Friend got hacked, promoting survey scam - +86 184-0203-4524

Popup - http://dublxu.ventasdecomarmol.com/disney-me/?_t=1623862731648#1623862732894

A WhoIs lookup reveals the domain was registered in Baiyinshi, Gansu, China by siting Li on July 25, 2019 (updated on June 9, 2021) - Whois ventasdecomarmol.com

image

Associated phone number (China) - +86 184-0203-4524

Associated Email Address - [email protected]

Requires users to share the scam with 5 groups or 20 friends on WhatsApp (or in my case Facebook Messenger) to earn a “Disney 100th anniversary celebration gift” worth $3,000. Afterwards, users will be prompted to install a specific application and keep it open for 30 seconds. Problem is that the application is actually a “press allow to continue” popup that will crash your browser.

when you click on complete it will redirect you to a ad website