WhatsApp forwards about Rs 500 recharge is a spam link likely to steal your information

WhatsApp forwards claiming to provide you with Rs 500 as a balance are increasingly doing rounds of WhatsApp group messages. The messages claim that the Prime Minister Narendra Modi is giving Rs 500 cash or as Mobile recharge to everyone in the country as reported by IndiaToday. The URLs being circulated in the messages differ from region to region, but we have verified that the individuals behind it are using three main links to direct users to the same website with minor changes while the fourth link leads users to a different site but with the same idea. The four websites being circulated by the spammers include http://recharge-pack.com/, http://balance.modi-gov.in/, http://500recharge.in/ and http://recharge-promos.com/. We checked the records on the registrations of all the website and found that all the domains are no older than 17 November 2016 except the fourth website where we could not access complete details of the registration. [caption id=“attachment_355884” align=“aligncenter” width=“640”]  Welcome page asking you for your personal data.[/caption] None of the details indicates their affiliation with Government of India or any other telecom operator according to the data given on whois.domaintools.com, a reputed website to check domain registration of websites on the internet. The mobile numbers along with the organisations and names of the people under which the website is registered seem to be inaccurate except email IDs. In fact, almost all the websites have posted that “We are not connected to any telecom company” giving us confirmation about the entire thing being a scam. [caption id=“attachment_355887” align=“aligncenter” width=“640”]  Website Disclaimer[/caption] But for the sake of confirming our doubt, we used all the four websites and found that all four sites include three steps. In the first step, you have to enter your mobile number, operator and state. The second step involves sharing the link with 15 contacts which is technically asking the user to spam their contact lists or WhatsApp groups. The third step includes downloading an Android .apk app which is different in all the cases. One important thing is that despite differing names, the app is a rebranded or modded version of 9Apps, an app distribution platform made by Alibaba. [caption id=“attachment_355885” align=“aligncenter” width=“640”]  Second page asking you to spam your friends.[/caption] We downloaded the app being offered from Balance.modi-gov.in and extracted the contents of the app to check the resources in the app and any association with a website. The app gives away an email ID registered the domain fastOdia.com. sOdia.in was the email ID listed in the domaintools.com for the same site making us think that a third party website is using the app to increase their database, but we are no experts in the reasons behind a person or a group of people trying to make a fake website viral using WhatsApp forwards. [caption id=“attachment_355886” align=“aligncenter” width=“640”]  Last page asking you to install and Android app[/caption] All websites claim to use the app for 5 minutes and not uninstall the app for next five days else some Rs 500 as recharge will be void. We would like to add here that unless you use the app for five days, these is no sure way for any app to know how long it was kept in the system before uninstalling the app. Any app that tracks such behaviour is a spyware or at least an adware at best while tracking the usage habits without informing the users about it. The other interesting thing to note is that these websites seem to be exploiting a referral system for their gain in addition to adding ads and tracking the usage of the website using Google Analytics. It is a good practice not to share your data with websites that claim to give you such offers. The best method to determine is to check if the offer is too good to be true. In most cases where the offer is too good to be true, the underlying driving force behind the website is a scammy scheme.