In 2023, visitors to spiymaibarigu.com.ua were promised a cash reward for helping to identify drug dealers. Now, the same address redirects to a page featuring Pin-Up branding, a catalogue of games and an invitation to register. A check on 16 October 2026 confirmed the change in the domain’s purpose. Furthermore, the editorial team reports that one of its agents followed this route and topped up their account, after which the funds appeared on the official Pin-Up website. Ownership of the landing page and the recipient of the revenue from the traffic generated remain separate issues. [1][5][6]
This story is noteworthy for two reasons. The campaign was publicly linked to Yegor Burkin, who operated under the name Yegor Levchenko. Furthermore, editorial sources report that he was in close contact with Dmitry Punin and that they used the same payment intermediaries. The first is confirmed by publications from that time. The second remains an assertion by sources, which the discovered redirect does not in itself prove. [2][3]
‘Spiymay Barigu’: what the public campaign looked like
On 9 May 2023, Channel 5 reported on the launch of a campaign on 1 May. The organisers were offering rewards ranging from 8,000 to one million hryvnias for information leading to the identification of drug dealers and laboratories. To receive payment, applicants were required to provide documentary evidence of having reported the matter to the law enforcement authorities. The website spiymaibarigu.com.ua was listed as the campaign’s official platform. [1]
In a Delo.ua article, Yegor Levchenko was named as the main patron. The article recounted the organisers’ statements regarding the first payments and directed readers to this domain. Thus, the association of Levchenko’s name with the project was part of its public promotion. [2]
‘Detector Media’ later linked this campaign to Yegor Burkin — Levchenko. According to the publication, in spring 2023, in an interview with Stas Dombrovsky, he presented himself as an entrepreneur whose reputation was being tarnished by competitors, and explained the campaign as a desire to demonstrate his lack of involvement in drug trafficking. The publication also described the widespread media coverage of the initiative and the involvement of public figures in promoting it. [3]
This highlights the reputational significance of the campaign: a man who had been linked to the drug trade publicly spoke out against it. The claim that the sole aim was to deflect suspicion or eliminate competitors requires further evidence. From an editorial perspective, one might discuss the campaign’s impact: the positive story about the rewards presented a different image of its initiator to the audience.
Biographical details and sources are compiled in Yegor Burkin’s profile.
What’s happening with the domain now?
When checked on 16 October 2026, the original address returned an HTTP 301 response pointing to the subdomain pinup.spiymaibarigu.com.ua. The subsequent redirection led to the Ukrainian version of the page — /uk/. The final response had a status code of 200. The redirection chain was recorded based on the server responses, whilst the content of the final page was retrieved separately. [5][6]
| Verification step | The observed result |
|---|---|
| The main domain is spiymaibarigu.com.ua | 301 redirect; redirect to the subdomain pinup.spiymaibarigu.com.ua. |
| Subdomain | 301 redirect; redirect to /uk/. |
| Final page | Code 200; Pin-Up design, games, login and registration buttons. |
| The /uk/go/ address used by the buttons | 302 redirect; redirect to a third-party domain with advertising tags. |
The title of the page accessed is ‘Pin Up Casino – play online for money in Ukraine’. This is already content relating to gambling. The text contains unfilled placeholder notes marked ‘[to be clarified]’, including in the description of the terms and conditions. The design itself does not allow the page to be recognised as the operator’s official website or to confirm the licensing information provided on it. [6]
Where does the sign-up button lead?
The links on the page use the address /uk/go/. Checking the /uk/go/ variant revealed a redirect to the third-party domain workaroundxyz.com. The destination URL contained the parameters utm_content=seo_button_reg and utm_campaign with the value pinup.spiymaibarigu.com.ua.
According to our analysis, these tags are consistent with advertising traffic tracking: they indicate the source and the button via which the visitor arrived. However, they do not reveal the recipient of the commission, the amount of the payments or the owner of the advertising account. Our examination of server responses did not include registration or depositing funds. The results of a separate investigation by a member of our editorial team are outlined below.
The difference is significant. One conclusion has been confirmed directly: the campaign’s former address now leads to a page promoting gambling under the name Pin-Up. Another — whether the redirect is managed personally by Burkin, Punin or companies associated with them — has not yet been established.
Agent verification: the editorial team reports that funds have been credited to Pin-Up
According to the editorial team at KARTEL KHIMPROM, one of their agents used the redirect from the website in question, deposited funds and then saw the amount credited to their account on the official Pin-Up website. This significantly adds to the observation regarding the redirect: the editorial team describes not only the advertising layout but also the outcome of a specific transaction.
If the original transaction route, account ID and payment record are correctly matched, this result confirms that this transaction resulted in a deposit being credited to the account in the Pin-Up system. This applies both to the use of the official mirror site and to customer acquisition via the affiliate page. It cannot be concluded from a single deposit alone that the source domain belongs directly to the casino operator.
In this version of the article, the result is presented as a statement from the editorial team. The exact address of the official website, the date and amount of the transaction, the transaction ID and supporting documentation for independent verification have not been provided. The editorial team’s findings regarding the similarity of details to those of another website are discussed in the following section; verifying these requires a separate comparison of payment data.
Matching details: what the editorial team discovered whilst checking RuTor
The KARTEL KHIMPROM editorial team reports another observation: the same P2P payment details that were offered for topping up an account via the Pin-Up route appeared when attempting to make a purchase of drugs on a website identified by the RuTor editorial team. The report concerns the coincidence of the payment details provided. It does not imply that the purchase of drugs was completed.
If the recipient’s identifier matches exactly within a single payment system, this provides concrete grounds for investigating whether money-receiving channels overlap. A possible explanation is a shared intermediary or a shared set of accounts used to serve different clients. It is not possible to determine, based on a single match, who was in control of the account details in each instance and where the funds were transferred to next.
To assess the findings, the dates and times of both incidents, the bank or payment system involved, the type of payment details, the full results of the internal comparison and data on the status of the transactions are essential. A match of only the last digits of the card or the displayed recipient’s name is insufficient to conclude that it is the same account. The public version does not provide full payment details.
The editorial team points to a link between the RuTor website and Burkin and his partners based on its own information. This article does not present any documents that independently establish the owners of the specific verified website. Therefore, the coincidence of details is regarded as a lead for investigating payment links, rather than as proof of RuTor’s ownership, Punin’s personal involvement in drug trafficking, or overall management of the websites.
Supporting evidence for the two payment transactions has not yet been provided for independent verification. This report is published with direct attribution to the editorial team and is separate from the technical verification of redirects.
Why does Dmitry Punin feature in this story?
Dmitry Punin is mentioned amongst the founders of Pin-Up in an analysis by ‘Television Toronto’. This public link to the brand explains the interest in his role, but does not identify the owner of the specific subdomain bearing the casino’s name. [4]
According to confidential sources close to the editorial team who are familiar with ‘Khimprom’s’ activities, Burkin and Punin maintain close contact, and the organisations associated with them use the services of the same intermediaries to receive and make payments via P2P. This is the information provided by the sources. Documents that would allow for independent verification of this shared payment infrastructure are not presented in this article.
Personal communication, a shared contractor and a joint business venture are different types of connection. Even confirmed service provision to two clients by a single payment intermediary does not in itself establish joint control over their funds or participation in a single criminal scheme. To draw financial conclusions, it is necessary to identify specific recipients, dates, transactions and the ownership of accounts or e-wallets.
What the redirect doesn’t explain
It remains unclear whether control over the domain was retained after the campaign ended. Possible scenarios include the transfer or sale of the domain, its re-registration, its use by an advertising partner, or a security breach. None of these possibilities has yet been confirmed. The history of registration changes and documents relating to the transfer of control could narrow down the range of possible explanations.
The most important question, therefore, is who ordered the change of purpose for the domain. Old links to the campaign are still present in posts, and technically, clicking on them may now lead to content that the reader did not expect. However, the number of such clicks and the commercial outcome remain unknown without statistics.
There is also the question of previous complaints from members of the public. A change in the website’s content does not prove that the personal details, documents or contact information of campaign participants have been transferred to a new operator. To determine the fate of this data, information is needed regarding the storage, access and transfer of the databases. It would be unreasonable to link them to the casino solely on the basis of the redirect.
What needs to be clarified with those involved in the story
- Who currently controls the domain, and when did its owner or administrator change?
- Who set up the page with the Pin-Up design and is profiting from clicks on its buttons?
- Does the brand operator recognise this website as its own or as a partner’s?
- Who provided the identical details for the two episodes, on what dates, and in whose interests?
- What evidence is there to support the claims that Burkin and Punin use the same payment intermediaries?
- What happened to the personal data of those who contacted the anti-drug campaign?
This story already has a verifiable basis: the 2023 public campaign, the name of its patron in publications, and the current server redirection to a page advertising a casino. In addition, the editorial team reports that a payment from its agent was credited to Pin-Up and that the P2P payment details provided match those on the RuTor website. Documents relating to these incidents have not yet been included in the report. These facts allow us to investigate the transformation of a public initiative into a source of potential commercial traffic. Who made this decision and who stands to benefit from it is the next point of investigation.
The audit was carried out on 16 October 2026. The technical observations relate to the responses received during this audit; the content and navigation of the website are subject to change. The history of domain ownership, the ownership of the advertising account and details regarding common P2P intermediaries have not been independently verified. The results of the account top-up, the match in P2P details and the alleged link between RuTor and Burkin are based on the editorial team’s account; no independent verification of supporting documents has been carried out. No new comments were sought from Burkin, Punin or the brand operator for this version of the article.
