.

LinkBack

Thread Tools

Search Thread

Display

+90% iGaming affiliates are going to lose their business in the forthcoming months.

The Following 12 Users Say Thank You to KazaK For This Useful Post:

The Following User Says Thank You to Oliver155 For This Useful Post:

The Following 2 Users Say Thank You to Maximus325 For This Useful Post:

The Following User Says Thank You to kofeinik For This Useful Post:

The Following User Says Thank You to universal4 For This Useful Post:

The Following User Says Thank You to mediapartner For This Useful Post:

Posting Permissions