What is this TheGamingJoy.com website exactly?
When we were investigating an email storage phishing scam, we noticed that the site taking payment was here:
https://thegamingjoy.com/r/NmVdJk3EaqNBiyxA/7b8b36ba-7c33-4939-a5bf-238b64b8d646/payment?token=#string
We subsequently reported this via thegamingjoy.com abuse link on their website and sent an email through to [email protected] with all of the links to what happened and a link to this video showing the path taken by a visitor who was a victim of the scam:
So who are they? They have to have a connection to the scam, no one would just randomly send vulnerable people to make payments to a company that wasn't at least giving them a cut, if they are not the perpetrators of the whole thing, which seems more likely. We decided to investigate who TheGamingJoy.com are and what their connection to the scammers might be.
The scam begins, as nearly all scams do, with an email designed to get past spam security with a malware link. The email is here:
With the image link as: https://mare.crazymind.info/index.php/campaigns/fk039qj91rce9/track-url/aa3482rf55ab3/5c87af7c07b3b56f994701d321e5e15f4b95b900 and the link to the image as: https://mare.crazymind.info/frontend/assets/files/customer/qm804apg68c91/email-templates/86ck-Cloud%20Storage%20(4).png
So by the link having 'campaign' within it, the crazymind.info site must be an affiliate network and this is some sort of marketing campaign in the eyes of the perpetrator. Interesting.
The reply email is listed as [email protected] and this is important too as the crazymind,info affiliate marketers are listing this as the reply email for feedback, so as far as the affiliate marketers are concerned, this is the email address of their customer, the perpetrator of this email.
Now if we have a look at another crazymind.info email from another of their customers:
If you no longer wish to receive this offer https://mare.crazymind.info/index.php/campaigns/lc214owovgf3c/track-url/aa3482rf55ab3/7275f39cf244c1dccb1c064177950427b1db4193 to get you out
Address:-> Park Ln, London W1K 1BE, United Kingdom.
If you have any Feedback, please mail us at:- [email protected].
We can see that they are using a differrent email address to contact the marketer, so the opendoor.info email is the customer as presented to the affiliate marketing network. We need to find out if there is a connection between opendoor.info and TheGamingJoy.com.
Now thegamingjoy.com is a company that is registered in Cyprus, or is at least the property of a company in Cyprus by the name of Kaprozi Limited who share their address of Eleftheroupoleos, 10A Egkomi, 2400, Nicosia, Cyprus