Recently, a new phishing scam has been circulating on WhatsApp, claiming to celebrate the “India Post 170th Anniversary.” The message includes a shortened URL, such as https://tinyurl.com/lndiaPost-1164
which redirects unsuspecting users to a fraudulent website: https://indiapost37.pages.dev/22602976.
This website impersonates India Post, one of India’s largest postal networks, in an attempt to steal users’ personal information. Here’s a breakdown of how the scam works and how to stay protected:
How the Scam Works
- The Message: It starts with a WhatsApp message claiming that India Post is celebrating its 170th anniversary with special prizes. This message contains a shortened link that appears legitimate at first glance, using the name “India Post” to gain trust.
- The Phishing Website: Once the link is opened, it redirects to a webpage mimicking the official India Post website, complete with logos and branding. However, this page is hosted on a suspicious domain (
pages.dev), which is a clear red flag that it is not an official India Post site. - Fake Questionnaire: The page presents users with simple questions such as:
- What is your age?
- What is your gender?
- Do you know about India Post?
The goal here is to keep the user engaged while also making the scam seem more legitimate.
4. “Prize” Announcement: After answering the questions, users are prompted with a pop-up claiming they have won a large amount of money—typically in the range of INR 62,478.55. This is an attempt to excite users and push them to the next step, which involves sharing more sensitive information.
5. Request for Personal Information: To claim the so-called prize, users are then asked to provide personal details such as their email address and mobile number. This is the final stage where the scammers collect information that could be used for future phishing attacks, identity theft, or selling the data to other cybercriminals.
Key Red Flags to Recognize the Scam
- Unfamiliar Domain Name: The genuine India Post website domain is
indiapost.gov.in. Any other domain should be considered suspicious. - Requests for Personal Information: Government institutions rarely ask for personal details through unsolicited messages or unverified websites.
- Too Good to Be True Prizes: Randomly winning large sums of money without prior participation is a classic sign of a scam.
To further investigate the legitimacy of these URLs, we can utilize VirusTotal, an online tool for checking websites and files for potential threats. Upon submitting both URLs
https://tinyurl.com/lndiaPost-1164 and https://indiapost37.pages.dev/2260297 VirusTotal scans them against multiple security databases and provides a report with detailed insights. In this case, the report reveals that both URLs have been flagged by several security vendors as malicious or phishing sites. Screenshots from VirusTotal show clear warnings of suspicious behavior, confirming that these URLs are designed to deceive users into revealing personal information. This evidence underscores the importance of checking untrusted links on reputable scanning platforms before clicking them.
How to Stay Safe
- Avoid Clicking Suspicious Links: Never click on links sent from unknown numbers, especially those that seem promotional or too good to be true.
- Verify with Official Sources: Go directly to the official India Post website (
indiapost.gov.in) or contact them directly to confirm any offers. - Report Phishing Attempts: If you receive such a message, report it on WhatsApp and avoid forwarding it to others.
- Educate Others: Share this information with friends and family to prevent them from falling victim to similar scams.
Conclusion
Phishing scams like these take advantage of people’s trust and curiosity. By staying alert and following best practices online, you can avoid falling prey to such fraudulent schemes. Always verify links and offers directly with official organizations and be cautious of any request for personal information from unverified sources.
Stay safe and share awareness—your vigilance is your best defense!
Reference:
Any.run Report on the analysis
Article Link: Beware of the “India Post 170th Anniversary” WhatsApp Scam – Malware Analysis