We hear from long time that it is easy to breach human psychology as compare to robust software. Yes, WhatsApp Voice calling message floating around everyone’s whatsapp chat message is an example of breaching human psychology (social engineering) and spam as well. Before going into the depth, let me warn you again not to open whatappvoiceplus.com link even by mistake.

I had no intention to write this blog but I got at least 10 similar forwarded message from many of my friends and groups in whatsapp. Instead of telling everyone there that it’s nothing but a spam and can be an identity theft example, I thought to share it online with everyone.

Ok, so how this spam message looks like? Just see yourself at the below screenshot.

Well, WhatsApp has infact launched Voice call feature in its new version and many people have updated their whatsapp. They are even using this feature. To update and use this voice call feature you need to download latest version either from google play store or whatspp official site. Never ever try to install from anywhere else, if you want to be in safer side.  The only thing is to enable the voice calling feature, a user needs to get an invite or a WhatsApp voice call from someone who already has the feature activated in his/her mobile. Now here is what giving the space for spam and spammers don’t miss any such chances 😉

If you receive an invite as many of my friends are getting from a link that says ‘Hey, I am inviting you to try whatsapp Calling click here to activate now http://www.whatsappvoiceplus.com’. like as shown in above image.

Why to invite 10 contacts? Whatsapp would do such cheap things?

Please please please do not click on this link. If you are tempted to do so then after clicking on the link you will be redirected to some unknown IP address showing look and feel like whatsapp’s official site. Why the link is redirecting to an unknown IP Address (http://128.199.87.230/ )? If it would be whatsapp official site it would not redirect you, right?

There you will have an option to invite 10 friends to enable this feature, which will ask your friends to further invite 10 of their friends. Can you feel the pace of spreading spam here! Your just one forward will create more spam over whatsapp than whatever you think.

Again warning you don’t proceed after this! If you click on continue then you will see a message to invite your 10 contacts in whatsapp as shown in below image:

If you check carefully what these two button are doing at licking on it, you will find the below JavaScript code behind it.

<span id="line55">var c=getCookie("invites");
function fn1(x)
{
 ++c;
 setCookie("invites",c,10);
 if(c <= 10)
 {
 window.open("whatsapp://send?text=Hey, i am inviting you to try whatsapp calling click here to activate now --> http://www.whatsappvoiceplus.com/");
 }
 else
 window.open("survey.html"a);
 }
}</span></pre>
<pre><span id="line55">
function fn2(x)
{
 if(c >= 10)
 {
 window.open("survey.html")
 }
 else
 {
 window.alert("Please Invite atleast 10 friends to continue You have invited "+c);
 }
}
</span>

Now you got why you are getting this predefined message: “whatsapp://send?text=Hey, i am inviting you to try whatsapp calling click here to activate now –> http://www.whatsappvoiceplus.com/”

Why Survey, when I already invited 10 contacts (Smelling spam?) ?

These spammers will make their money by forcing you to go through multiple pages, advertisements surveys and finally you will have no voice calling feature but a bad luck of getting your mobile infected by adwares/malwares. So beware of such spam messages and don’t let these spammers a chance to woo you again.

Once you are done by making you other 10 friends victim of this spam, now they need you to do one more step to make them rich. Yes, you guessed it right!. By taking survey. seriously?

Once you are done with the survey, you will see the message like this.

I got above message because I opened spam link in my laptop’s browser instead of mobile 😉 Otherwise it would have shown any survey based ads from more than 10 ad services sites. If you see the request being sent when you open the survey page, you will be able to figure it out.

And when you will try to go away from this final page, you will finally see a congratulation message, yes only message although you won’t get voice call feature enabled in your mobile 😉 How cheap 😛

Who is behind this spam?

Ok, so we have two hostnames to start with one is whatsappvoiceplus.com and another is 128.199.87.230
After doing some google search and dns recon, I found below information which you will interest you 😉

1. The person behind this spam is non other than Karteek Munjal whose previous site is banned for spreading Fb spam i.e. crazyappsfacebook.com which was redirecting to karteekmunjal.eu which is registered to Karteek Munjal from New Delhi having karteek.munjal@gmail.com as registered email id there 🙂 We found from google profile many sites linked in his profile. Two of which are mr-munjal1.blogspot.in and mr-munjal.blogspot.in(inactive now)

2. Whatsappvoiceplus.com is redirecting to IP Address 128.199.87.230 hosted at digital ocean cloud server Whatsappvoiceplus.com is registered as of today 18^th March with bigrock.in

So, a final request yet the same request 🙂 When you see message like this, instead of clicking and doing all such non-sense thing simply delete and make your friends aware of this spam 🙂

Update on 21st March, 2015

Some people are getting similar message but this time the url is http://www.whatsappcl.com/
It looks this time it is targeting global instead of just India. This website is registered with Lisa alexa name under GoDaddy registrar , registered on 14th March, 2015. The location of the site owner is shown as Istanbul, Turkey. It has the same behaviour as of whatsappvoiceplus.com. It will ask you to invite 10 more friends to enable voice call feature. Once you invite your 10 friends it will redirect you to http://damnlink.com blog page via whatsappcl.com/active.php

The main purpose of this spam is to increase the site rank of damnlink in google by making as much clickcs as possible through this spam. When you click any post in damnlink, it will open a ad popup as well. This way they will earn money by fooling you 🙂 Damnlink was registered in Dec,2015

Happy Reading! Please like and share to make more people aware of this.