On July 24th, Primedice staff were made aware of a phishing website attempting to trick users into depositing into an investment version of the website. We took immediate action into sending abuse complaints to the DNS registrar and server host.
Upon inspection of the phishing website, we found that the SSL certificate used was shared by other domain names including paradice.io and kingdice.io. After some further investigation, we found that four domains used the exact same cloudflare nameservers, which is a very unlikely coincidence. These domains were paradice.io, kingdice.io, primedice.co and the domain registered for phishing, bitcointalk users have previously linked paradice.io to primedice.co (
https://bitcointalksearch.org/topic/m.18510402).
Primedice staff were able to find cached google and bing results for the phishing domain, which show the website title as “PARADICE | One Step Ahead! - Bitcoin Dice Game..”
Primedice also found a google result which shows that both paradice.io and the phishing url have the same overall website structure, in the Google result image below, you can see ajax requests are sent to /content/ajax/unprotect_url.php?_unique=token, the exact same way the paradice.io website works. Adding to this, the phishing url reports Apache as the webserver, paradice.io has this field hidden, but it is clearly an Apache error page that shows up.
Furthermore, paradice.io has been found to lift assets directly from Primedice in the past, including the favicon, and faq text. Not surprisingly their website isn't provably fair either.
Update: Reports were successful, now both Paradice and the phishing website are down.
More details:;; QUESTION SECTION:
;xn--prmedice-ukb.com. IN NS
;; ANSWER SECTION:
xn--prmedice-ukb.com. 86400 IN NS fay.ns.cloudflare.com.
xn--prmedice-ukb.com. 86400 IN NS rob.ns.cloudflare.com.
;; QUESTION SECTION:
;paradice.io. IN NS
;; ANSWER SECTION:
paradice.io. 86400 IN NS rob.ns.cloudflare.com.
paradice.io. 86400 IN NS fay.ns.cloudflare.com.
;; QUESTION SECTION:
;kingdice.io. IN NS
;; ANSWER SECTION:
kingdice.io. 86400 IN NS rob.ns.cloudflare.com.
kingdice.io. 86400 IN NS fay.ns.cloudflare.com.
Primedice.co
http://archive.is/75DEzKingdice.io
http://archive.is/thcwmParadice.io
http://archive.is/DYV75Phishing domain
http://archive.is/FNRudhttp://archive.is/o8lGvhttp://archive.is/HBwODhttp://archive.is/Tv0Ofhttp://archive.is/X56fU