A month ago, we published an OSINT study on how the Russian bookmaker 1XBet obtained a license to operate in Ukraine during the war, and who promoted the interests of the Russians. The study provoked a significant response in the Ukrainian media space and interested journalists from Poland, Lithuania and Great Britain. The petition to the President of Ukraine to revoke the 1XBet license has already received the necessary 26,000 votes. The Bureau of Economic Security of Ukraine has begun checking gambling business operators for ties with the Russian Federation, and the state regulator of the gambling market KRAIL (Gambling and Lottery Regulatory Commission) has dissolved its Expert Council. But all this has not affected the license of the Russian bookmaker in Ukraine. In a new study, we will demonstrate how 1XBet works in Russia and how it will get personal data of Ukrainians.
After the first investigation, some interested individuals spoke about the fact that 1XBet allegedly does not work in Russia and has no relations with the aggressor country. If these connections were established, then the license would be worth withdrawing. And the brand itself and the people and companies associated with it should fall under the sanctions of the National Security and Defence Council. While there is no such evidence, this is all “an attempt to cast a shadow on the market and reform of gambling in Ukraine.” This is exactly what Borys Baum, listed on the Myrotvorets website, who has long been called the gray cardinal of the Ukrainian gambling market, wrote on his personal Facebook page in an effort to protect 1XBet.
After the scandal with 1XBet, Baum was dismissed from KRAIL together with the entire advisory and expert board, in which he was the deputy chairman. But he still remains an adviser to the deputy head of the Office of the President Kyryl Tymoshenko. We hope that this will not be for long. Because 1XBet, whose interests he so ardently defends, continues to work freely in Russia with the consent of the FSB. Therefore, lobbying interests and issuing a license to this brand in Ukraine is a crime against national security and an attempt to provide personal data of Ukrainians to the enemy.
This becomes especially important in view of the fact that soon 1XBet will get access to this data.
Why are we sure that 1XBet continues to work on the Russian market? We present a number of arguments based on data obtained from open sources.
1XBet is a sponsor of anti-Ukrainian propaganda in the Russian Federation
On June 21, 2022, a recording of the Russian rap battle “140 BPM” was shown in the “Evening” program on the YouTube channel “Khodorkovsky LIVE”. On it, the performer “Tot Samy” under the signs of 1XBet and surrounded by women with similar symbols reads the beat how “armed Azov battalion was sitting in the kindergarten” and how allegedly Ukrainians “bombed old people, children and others” in Donbas, and other relatable Russian propaganda.
According to records on other YouTube channels, the recording of the program took place on May 29, 2022. The main target audience of such programs with a combination of propaganda and Russian rap is Russian youth. And this video serves as a clear proof that the 1XBet office, which received a license to operate in Ukraine, is interested in marketing on the Russian market, works in Russia and provides Russians with platforms for anti-Ukrainian propaganda.
1XBet – works with most Russian banks and payment systems
Another confirmation of the presence of 1XBet in the Russian Federation is banking operations. In Russia, there is a Badbank Telegram channel, which specializes in publishing leaks about banks that are engaged in acquiring casino payments. The information published there is quite easy to verify due to the large number of payments. When entering the search query “1xbet”, the channel produces 79 publications. The last of them is dated July 11, 2022 and shows that payments for the bookmaker are made by the MTS-Money service.
Other acquirers include Sberbank of Russia, Tinkoff, AlfaBank, Qiwi, and other Russian banks and payment systems.
If 1XBet does not work in Russia, how and why does it make payments through Russian banks? The answer to this question is obvious – 1XBet works in Russia. This applies both to the main platform 1XBet.com and to its infinite number of mirrors and subsidiary sites.
1XBet and 1XStavka are one bookmaker office. Software analysis
During the preparation of the preliminary study, we spoke extensively with specialists in the field of gambling. The only thing that experts agree on 100% is that all operators approach the development of their own software with great sensitivity and protect it from copying. The code can show where the operator works, who is the author of the gambling or betting site, which libraries are used in the software, and sometimes you can even identify the operator’s partners.
Volunteers from the BraveUkraine group conducted a large-scale comparative study of gambling sites and mobile applications and published the results on Github. Among the studied resources are 1XBet and 1XStavka. The latter officially works in the Russian Federation and, allegedly, has no connection with 1XBet and its owners. However, the code shows the opposite. During the study, volunteers compared the design, technology stack of websites, backend and mobile applications (Android, iOS).
The visual similarity of the sites immediately catches the eye. Not only logos, but also the main page, content and various forms for users. But, apart from that, the resources have a completely identical set of libraries and API services.
JS libraries – full coincidence of set and version of libraries.
Backend | АРI services – a complete match of used АРI.
For comparison, we used the API requests that were sent from the frontends of the sites during registration, login, password recovery and receiving lists of sports events.
In the comparison table there is a 100% match of the API URIs used in the operation of both websites.
More than 10,000 files and a set of used libraries in APK files completely coincide in the mobile applications of the two Android platforms.
Contents of unpacked applications – most of the files match.
- The number of files in both applications is almost the same (the difference is 2334 files).
- The number of absolutely identical files in .APK is 10,774.
- All indications show that the applications use exactly the same libraries (below). Differences in graphic files (graphics) and text strings (in-app messages) customized for the respective brand.
Applications in IOS are visually almost completely identical. And even with the same frameworks and libraries.
The conclusions of this analysis indicate an almost complete coincidence of software, raw data for its development and technical support. And this means that 1XStavka, without even hiding it, uses 1XBet technologies.
The owners of the Russian bookmaker, Roman Semiokhin and Serhiy Karshkov, told the Russian Forbes in an interview that all technical work with the platform is conducted in Cyprus and is personally managed by Serhii Karshkov. So without his participation, 1XStavka would not exist. This once again indicates the close ties of the owners of 1XBet with Russia and the unhindered work of the bookmaker group on the territory of the Russian Federation.
In addition to 1XBet and 1XStavka, BraveUkraine volunteers also compared other platforms operating in Ukraine, whether they could pose a potential threat to our country by operating in the Russian Federation. In particular, FavBet and Fonbet, Pari-Match and Pari.ru, Fonbet and Pari.ru. The analysis showed an almost complete coincidence of only two platforms, Fonbet and Pari.ru. Fonbet does not have a license in Ukraine, but, like most operators, continues to conduct illegal activities in the country.
As for FavBet and Pari-Match, analysis of the software showed that it is not similar to the one used in the Russian Federation. But it is not registered on Ukrainian companies. This means that operators do not pay taxes in Ukraine. BES (Bureau of Economic Security of Ukraine) should pay attention to this when checking FavBet and Pari-Match.
But 1XBet and Fonbet must stop their activity. Because it is impossible to work on the Russian market without connections in the law enforcement agencies of the Russian Federation. And the loyalty of the FSB must be repaid with something. Today, this is the personal data of Ukrainians, which we will talk about a little later.
Patrons of 1XBet
As far as we know, the SBU is already looking into the situation with 1XBet. But why did counter-intelligence agents start work only now? According to our data, this was facilitated by the resignation of Artem Shilo, who started 1XBet in Ukraine back in 2016-2017. The resignation took place after the suspension, and later detention in Serbia on suspicion of treason, of Andriy Naumov, the ex-head of the State Security Directorate of the SBU. Together with Naumov, his protégés lost their positions, one of whom was Artem Shilo.
For many years, he held the position of deputy, and later acting head of the department of counterintelligence protection of state interests in the field of information security (DKIB) of the SBU. According to the media, Shilo was one of the key people associated with pressure on Ukrainian IT companies between 2016 and 2019. At the same time, for many years he was involved in the development and implementation of schemes related to the gaming business, including from Russia.
Why does 1XBet want to enter the Ukrainian market?
As you can see, the Russian bookmaker operator has been trying to work in Ukraine for many years and has a great interest in the Ukrainian market. Unfortunately, it may not be about money at all. There is a high probability that 1XBet wants to get personal data of Ukrainians and direct access to players more than money. Gambling is a risk. People lose money. Often – big money. With a database of people with major financial problems, it is very easy to recruit agents on the ground and use them for the needs of the GRU and the FSB.
But how will 1XBet get the personal data of the players? The thing is that they have received permission, moreover, the obligation to do so along with a license to operate in Ukraine. The Law “About state regulation of activities for the organization and carrying out gambling” in Art. 16 requires operators to “ensure identification of player(s) and visitor(s) in accordance with the procedure specified by this Law in a gambling establishment and identification of player(s) during Internet activities.” And already in Art. 17 indicates that “for the purpose of identification (verification, data establishment) of a player on the Internet, the organizer of gambling games has the right to request additional documents from the player in accordance with the rules of the organizer of gambling games, in particular, the player’s own image with the necessary document, or to require using video communication means».
Screenshot: The Law of Ukraine “About state regulation of activities for the organization and carrying out gambling”, article 17.
Article 17. Identification (verification) of a player and visitor
- Identifying (verifying) a player or visitor for the purposes of this Law involves the collection by the gambling organizer of information on:
1) surname, first name, patronymic (if available) of the person;
2) age (date of birth) of the person;
3) presence or absence of the person in the Register of persons with restricted access to gambling establishments and/or participation in gambling.
- Identifying (verifying) a player or visitor is carried out by an employee of the gambling organizer during the first visit to the gambling establishment on the basis of an original document certifying identity and confirming age, as well as until the moment of accepting a bet on the Internet via identification and (or) other verification methods used in accordance with the legislation on the protection of personal data and the rules of the gambling organizer.
- Secondary identification (verification) of the player or visitor can be carried out on the basis of a player’s ID card, in particular in electronic form, issued to the player or visitor by an employee of the relevant gambling organizer, and in the absence thereof – on the basis of the original identity document. The player’s card must contain their photo and indicate their surname, first name, patronymic (if available), date of birth, and a special (unique) number of this card or a corresponding bar code, which allows one to read the information using relevant technical devices.
The description of the player’s ID card is approved by the Authorized Body.
- Identifying (verifying) a player on the Internet is carried out by the organizer of gambling games using an electronic signature, a SIM card supporting the MobileID method, the BankID method, or other verification methods used in accordance with the law.
- The gambling organizer has the right to request additional documents from a player in accordance with the rules of the gambling organizer, in particular, the player’s own image with the required document, or to demand using video communication tools for identifying (verifying) the player on the Internet.
- Identifying (verifying) a player’s age on the Internet is carried out by the gambling organizer before the bet is accepted.
Until the Russian bookmaker begins to collect this data, we are waiting for the results of the work of the BES, the SBU, and the National Security Defence Council. We no longer expect anything from KRAIL. If the head of the state regulator, Ivan Rudy, had remembered the debt of honor of the ATO veteran, he would not have allowed such a disgrace. And if he is silent and pretends that nothing is happening, then everything suits him. Another question is whether Ukraine is satisfied with the head of KRAIL, who remains silent when the enemy seizes his agency.
Mykhailo Makaruk, InformNapalm