Table of contents
Summary
This is a phishing campaign that targets individuals during the month of Ramadan using WhatsApp messages. The attack begins with a message from a contact that contains a link to a fraudulent website posing as a competition organized by His Highness Sheikh Mohammed bin Rashid Al Maktoum, offering cash prizes for answering questions about Islam.
The fraudulent website then tricks users into providing their personal information, such as full name, gender, country, and mobile number, under the guise of claiming their prize. The website also requests users to share the link with their contacts on WhatsApp, further spreading the phishing campaign.
Background
These scams on WhatsApp have been there for many years, the first one I came across was back in 2016: urShadow’s Blog: Beware of Winning Voucher Link Received on WhatsApp, its Fake/Fraud/Scam (Updated)
I started capturing them on this post: urShadow’s Blog: Beware of Fake / Fraud / Scam Messages on WhatsApp
Ramadan Scam – Mohammed bin Rashid Ramadan Competition
These scams initially mimicked famous brands but evolved into targeting educational institutes (Post | LinkedIn), national or religious events, etc. One such scam I came across recently is targeting the month of Ramadan.
The phishing page is designed in the usual way to gather visitors’ information through a questionnaire. The gathered information is usually used in a phishing attack.
Anatomy of the Attack
A message is received on WhatsApp from any of your contacts that look like this:

“Urgent.. Mohammed bin Rashid Ramadan Competition🌙 Participate now, answer questions and win daily prizes 💵 Gifted by His Highness Sheikh Mohammed Bin Rashid Al Maktoum, Everyone is a winner. Hurry Up From here >> https[:]//mbr3[.]pages[.]dev/”
The link in the WhatsApp message opens a website (https[:]//emohammadbinramadan[.]pages[.]dev/#) with a pop-up with the following statement:

You have been selected from among the few to receive a financial award presented by His Highness Sheikh Mohammed bin Rashid Al Maktoum on the occasion of the holy month of Ramadan.
Click “OK” to claim your reward”
Clicking “OK” brings the main page with the following statement:

Clicking “Start Now” starts a quiz about Islam:




After completing the quiz, the website pretends to be processing the provided answers and then offers to provide cash prizes by playing a game:

You have answered 4/4 questions
Searching for prizes
Your answers are being processed”

Now you have a chance to win cash prizes
You must select the box that contains the prize inside
You have 3 attempts! Good Luck”

At the start, the game shows as if the chosen box is wrong. This is to pretend the authenticity of the scam.

You have (2) extra chances
The next attempt shows winning a cash prize:

You won a cash prize
The amount of (30,000 dollars) in cash
Follow the instructions below to claim your prize money”
Clicking “Get your prize” will open another page to gather personal information like Full Name, Country and Phone Number:

There are some checks to confirm that you are filling out the form correctly.
![moahmmedbin-shareen[.]pages[.]dev says Please fill in the data correctly!](https://i0.wp.com/theclearevidence.org/wp-content/uploads/2023/04/Beware-of-Ramadan-Related-Fraud-Messages-on-WhatsApp-12-of-18.jpg?resize=348%2C464&ssl=1)
The website even allows you to edit or confirm the entered information:

After entering the data, the website pretends to be processing the request:

After that the website requests to share the link with contacts on WhatsApp.

Please follow the last step to claim your prize
(1) Share it with 5 groups or 15 friends on WhatsApp (Click on the “SHARE” icon below).
(2) The contest support team will contact you on your registered phone number after the golden verification bar below is filled to send you the money immediately.”
After the link is shared with the requested number of contacts in WhatsApp, the next page (https[:]//moahmmedbin-shareen[.]pages[.]dev/) shows a few buttons which all redirect to other scam pages:


Personal Information Compromised
In the whole activity, the threat agent collected the following information:
- Full Name
- Mobile Number
- Gender
- Religion
- Country
- IP Address
- Browser Brand, Version, Extensions
- OS Brand, Version, Architecture
- Device Make, Size, Resolution
- Victim’s eagerness to acquire money through a shortcut
- Victim’s lack of understanding of cyber frauds/scams
This information can be used to design and launch a phishing / spear phishing / smishing attack.
Websites Analysis
- mohmmeadbenalrashideo8[.]pages[.]dev – Launch Date: 16th April 2023 – Reported and Taken Down
- mbitvi[.]pages[.]dev – Launch Date: 12th April 2023 – Reported and Taken Down
- mohammedbinrasheaden2[.]pages[.]dev – Launch Date: 12th April 2023 – Reported and Taken Down
- mbrtyun67[.]pages[.]dev – Launch Date: 11th April 2023 – Reported and Taken Down
- mbrtyun63[.]pages[.]dev – Launch Date: 10th April 2023 – Reported and Taken Down
- mbsevi[.]pages[.]dev – Launch Date: 10th April 2023 – Reported and Taken Down
- vmohammedbinrashead[.]pages[.]dev – Launch Date: 10th April 2023 – Reported and Taken Down
- lmohammedbinrashead[.]pages[.]dev – Launch Date: 9th April 2023 – Reported and Taken Down
- mbrtyun44[.]pages[.]dev – Launch Date: 9th April 2023 – Reported and Taken Down
- moahmmedbin-shareen2.pages.dev – Launch Date: 9th April 2023 – Reported and Taken Down
- mboevi[.]pages[.]dev – Launch Date: 8th April 2023 – Reported and Taken Down
- emohammadbinramadan[.]pages[.]dev – Launch Date: 1st April 2023 – Reported and Taken Down
- moahmmedbin-shareen[.]pages[.]dev – Launch Date: 30th March 2023 – Reported and Taken Down
- mbsvi[.]pages[.]dev – Launch Date: 30th March 2023 – Reported and Taken Down
- mbr3[.]pages[.]dev – Launch Date: 29th March 2023 – Reported and Taken Down
- moenvi[.]pages[.]dev – Launch Date: 29th March 2023 – Reported and Taken Down
Launch dates confirm that the scam has been specially designed for Ramadan 2023. But as the scam does not mention the year 2023 thus same scams can be used in future years.
Registrar: 101domain, Inc.
Registrant: Cloudflare, Inc.
Images Host: imgur.com
Development Environment: The websites have been developed using Cloudflare Pages, which is a JAMstack platform for front-end developers to collaborate and deploy websites. Several subdomains have been reported as phishing websites: Malwarebytes – pages.dev.
Recommendations
Phishing campaigns like this are illegal and unethical attempts to trick individuals into providing their personal information, which can be used for identity theft, fraud, and other malicious activities. Individuals need to be cautious and verify the legitimacy of any messages or links received on WhatsApp or other platforms, especially during events or occasions that may be targeted by scammers, such as Ramadan. Users should also be careful about sharing their personal information online and only provide it to trusted and legitimate sources.
Indicators of Compromise (IoC)
Domains
- dibab[.]click
- fireslaegrep[.]lol
- m-wlmw[.]com
- miveuptrk[.]pics
- ofaba[.]live
- okwiththate[.]quest
- onemortrk[.]pics
- r-q[.]media
- suptrkdisplay[.]com
- thebestoffers4you[.]net
- thingswinner[.]com
- turbomkst[.]art
- turbotrck[.]art
URLs
https[:]//1680972264[.]m-wlmw[.]com/af[.]php?hash=XrkxCrjdArrrZrCikAAGjCxCrjjNpkNGkNZxrCrCZZZCCrixCrrxCrCACppApCZiGGjGiAxCCr_75177&refferer=aHR0cHM6Ly9tb2FobW1lZGJpbi1zaGFyZWVuLnBhZ2VzLmRldi8=&user_agent=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMC4wLjAuMCBTYWZhcmkvNTM3LjM2&url78456=aHR0cHM6Ly9vZmFiYS5saXZlL2dvLnBocD9nbz1odHRwcyUzQSUyRiUyRmNkbi5yLXEubWVkaWElMkYlM0Z1dG1fbWVkaXVtJTNEMDJjZWVhMmI1YmZiNTM4N2Y0N2UwMDVjMmMxNTAyYTlmYmZkMTliNSUyNnV0bV9jYW1wYWlnbiUzRE1TLVNMLU5BJTI2Y2lkJTNEOTBhZmZDMTY4MDk3MjI2NGFmZmY4NzRiZGE0MTA3NjRhOTY3YTkwNyUyNjElM0QyOTQ3MTI0MCZkbz00OTkxNzlmZTQ2ZTAxYjkxMzU2MDFjZjI1ZWViNmUyOA==
https[:]//1680972302[.]m-wlmw[.]com/af[.]php?hash=XrkxCrjdArrrZrCikAAGjCxCrjjNpkNGkNZxrCrCZZZCCrixCrrxCrCACppApCZiGGjGiAxCCr_75177&refferer=aHR0cHM6Ly9tb2FobW1lZGJpbi1zaGFyZWVuLnBhZ2VzLmRldi8=&user_agent=TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMC4wLjAuMCBTYWZhcmkvNTM3LjM2&url78456=aHR0cHM6Ly9vZmFiYS5saXZlL2dvLnBocD9nbz1odHRwcyUzQSUyRiUyRmNkbi5yLXEubWVkaWElMkYlM0Z1dG1fbWVkaXVtJTNEMDJjZWVhMmI1YmZiNTM4N2Y0N2UwMDVjMmMxNTAyYTlmYmZkMTliNSUyNnV0bV9jYW1wYWlnbiUzRE1TLVNMLU5BJTI2Y2lkJTNEOTBhZmZDMTY4MDk3MjMwMmFmZjM1MjBlOTczNzEwNjZhODY2YTg1NSUyNjElM0QyOTQ3MTI0MCZkbz01NmMyNjBkYmQwMDExOWQ1MDY5NDNjMzlmY2E3YWY0Yg==
https[:]//1d7062874ed[.]thebestoffers4you[.]net/?p=1086&plid=58&plid_hmac=2afaa226dd0ae1902f2cb329a5b09a0f&wid=128305&wid_hmac=58bfd98bab4e9eb8d5cb81c1695d629a&click_id=BHqWk9UAAAGHYcFdQwAAaGYAACQ1AAAAAAAAAAAU
https[:]//1d706a1004e[.]thingswinner[.]com/billionaire-quiz?ctrack=1680972275[.]3307956340&traffic=eyJpdiI6Ik5sdDdsM0RsaHlhYmRCMGQ4c252MGc9PSIsInZhbHVlIjoiY0s5S3NsOWtCUHV5VEZGTDU0MVkzMU80VjVyZ2lzdTNVc2hmZWNDbjRpSXJCREVOYlNaV0RPdDNVdSswRVhvdyIsIm1hYyI6IjZjZmM2MWE2ZmEyZjU3OWI0MWVlNjdhMGE5NTY5N2EzZTA4YWUyOTk1MTJmMWQxMWNmNDkyZDNlYTFhMmEyOTEiLCJ0YWciOiIifQ%3D%3D&out=eyJpdiI6Indxb2ZFeHJjam5pRFhNOVFmZzBkaWc9PSIsInZhbHVlIjoiUERFdkEvanI4WUFWMWpmek4waDVDWkc5RVR3cStnMzRGQXBPV2NKblphZTd1TGpnRFBNVTdQWjVMZm4vQ2JBT1NxMVhJRkVGcEJxUVhCeE5YNzN1cHZaaXVsem9HbzZ4Nm4xbjdDUWpYUGpQYjNjM0xUSmZMWUlML3VsZmQyZnUyTFFRUFA3T0paTm44YlpodUxHUzV3SG1yQXVGckFXTFR5V2docncwalhCRXBwVVlZa1RabzZuYkt3LzNFM1grRjRsWlVwaXJLbFBncCtpZHZ1Z0NDQU1OY01DWHJpK21kOWpZdk1wVDBEOD0iLCJtYWMiOiI1NmY3ZDZkZTgyODI0MzVlMzg3YjFlOTJmMDI2YWEwNzVlYzFlMTJlMWU5NzQ3MTdmZjUyOTE3YjQ0YTIxMmM2IiwidGFnIjoiIn0%3D
https[:]//cdn[.]r-q[.]media/?utm_medium=02ceea2b5bfb5387f47e005c2c1502a9fbfd19b5&utm_campaign=MS-SL-NA&cid=90affC1680972264afff874bda410764a967a907&1=29471240
https[:]//cdn[.]r-q[.]media/?utm_medium=02ceea2b5bfb5387f47e005c2c1502a9fbfd19b5&utm_campaign=MS-SL-NA&cid=90affC1680972302aff3520e97371066a866a855&1=29471240
https[:]//cdn[.]r-q[.]media/?utm_term=7219720916559724623&ver=4viyaptcjo&utm_content=fdc2c69a9cafac9c9a9698a197979c95ba8fb8ccbecabcbd838b8589b6868484b98ba5b8b6bf8cbfb28380b0868784e9fbf5fceafdfeecf8bfe3e2f8fbf6e6eceadae8ae81808b8187c3a98f85c9e4d7cefbcacdfefffc89808695f1f6c6f4c4f3f9f8c9fffff4fdc2f0a4f7a2f6a2f6bbdbefecb8baece8e1e3e4b3e5b4e4e51a1d28292e1d1e181a1719111e111616030f000b3e0c0c0d0200020900050d01333c31393937
https[:]//cdn[.]r-q[.]media/?utm_term=7219721079768481850&ver=4viyaptcjo&utm_content=fdc2c69a9cafac9c9a9698a197979c95ba8fb8ccbecabcbd838b8589b6868484b98ba5b8b6bf8cbe8283b1818687e8e4f4ffebfaffeff9b0e2e1f9fcf7e5ed95dbebaf8681888088c2aa8e82c8e7d6d1fac9ccf9feff888f8796f0f1c7f7c5ccf8fbc8f8fef7fccdf1a7f6a5f7a1f7a4daecedbfbbefe9eee2e7b2e2b5e7e4e51c2b28291c1d1915161a10191015171c0e030a390d0f0c0d01010807040e000c3d32383ec6
https[:]//cdn[.]r-q[.]media/proc[.]php?376690d6e51125dd1d31e2f7fa81cb11339ef59b
https[:]//cdn[.]r-q[.]media/proc[.]php?58405c0c39562b043a901ed7ec5277257eda5e3f
https[:]//dibab[.]click/148bcf03fc/bb6bac9292/?campaign=VW1hZ2t3Z2xzdnVJSytUbWsxTU4vZz09&clicked=1&placementName=ROTATOR&cv=XrkxCrjdArrrZrCikAAGjCxCrjjNpkNGkNZxrCrCZZZCCrixCrrxCrCACppApCZiGGjGiAxCCr_75177&yxDom=Y2RuLXNlcnZlci5pbmZv_dffb114e096ea505e274a7665e6dd6a2&convertedAs=1&refferer=2247690940_aHR0cHM6Ly9tb2FobW1lZGJpbi1zaGFyZWVuLnBhZ2VzLmRldi8=&realRef=Rkl2eDFHVjRydlIyYzhQZStoZldtUU9MaHhyZDNjQlFqa1ZQeGNrVDdqST0=&ecpm_choosed=5&generic_choosed=4009&redirectInfo=Q1R4cTZBa3dkUkhhdkFQTU9ua3NOQT09
https[:]//emohammadbinramadan[.]pages[.]dev
https[:]//lmohammedbinrashead[.]pages[.]dev
https[:]//mboevi[.]pages[.]dev
https[:]//mbr3[.]pages[.]dev
https[:]//mbrtyun44[.]pages[.]dev
https[:]//mbrtyun63[.]pages[.]dev
https[:]//mbsevi[.]pages[.]dev
https[:]//mbsvi[.]pages[.]dev
https[:]//moahmmedbin-shareen[.]pages[.]dev
https[:]//moahmmedbin-shareen2[.]pages[.]dev
https[:]//moenvi[.]pages[.]dev
https[:]//nnn[.]turbomkst[.]art/?utm_medium=1df3ea4804fa4c2ad64e8ee69e833783f01d2784&utm_campaign=viewmore&cid=1077555983144930989&2=5503045&3=53&1=mdcsl
https[:]//nnn[.]turbomkst[.]art/?utm_medium=1df3ea4804fa4c2ad64e8ee69e833783f01d2784&utm_campaign=viewmore&cid=3920751241484771590&2=5467509&3=53&1=mdcsl
https[:]//nnn[.]turbomkst[.]art/?utm_term=7219721827092791390&ver=4viyaptcjo&utm_content=fdc2c69a9cafac9c9a9698a197979c95ba8fb8ccbecabcbd838b8589b6868484b98ba5b8b6bf8cbf8283b1818687e8e4f4ffebfaffeff9b0e2e1f9fcf7e5ed95dbebaf8681888088c2aa8e82c8e7d6d1fac9ccf9feff888f8796f0f1c7f7c5ccf8fbc8f8fef7fccdf1a7f6a5f7a1f7a4daecedbfbbefe9eee2e7b2e2b5e7e4e51c2b28291c1d1915161a10191015171c0e030a390d0d080c040602020507010c393d3f39c1
https[:]//nnn[.]turbomkst[.]art/?utm_term=7219721857157562382&ver=4viyaptcjo&utm_content=fdc2c69a9cafac9c9a9698a197979c95ba8fb8ccbecabcbd838b8589b6868484b98ba5b8b6bf8cbcb38380b0868784e9fbf5fceafdfeecf8bfe3e2f8fbf6e6eceadae8ae81808b8187c3a98f85c9e4d7cefbcacdfefffc89808695f1f6c6f4c4f3f9f8c9fffff4fdc2f0a4f7a2f6a2f6bbdbefecb8baece8e1e3e4b3e5b4e4e51a1d28292e1d1e181a1719111e111616030f000b3e0c0e09030505030504040033383e3e3e43
https[:]//nnn[.]turbomkst[.]art/proc[.]php?229a4458d3fa74d5b1fec8eb45addbadacdec54f
https[:]//nnn[.]turbomkst[.]art/proc[.]php?7e43e8ca08d393f39c24536ec8f31f27cd1c99cc
https[:]//ofaba[.]live/go[.]php?go=https%3A%2F%2Fcdn[.]r-q[.]media%2F%3Futm_medium%3D02ceea2b5bfb5387f47e005c2c1502a9fbfd19b5%26utm_campaign%3DMS-SL-NA%26cid%3D90affC1680972264afff874bda410764a967a907%261%3D29471240&do=499179fe46e01b9135601cf25eeb6e28
https[:]//ofaba[.]live/go[.]php?go=https%3A%2F%2Fcdn[.]r-q[.]media%2F%3Futm_medium%3D02ceea2b5bfb5387f47e005c2c1502a9fbfd19b5%26utm_campaign%3DMS-SL-NA%26cid%3D90affC1680972302aff3520e97371066a866a855%261%3D29471240&do=56c260dbd00119d506943c39fca7af4b
https[:]//tinyurl[.]com/36z7dc2a
https[:]//tinyurl[.]com/58cm4d3a
https[:]//vmohammedbinrashead[.]pages[.]dev
https[:]//wmw[.]okwiththate[.]quest/?utm_medium=4380b8af5455965347a14cc974463bff361d7753&utm_campaign=adult1&cid=3367234323936093122&2=5460198&3=53&1=adc
https[:]//www[.]fireslaegrep[.]lol/?sl=5460198-d7cee&eyeg=3
https[:]//www[.]miveuptrk[.]pics/?sl=5459258-9a9a4&eyeg=3
https[:]//www[.]onemortrk[.]pics/?sl=5554398-69c03&data1=Track1&data2=Track2&tag={External_ID_from_traffic_source}&website={subID}&placement={sub_subID
https[:]//www[.]onemortrk[.]pics/?sl=5554398-69c03&data1=Track1&data2=Track2&tag={External_ID_from_traffic_source}&website={subID}&placement={sub_subID}&eyeg=0880c0e4b3005f72691d92d5ffe14bd1&eyer=0[.]4998920532463922&eyei=0&eyew=1858&eyeh=1013&eyetd=210&eyef=moahmmedbin-shareen[.]pages[.]dev
https[:]//www[.]suptrkdisplay[.]com/click?offer_id=24911&pub_id=9269&pub_sub_sub_id=9&unique1=5564921-b2be6&app=test&pub_click_id=M7219721079768481850&site=21977-1d18470f&pub_sub_id=21977&unique2=Track1&unique3=Track2
https[:]//www[.]suptrkdisplay[.]com/click?offer_id=25860&pub_id=9269&pub_sub_sub_id=9&unique1=5564921-b2be6&app=test&pub_click_id=M7219721857157562382&site=19854-ace2091b-346ab5c2&pub_sub_id=19854&unique2=Track1&unique3=Track2
https[:]//www[.]suptrkdisplay[.]com/click?offer_id=26352&pub_id=9269&pub_sub_sub_id=9&unique1=5564921-b2be6&app=test&pub_click_id=M7219721827092791390&site=19854-ace2091b-4a1c7be4&pub_sub_id=19854&unique2=Track1&unique3=Track2
https[:]//www[.]suptrkdisplay[.]com/click?offer_id=26472&pub_id=134081&pub_sub_sub_id=9&unique1=5554398-69c03&app=test&pub_click_id={External_ID_from_traffic_source}&site={subID}&pub_sub_id={sub_subID}&unique2=Track1&unique3=Track2
https[:]//www[.]suptrkdisplay[.]com/click?offer_id=26726&pub_id=9269&pub_sub_sub_id=9&unique1=5564921-b2be6&app=opt&pub_click_id=M7219720916559724623&site=21977-1d18470f&pub_sub_id=21977&unique2=Track1&unique3=Track2
https[:]//www[.]turbotrck[.]art/?sl=5564921-b2be6&data1=Track1&data2=Track2&tag=M7219720916559724623&website=21977-1d18470f&placement=21977&utm_content=fdc2c69a9cafac9c9a9698a197979c95ba8fb8ccbecabcbd838b8589b6868484b98ba5b8b6bf8cbf8283b1818687e8e4f4ffebfaffeff9b0e2e1f9fcf7e5ed95dbebaf8681888088c2aa8e82c8e7d6d1fac9ccf9feff9a9c9e8095f1f6c6f4c4f3f9f8c9fffff4fdc2c3c0c1c6f5f6f0e2efe1e9e6e9eeeeebe7e8e3fe
https[:]//www[.]turbotrck[.]art/?sl=5564921-b2be6&data1=Track1&data2=Track2&tag=M7219720916559724623&website=21977-1d18470f&placement=21977&utm_content=fdc2c69a9cafac9c9a9698a197979c95ba8fb8ccbecabcbd838b8589b6868484b98ba5b8b6bf8cbf8283b1818687e8e4f4ffebfaffeff9b0e2e1f9fcf7e5ed95dbebaf8681888088c2aa8e82c8e7d6d1fac9ccf9feff9a9c9e8095f1f6c6f4c4f3f9f8c9fffff4fdc2c3c0c1c6f5f6f0e2efe1e9e6e9eeeeebe7e8e3fe&eyeg=221ca84df4b626c7134e53aaa3b580ac&eyer=0[.]9933849285403364&eyei=0&eyew=1858&eyeh=1013&eyetd=210&eyef=cdn[.]r-q[.]media
https[:]//www[.]turbotrck[.]art/?sl=5564921-b2be6&data1=Track1&data2=Track2&tag=M7219721079768481850&website=21977-1d18470f&placement=21977&utm_content=fdc2c69a9cafac9c9a9698a197979c95ba8fb8ccbecabcbd838b8589b6868484b98ba5b8b6bf8cbf8283b1818687e8e4f4ffebfaffeff9b0e2e1f9fcf7e5ed95dbebaf8681888088c2aa8e82c8e7d6d1fac9ccf9feff9a9c9e8095f1f6c6f4c4f3f9f8c9fffff4fdc2c3c0c1c6f5f6f0e2efe1e9e6e9eeeeebe7e8e3fe
https[:]//www[.]turbotrck[.]art/?sl=5564921-b2be6&data1=Track1&data2=Track2&tag=M7219721079768481850&website=21977-1d18470f&placement=21977&utm_content=fdc2c69a9cafac9c9a9698a197979c95ba8fb8ccbecabcbd838b8589b6868484b98ba5b8b6bf8cbf8283b1818687e8e4f4ffebfaffeff9b0e2e1f9fcf7e5ed95dbebaf8681888088c2aa8e82c8e7d6d1fac9ccf9feff9a9c9e8095f1f6c6f4c4f3f9f8c9fffff4fdc2c3c0c1c6f5f6f0e2efe1e9e6e9eeeeebe7e8e3fe&eyeg=d0c96bfb4e60fd33b62fb56d691918ed&eyer=0[.]6961515546382122&eyei=0&eyew=1858&eyeh=1013&eyetd=210&eyef=cdn[.]r-q[.]media
https[:]//www[.]turbotrck[.]art/?sl=5564921-b2be6&data1=Track1&data2=Track2&tag=M7219721827092791390&website=19854-ace2091b-4a1c7be4&placement=19854&utm_content=fdc2c69a9cafac9c9a9698a197979c95ba8fb8ccbecabcbd838b8589b6868484b98ba5b8b6bf8cb58283b1818687e8e4f4ffebfaffeff9b0e2e1f9fcf7e5ed95dbebaf8681888088c2aa8e82c8e7d6d1fac9ccf9feff9a9c9e8095f1f6c6f4c4f3f9f8c9fffff4fdc2c3c0c1c6f5f6f0e2efe1e9e6e9eeeeebe7e8e3f4
https[:]//www[.]turbotrck[.]art/?sl=5564921-b2be6&data1=Track1&data2=Track2&tag=M7219721827092791390&website=19854-ace2091b-4a1c7be4&placement=19854&utm_content=fdc2c69a9cafac9c9a9698a197979c95ba8fb8ccbecabcbd838b8589b6868484b98ba5b8b6bf8cb58283b1818687e8e4f4ffebfaffeff9b0e2e1f9fcf7e5ed95dbebaf8681888088c2aa8e82c8e7d6d1fac9ccf9feff9a9c9e8095f1f6c6f4c4f3f9f8c9fffff4fdc2c3c0c1c6f5f6f0e2efe1e9e6e9eeeeebe7e8e3f4&eyeg=442f887a514877ff07b73557a39dfb1a&eyer=0[.]556218074117732&eyei=0&eyew=1858&eyeh=1013&eyetd=210&eyef=nnn[.]turbomkst[.]art
https[:]//www[.]turbotrck[.]art/?sl=5564921-b2be6&data1=Track1&data2=Track2&tag=M7219721857157562382&website=19854-ace2091b-346ab5c2&placement=19854&utm_content=fdc2c69a9cafac9c9a9698a197979c95ba8fb8ccbecabcbd838b8589b6868484b98ba5b8b6bf8cb88283b1818687e8e4f4ffebfaffeff9b0e2e1f9fcf7e5ed95dbebaf8681888088c2aa8e82c8e7d6d1fac9ccf9feff9a9c9e8095f1f6c6f4c4f3f9f8c9fffff4fdc2c3c0c1c6f5f6f0e2efe1e9e6e9eeeeebe7e8e3f7
https[:]//www[.]turbotrck[.]art/?sl=5564921-b2be6&data1=Track1&data2=Track2&tag=M7219721857157562382&website=19854-ace2091b-346ab5c2&placement=19854&utm_content=fdc2c69a9cafac9c9a9698a197979c95ba8fb8ccbecabcbd838b8589b6868484b98ba5b8b6bf8cb88283b1818687e8e4f4ffebfaffeff9b0e2e1f9fcf7e5ed95dbebaf8681888088c2aa8e82c8e7d6d1fac9ccf9feff9a9c9e8095f1f6c6f4c4f3f9f8c9fffff4fdc2c3c0c1c6f5f6f0e2efe1e9e6e9eeeeebe7e8e3f7&eyeg=830d031faf5b86bbae2c72832f6f9b92&eyer=0[.]8641035699282869&eyei=0&eyew=1858&eyeh=1013&eyetd=210&eyef=nnn[.]turbomkst[.]art
https[:]//tinyurl[.]com/3p7a6bmp
https[:]//mbitvi[.]pages[.]dev
https[:]//mbrtyun63[.]pages[.]dev
https[:]//mbrtyun67[.]pages[.]dev
https[:]//mohmmeadbenalrashideo8[.]pages[.]dev
https[:]//tinyurl[.]com/58cm4d3a
Uzair says
I am poor man please send money 😥
Nauman Khan says
Wajahat Ali Khan commented on WhatsApp: “JazakumAllah khair”
Nauman Khan says
Javed Sajid commented on WhatsApp: “👍🏻”
Nauman Khan says
Saima Akmal commented on WhatsApp: “Okkkk”
Nauman Khan says
Usman Iftikhar commented on WhatsApp: “🙏”
Nauman Khan says
Syed Adil commented on WhatsApp: “👍”
Nauman Khan says
Ali Asghar commented on WhatsApp: “😮 It is ultimate , I see the links shared by other on groups look like very official, i m sure hundreds of thousands give there personal info there”
Nauman Khan says
Masood Khan commented on WhatsApp: “It’s the season for the Spam in name of Ramadan including zakat”
Nauman Khan says
Muhammad Abubakar Khan commented on WhatsApp: “جزاکم اللہ خیرا”
Nauman Khan says
Shafqat Ullah Khan commented on WhatsApp: “jazakAllah khair”
Nauman Khan says
Nasir Ghafoor commented on WhatsApp: “👍 jazakAllah khair”
Nauman Khan says
Muhammad Ali Sohail commented on WhatsApp: “Jizakallah nouman bhai
Very useful heads-up”