'iesnare'

Opened a Skybet account last week so Mrs DG could have a bet on the GN and also helped Slim with his trixie but no sign of any of the mentioned files on my pc.

Thanks for the warning though chef.
 
attachment.php
The above is supposedly the first part of "proof" of what is happening as released by Paul Fairhead
 

Attachments

  • Iesnare.JPG
    Iesnare.JPG
    90.9 KB · Views: 57
I can confirm this is also used throughout the personal loans industry to try to pick up on fraudulent applications and reduce the risk.

I am currently integrating it into several products.

I would imagine in this case it has bugger all to do with taking prices and limiting accounts and to state that - the intention behind it is to ensure that people are not committing fraud. As in signing up for new customer offers with bookmakers using your own details, your partners etc. But surely no one would ever do that? :lol: It's only those dastardly bookies trying to close accounts.

A refer result would typically be used to indicate that the potential for Fraud has been recognised and that the company should examine the account in more detail.

I would also imagine he is talking utter balls about being able to "remove this from your computer". It's a series of javascript files which are downloaded in the browser. You can stop all outgoing requests from your machines to all the iovation servers and this will work for a while. But all they will do is just change the URL and off it will go again.

Plus you will be in contradiction of the T&C's you signed up for when you opened the account in the first place, so the missing Iovation data will be more likely to throw up a red flag for them anyway
 
I assume as the name implies iesnare only works on internet explorer? If so could one get round it by using chrome, or Firefox. Or what about using safari via an iPhone?

This is a subject of interest to me having had numerous accounts closed. I recently had to take the step of getting a second mobile and a few SIM cards so I have some new IP addresses to bet through.
 
Flagship uberalles said:
I can confirm this is also used throughout the personal loans industry to try to pick up on fraudulent applications and reduce the risk.

I am currently integrating it into several products.

I would imagine in this case it has bugger all to do with taking prices and limiting accounts and to state that - the intention behind it is to ensure that people are not committing fraud. As in signing up for new customer offers with bookmakers using your own details, your partners etc. But surely no one would ever do that? :lol: It's only those dastardly bookies trying to close accounts.

A refer result would typically be used to indicate that the potential for Fraud has been recognised and that the company should examine the account in more detail.

I would also imagine he is talking utter balls about being able to "remove this from your computer". It's a series of javascript files which are downloaded in the browser. You can stop all outgoing requests from your machines to all the iovation servers and this will work for a while. But all they will do is just change the URL and off it will go again.

Plus you will be in contradiction of the T&C's you signed up for when you opened the account in the first place, so the missing Iovation data will be more likely to throw up a red flag for them anyway
Click to expand...

A friend of mine posted the following Flagship - does it work? I'm clueless and doubt I could even follow it.

How do I get rid of iesnare?

Getting rid of iesnare may be as simple as deleting the folders you find. However, staying rid of it is a slightly more complicated operation. But, if you value your privacy and still want to bet with the best priced firm, it is worth the effort.

These instructions were originally published here, and I make no claim to be a tech whizz or otherwise able to troubleshoot the implementation of them, or anything awry which might crop up as a consequence of following them. They have worked fine for me, with no adverse consequences so far. Caveat emptor!

[NB The process is not nearly as complicated as it is long, so don't be put off by the block quoted text below]

To check if iesnare is on your computer...You can find it by opening up a command prompt
(start -> all programs->accessories->command prompt) then typing..... dir mp*.com /s
If it's there you will see the date it was installed on your computer!

If it's there and you want to block it this is how...

Click the Start button, click notepad or enter notepad in the bar at the bottom
Right-click on the Notepad item which appears at the top of the list
Choose "Run as administrator"
In "untitled - notepad" go to file and click open, then under "files of type" click all files
Enter "C:\WINDOWS\system32\drivers\etc" in file name and click open
Right click on "hosts" file (make sure it only says hosts, not hosts.bak or hosts.txt), select properties and uncheck read-only box at bottom beside attributes, then click "Apply" then OK.
Now double-click "hosts" again
Add the following lines in the next line below where it says "127.0.0.1 localhost"

127.0.0.1 iesnare.com
127.0.0.1 iesnare.co.uk
127.0.0.1 http://www.iesnare.co.uk
127.0.0.1 mpsnare.iesnare.com
127.0.0.1 mpsnare.iesnare.co.uk
127.0.0.1 http://www.mpsnare.iesnare.com
127.0.0.1 http://www.mpsnare.iesnare.co.uk
127.0.0.1 ci-mpsnare.iesnare.com
127.0.0.1 ci-mpsnare.iesnare.co.uk
127.0.0.1 http://www.ci-mpsnare.iesnare.com
127.0.0.1 http://www.ci-mpsnare.iesnare.co.uk
127.0.0.1 admin.iesnare.co.uk
127.0.0.1 http://www.admin.iesnare.com
127.0.0.1 http://www.admin.iesnare.co.uk
127.0.0.1 iovation.com
127.0.0.1 iovation.co.uk
127.0.0.1 http://www.iovation.com
127.0.0.1 http://www.iovation.co.uk
127.0.0.1 http://www.iesnare.com
127.0.0.1 admin.iesnare.com
127.0.0.1 dra.iesnare.com
127.0.0.1 impsnare.iesnare.com
127.0.0.1 mpsnare.iesnare.com
127.0.0.1 mx.iesnare.com
127.0.0.1 snare.iesnare.com
127.0.0.1 iovation.com
127.0.0.1 accountlock-demo.iovation.com
127.0.0.1 admin.iovation.com
127.0.0.1 bam-pilot.iovation.com
127.0.0.1 batch.iovation.com
127.0.0.1 ci-accountlock.iovation.com
127.0.0.1 ci-admin.iovation.com
127.0.0.1 ci-mpsnare.iovation.com
127.0.0.1 ci-snare.iovation.com
127.0.0.1 dv-fw-a-nat.iovation.com
127.0.0.1 ioit.iovation.com
127.0.0.1 mx.iovation.com
127.0.0.1 p.iovation.com
127.0.0.1 rm-admin-demo.iovation.com
127.0.0.1 soap.iovation.com
127.0.0.1 test.iovation.com
127.0.0.1 testgw.iovation.com

Save the text file back to its existing location, then close notepad

Now, open the command prompt (start -> all programs->accessories->command prompt)
and check that it is working by...

Type in the word "ping" followed by any of the entries
(without the numbers)..e.g ping mpsnare.iesnare.com

Press enter

You're looking to see similar to this:

Pinging mpsnare.iesnare.com [127.0.0.1] with 32 bytes of data:

Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Ping statistics for 127.0.0.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms

Note all zeros at bottom and 127.0.0.1 addresses at top
anything different to this is wrong!

I've done this on both vista and xp, both work.

Now, whenever IESnare attempts to phone home, your networking system will give it the wrong address (127.0.0.1 is always the address of your own computer), and its messages won't get through. You can check this has worked by trying to go to http://www.iesnare.com, or any of the above addresses, in your web browser: you shouldn't be able to get there and it should say it is unable to connect!
I followed these instructions, and can say they worked fine on Windows 10 as well. I'd imagine they'll work on any Windows device. Sadly, I can't vouch for a similar process on Apple kit.
 
Hi Chef,

It will kinda work.

But it isn't guaranteed to keep working. The scripts for Iovation are served up as part of the website they are integrated with. If you are on a bookies website, right click the page and select "View Source".

You will get a text file with the HTML markup of the current page. In that, you will find something like this:

<script type="text/javascript" src="URL"></script>

where URL is one of the addresses in that article. The above tells your browser to download the requested script from that URL.

What those instruction do is to tell your computer that any outgoing requests to those URLs will instead be directed to localhost (127.0.0.1), which is the address of your computer. So the script will not be downloaded.

Here's why it won't always work:

- Iovation allow you to host the script yourself. So a company could choose to host the scripts internally on their own domains, meaning the URL won't be blocked as it isn't in the list below. This will get the script onto your machine, unless you add in the URL to that list.
- The first script contains calls to Iovation which WILL be blocked by the list below as they are included in it. However, all they have to do is release a new version of the script with different subdomains (i.e. mpsnare2.iovation.com) and it will go through. The hosts file in Windows does not support wildcards, so you would have to explicitly put in every single subdomain as an entry into this file.

There's probably a program you can download which will allow you to put in a wildcard ie. *.iovation.com - this would block everything to Iovation outgoing by repointing it at your machine.

However, anyone doing this would need to be really careful - it may also mean you suffer problems on other sites, such as when:

- applying for a loan, credit card etc
- finance agreements
- renewing insurance
- perhaps even online banking

Any site which uses Iovation (of which there are a growing number) may well reject whatever you are trying to do as they were unable to validate that your device does not pose a risk of fraud.
 
Last edited:
Just an advice, instead of that long winded list of hosts from iesnare(appreciate the effort whoever compiled it but...), just use Adblock Plus and create your own group of filters then place *.iesnare.* and *.iovation.* in a new filter. Thats it.
 
Last edited:
Back
Top