Today, we’re going to look at another site which wants you to fire up Whatsapp and spam messages to friends [1], [2] in order to claim a prize. In this case, the route to victory involves their so-called Lucky Wheel.
The Bit.ly URL
bit(dot)ly/globalwheel
has been doing a roaring trade in clicks since the 7th of July, with a total of 432,205 clicks so far:
The shortened link leads to
xfgnh(dot)trackvoluum(dot)com/58ba40d7-5485-44c1-8150-020da320e90a
which redirects to
luckywheel(dot)mobpromo(dot)net/iphone/lp4/index.html/[long string removed]
What could this wheel possibly be? The answer is a Facebook styled page offering up a clickable spinning wheel “competition”, designed to entice visitors into playing along.
Spin the lucky wheel!Only this Tuesday we give our members 1 free spin for a chance to win exclusive prizes!
Spin the wheel and you may win exclusive prizes!
Click OK to start the game!
Hitting the spin button will bring up the first of many dialogue boxes:
You won 1 free extra spin!
You’ll “win” this extra spin every single time you play. Don’t pause for breath, it’s time for another dialogue box!
Congratulations! Your possible prize: the new Samsung S6! Please follow the instructions to win your prize!
…”possible”. Well, there’s a somewhat more ambiguous “You’ve definitely won a thing” message than I’m accustomed to seeing.
Your Samsung S6 has been reservedTell 10 friends on Whatsapp about the "Lucky Wheel!"
At this point, you need to send out spam to your friends. They add a splash of pressure by saying the offer is valid for 300 seconds only, so you’ll need fingers of flame to fire out the required amount of messages in time. The countdown timer is worthless anyway; you can let it expire and still send out the spam. Here’s the message in question:
Have you seen this lucky wheel thing? [bit.ly url]
Once 10 people have been spammed (and likely removed you from their contacts forever), the following message is displayed. As you can tell, this website really loves dialogue boxes:
Your Samsung S6 has been reserved.Verify your phone number on the next page to claim your prize!
Hang on, “Download available”? Why has my Samsung S6 turned into a Windows download? Oh well, better hit the Download button and see what happens…
Why has my Windows download turned into a dating site? Am I supposed to be downloading the smiling couple? Maybe they have a phone I can use. This whole Lucky Wheel business is become very confusing – maybe I’m spinning the Unlucky Wheel by mistake.
As it turns out, multiple random destinations are the order of the day with this one and we wound up in a variety of locations after going back and retesting the site. Here’s a file called “Flashplayerupdate-setup.exe” from an otherwise blank page:
Users of Malwarebytes Anti-Malware will find we detect this particular file as PUP.Optional.DownloadAdmin. We also saw messages which claimed we needed to “Upgrade our mobile to the latest version” (no mean feat when you’re on a desktop), a Flash games website and another dating splash which said “This site contains photos of someone you know”. On the bright side, that means you won’t need to call them.
No matter what we did, we saw no sign of the Samsung and are now busily making one out of papier mâché and bits of string.
As for the Lucky Wheel, it would appear that if you expect to receive the promised gifts you are most definitely all out of luck.
Christopher Boyd
