Someone sent me a URL via WhatsApp (
httpx://cadburys-prizes[.]com) that allegedly lets me claim a free box of chocolates. Obviously this is fake and I've seen similar websites before.
If I view the URL on my phone I end up at
httpx://cadburys-prizes[dot]com/#forward where I'm prompted to answer some questions and then spam my WA contacts with further messages.
Viewing the source code for the page (by wget'ting it) , I can see a redirect to a bit.ly address. When I open the
cadburys-prizes[.]com url on a (sanitized, virtual) desktop browser I get redirected to the bit.ly address which, judging from the URL, is a fake tech support site (the content is getting blocked by my network defences but I can imagine the scene).
What I don't understand is where the survey that shows on iPhone comes from? There is nothing I can see in the source of that page. Is it possible for an invisible proxy to be presenting a different index.html based on the user agent string? I did try to wget the page with mobile Safari UA but got the same result as without it.