| The relationship between various TDSs and DNS associated with Vigorish Viper and the final landing experience for the user |
A Chinese organized crime syndicate with links to money laundering and human trafficking across Southeast Asia has been using an advanced “technology suite” that runs the whole cybercrime supply chain spectrum to spearhead its operations.
Infoblox is tracking the proprietor and maintainer under the moniker Vigorish Viper, noting that it’s developed by the Yabo Group (aka Yabo Sports), which has been linked to illegal gambling operations and pig butchering scams in the past. In late 2022, it rebranded as Kaiyun Sports and has since been absorbed into another newly formed entity called Ponymuah.
The suite, marketed in China as “baowang” (“包网,” meaning full package) encompasses several components such as Domain Name System (DNS) configurations, website hosting, payment mechanisms, advertising, and mobile apps. It also hosts thousands of domain names and numerous brands in an infrastructure that’s tied to Hong Kong and China.
The enterprise hinges on securing European football club sponsorships using front companies or white label brands, and using them as a “force multiplier” to advertise illegal gambling sites in the region with the goal of attracting more bettors. In July 2023, it was reported that betting company logos appeared as often as 3,500 times during the course of a televised football match.
Yabo, Ponymuah, and other related offshoots like OB (aka OBGM), DB Gaming, Panda Sports, KM Gaming, and Smart King Games (SKG) are all part of Vigorish Viper’s sprawling network, highlighting the tangled and murky ownership of the gambling companies and the painstaking steps undertaken to sidestep scrutiny.
It’s not just English football clubs that have engaged in these sponsorships, as the investigation has unearthed that cricket and kabaddi teams in India have also entered into similar sponsorship agreements to advertise Vigorish Viper brands.
“Vigorish Viper operates a vast network of over 170,000 active domain names, evading detection and law enforcement through its sophisticated use of DNS CNAME traffic distribution systems,” Infoblox researchers Maël Le Touz, Jacques Portal, Renée Burton, and Elena Puga in an exhaustive report shared with The Hacker News.
“In addition to gambling, Vigorish Viper’s CNAME [traffic distribution systems] serve illegal streaming and pornography sites. Some of the domains used for streaming are long-registered domains that Vigorish Viper picked up after the original registration expired.”
Burton, vice president of threat intelligence at Infoblox, described the threat actor as “one of the most sophisticated and important threats to digital security” discovered to date.
| An overview of Vigorish Viper’s sports sponsorship scheme |
“Vigorish Viper created a complex infrastructure with multiple layers of traffic distribution systems (TDSs) using DNS CNAME records and JavaScript, which makes it incredibly difficult to detect,” Burton said in a statement. “These systems are complemented by their own encrypted communications and custom-developed applications, making their activities not only elusive but also remarkably resilient.”
This entails the use of DNS CNAME records to redirect traffic from one domain through another, a technique previously adopted by other DNS threat actors like Savvy Seahorse. Furthermore, the system has the capability to differentiate between residential, mobile, and commercial IP addresses in China.
Earlier this January, the Danish Institute for Sports Studies’ Play the Game initiative uncovered connections between dozens of European football clubs and illegal gambling brands that can be traced back to Yabo and target jurisdictions like China where gambling is prohibited and considered an organized crime.
The online crimes also have an offline aspect involving human trafficking wherein people are lured with the promise of high-paying jobs and are coerced into supporting sports betting schemes and promoting pig butchering scams and other cryptocurrency scams, according to the Asian Racing Federation (ARF).
“Operating in teams of 8-10, some coordinate with commentators and broadcasters of live sport (presumably on pirate streams) to promote live chat groups marketing betting websites during games,” according to a report [PDF] released by the ARF in October 2023. “Others act as relationship managers to encourage customers to continue betting and others as direct customer recruitment agents.”
| Steps between when a user visits a site and starts placing bets |
Infoblox said its own investigation into Vigorish Viper stemmed from a single anomalous domain, kb[.]com – a gambling site named KB Sports that uses Chinese nameservers – which also hosts yabo[.]com, the domain name for Yabo Sports.
An interesting aspect to note here is that the website is geo-blocked to users located in France and elsewhere in Europe, but is accessible from mainland China and the special administrative regions of Hong Kong and Macau.
“When visited from one of those areas, the user is redirected to another domain — for example, kb830[.]com,” the researchers pointed out. “The redirection domain changes over time. Additionally, all ‘right click’ functionality is disabled on the site, as is text selection, hindering efforts to investigate or copy the site.”
Users to the website are then served ads promoting financial incentives for betting regularly, alongside options to pay using WeChat Pay, EBpay, Alipay, JD Pay, KOIPay, AstroPay, YunShanFu, UniPay, Net Pay, Fast Pay, and NetBank. The betting takes place through agents, who place the bets, manage the deposits, and communicate with gamblers through bespoke, encrypted chat apps.
A deeper examination of the DNS query logs has also unearthed evidence that Vigorish Viper’s activities transcend China to target users across the world.
Some of the other defense mechanisms embedded in these sites comprise periodically checking for signs of automated activity and serving a CAPTCHA puzzle for visitors in an attempt to avoid potential scanning efforts, or when trying to reach customer support, a task carried out by real people who have been trafficked into Southeast Asia.
That’s not all. Users visiting one of Vigorish Viper’s brand domains are subjected to multiple rounds of fingerprinting checks to validate that the IP address is in China and they are legitimate, before they are allowed to bet on the sites.
“Both the DNS and the software tie Vigorish Viper’s entire enterprise to Yabo Sports or Yabo Group,” the company said. “Their reach extends to dozens of brands, possibly hundreds, and targets users beyond Southeast Asia.”
“In spite of the massive number of domain names, websites, and accompanying applications, along with overt presence in the public eye, Vigorish Viper is operating directly and inexplicably in the PRC without meaningful consequence.”
