# MA-1037.022024: MyCERT Alert - Bogus Gaza Petition Link

**Date:** 28 Feb 2024  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-1037.022024  
**Advisory ID:** MA-1037.022024

---

**1.0 Introduction**
The Cyber999 Incident Response Centre has received several incidents recently targeting Malaysian Internet users with bogus Gaza Petition message link that are being circulated on WhatsApp and other major messaging platforms that promise to stop the Gaza War.  This petition asks Internet users to help end Israel's attacks on Gaza, but the source of this petition is unknown. As a preventive measure, CyberSecurity Malaysia releases this alert to advise internet user in Malaysia to take necessary steps to secure their systems against unwanted incidents as well as other security threats.
*Figure 1:**Petition (hxxps[:]//30gbbonus[.]xyz/onlinegazapetition[.]html) from an unknown source asks Internet users to Help end Israel's attacks on Gaza.Below are the details of the Gaza Petition Link:**(hxxps[:]//30gbbonus[.]xyz/onlinegazapetition[.]html)Domain Name: 30GBBONUS.XYZRegistry Domain ID: D423784188-CNICRegistrar WHOIS Server: whois.namecheap.comRegistrar URL: https://namecheap.comUpdated Date: 2024-01-26T11:22:28.0ZCreation Date: 2024-01-10T14:14:32.0ZRegistry Expiry Date: 2025-01-10T23:59:59.0ZRegistrar: NamecheapRegistrar IANA ID: 1068Domain Status: serverTransferProhibited https://icann.org/epp#serverTransferProhibitedDomain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibitedRegistrant Organization: Privacy service provided by Withheld for Privacy ehfRegistrant State/Province: Capital RegionRegistrant Country: ISIP Address: 185.199.110.153185.199.109.153185.199.111.153185.199.108.153*2.0 Impact**
A user could possibly auto-spread the link to a WhatsApp contact when users click on the share petition button.  
**3.0 Technical Details**
Clicking on the petition link didn’t show any visible suspicious behaviour such as malware or phishing. However, analysing the URL statically showed that the URL was diverted to other un
*Figure 2: The interface the user sees once they click on the Gaza petition link.Figure 3: Once click on the ‘Start Petition’, the user is required to submit their name.Figure 4: After entering user’s name, a user asked to share this petition link with other friends via WhatsApp.Figure 5: Even if the user clicks on the ‘cancel’ and then ‘share’, the percentage still increases.Figure 6: Once hit 100%, the user will buttons to this page where the user can ‘Submit’ or ‘Cancel’ the petition.*
Once, the user clicks on ‘Submit Petition’ or ‘Cancel Petition’, the page will redirect to another link.
*Figure 7: Shows the redirected link if the mouse is placed on the ‘Submit Petition’ button.Figure 8: Shows the redirected link if the mouse is placed on the ‘Cancel Petition’ button.Figure 9: Shows the redirected page once click on either of the button.Below are the details of the redirected link:**(https://scholly-relief-fund.blogspot.com/#1705037068571). Based on our analysis, this link is not embedded with malware or phishing website.Domain Name: BLOGSPOT.COMRegistry Domain ID: 32160240\_DOMAIN\_COM-VRSNRegistrar WHOIS Server: whois.markmonitor.comRegistrar URL:* [*http://www.markmonitor.com*](http://www.markmonitor.com)
*Updated Date: 2023-06-29T10:00:58ZCreation Date: 2000-07-31T21:38:58ZRegistry Expiry Date: 2024-07-31T21:38:58ZRegistrar: MarkMonitor Inc.Registrar IANA ID: 292IP Address: 142.250.115.132*4.0 Recommendation**
Way of prevention, there are several steps you can take to mitigate the chances of falling victim to similar schemes in the future:
- Never click on links or attachments that you received via an unsolicited message or from someone you don’t know or know before the link is confirmed safe.
- Only open links from a legitimate website or from trusted sources.
- Always use reputable and up-to-date security solutions.
- Be wary of what kinds of permissions you grant for a website.
- Delete the fake/bogus link and report the message to WhatsApp.
- Scan your devices regularly with a reputable and up-to-date antivirus/anti-spyware to ensure that the device is clean.
- Report any such incidents or any enquiries 
Generally, CyberSecurity Malaysia advises the users to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact us through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours)  
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: [https://www.mycert.org.my](https://www.mycert.org.my/) 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0 References**
<https://www.ionos.com/digitalguide/online-marketing/online-sales/click-fraud-how-to-out-fraudulent-clicks/>