Tinyurl4.ru Whatsapp Scam (Virus removal guide)

Is Tinyurl4.ru a Scam?

Tinyurl4.ru Whatsapp Scam is a phishing scam that is similar to Tinyurl5.ru, which we analyzed earlier. Victims receive a link in a chat (WhatsApp or Telegram), often from friends, as scammers use the Chain-letter method, click on the link and find a familiar image of the Milka brand with an inviting message: Willkommen zum Milka Halloween-Geshenkewettbewerb (Welcome to the Milka Halloween Gift Contest).

Of course, it’s all fake. Milka is not running a giveaway on Whatsapp (Telegram) and is not associated with the Tinyurl4.ru site in any way. Tinyurl4.ru scam is used to trick users into giving away their personal information and even financial information.

Text presented in the scam message:

Hallo,

Willkommen zum Milka Halloween-Geshenkewettbewerb.

Mach das kurze Quiz, finde den versteckten Geist und
gewinne einen exklusiven Milka-Schokoladenkorb!

247 Geschenke übrig.

Hello,

Welcome to the Milka Halloween Gift Contest.

Take the short quiz, find the hidden ghost and
win an exclusive Milka chocolate basket!

247 gifts left.

Tinyurl4.ru Whatsapp Scam in detail

Tinyurl4.ru phishing campaign uses an offer of free Halloween Gift Baskets from Milka (and other tempting offers) as bait in an attempt to lure people into clicking a malicious link. This activity has been seen since October 2022. In this case, the scam uses the Milka brand as its bait. The message, which is delivered via WhatsApp, suggests that Milka is offering 247 Gift Baskets to celebrate Halloween 2022.

Tinyurl4.ru Whatsapp Scam Text Message:

Text presented in the scam message:

Kostenlose Halloween-Geschenkkörbe
von Milka

5.000 Gratisgeschenke für Sie

tinyurl4.ru/

Free Halloween Gift Baskets
from Milka

5,000 free gifts for you

tinyurl4.ru

https://tinyur4.ru/sxxxxxxx/

Once the malicious link (which is part of the message) is clicked, it triggers a few checks using JavaScript code that validates whether the request is coming from a mobile device, such as a smartphone. If validation passes, the website obtains geolocation data for the victim’s IP address and, depending on the country, the victim may be redirected. If validation fails, the victim is redirected to a URL which displays a 404 error.

Tinyurl4.ru redirects users to the Milka Whatsapp Scam:

Text presented in the scam page:

Ihr Geschenk ist: Halloween-Geschenkkörben von Milka.
Befolgen Sie die nachstehenden Anweisungen, um Ihren
Preis zu erhalten:

1. Mit 5 Gruppen / 20 Freunden auf WHATSAPP
teilen. (tippen Sie auf das „WhatsApp”-Symbol unten)

2. Tippen Sie auf „WEITER“, um den Preis zu erhalten.

WhatsApp

Teilen, bis.der blaue Balken voll ist!

WEITER

Dieses Angebot ist 500 Sekunden lang gültig

Her gift is: Halloween gift baskets from Milka.
Follow the instructions below to set up your
price to get:

1. With 5 groups / 20 friends on WHATSAPP
share. (tap the “WhatsApp” icon below)

2. Tap NEXT to get the price.

Whatsapp

Share until the blue bar is full!

FURTHER

This offer is valid for 500 seconds

If the validation is successful, the victim is redirected to a page that states that the user has a chance to receive a prize simply by taking a short and anonymous survey. After answering the questions, users are redirected to a site containing a form that they must fill out with their personal data. This information can be used to make fraudulent purchases and unauthorized transfers, sold to criminals on the dark web, or other malicious purposes. Moreover, the criminals can use stolen email addresses and phone numbers to send spam and malspam (spam emails containing malware or links to malware).

To summarize, Tinyurl4.ru can lead to malware infection, financial losses, theft of personal data and other serious problems.

VirusTotal flagged tinyurl4.ru as maliciouis:

Tinyurl4.ru scam – Shein Black Friday variant

In this case, the scam uses the Shein brand as its bait. The message, which is delivered via WhatsApp, suggests that Shein is offering 2,500 free 450£ gift cards.

Text presented in the scam message:

Shein Black Friday Special
Contest
2,500 free 450£ gift cards for you!

sheln.com

https://tinyur4.ru/sxxxxxxx/

Tinyurl4.ru scam – Emirates Airlines 2022 variant

In this case, the scam uses the Emirates Airlines 2022 brand as its bait. The message, which is delivered via WhatsApp, suggests that Emirates Airlines 2022 is offering 5,000 free round-trip flights to Europe.

Text presented in the scam message:

Emirates Airlines 2022 Black Friday Giveaway
5,000 free round-trip flights to Europe
fly.emirates.com

https://tinyur4.ru/sxxxxxxx/

Tinyurl4.ru scam – Heineken Oktoberfest 2022 variant

In this case, the scam uses the Heineken brand as its bait. The message, which is delivered via WhatsApp, suggests that Heineken is offering 5000 FREE mini fridges to celebrate Beer Oktoberfest 2022.

Text presented in the scam message:

Heineken Beer Oktoberfest
2022 Giveaway

5000 FREE mini fridges full of He…
heineken.com

https://tinyur4.ru/sxxxxxxx/

Tinyurl4.ru scam – “Cafeteira Expresso” variant

Text presented in the scam message:

Parabens!

Seu premio é: Cafeteira Expresso Tres Coracoes Gesto Rosa. Siga as instrucoes abaixo para recebe-la em sua casa!

Threat Summary

Name	Tinyurl4.ru Whatsapp Scam, “Tinyurl4.ru spam”, “Tinyurl4.ru virus”, “Tinyurl4.ru malware”
Type	scam, phishing, fake alerts
Fake claims	Shein Black Friday Special Contest – 2,500 free 450£ gift cards for you, Emirates Airlines 2022 Black Friday Giveaway, Parabens! Seu premio é: Cafeteira Expresso Tres Coracoes Gesto Rosa, Heineken Beer Oktoberfest 2022 Giveaway – 5000 FREE mini fridges, Share with 20 friends on WHATSAPP and claim your gift
Phishing websites	Tinyurl4.ru
Distribution	Whatsapp,Telegram,Viber,Facebook, YouTube, Twitter, Instagram, deceptive ads, push notifications, adware, potentially unwanted apps
Symptoms	spam Whatsapp messages, fake security warnings, fake system messages, pop-up errors
Removal	Tinyurl4.ru Whatsapp Scam removal guide

Examples of such scams

The Tinyurl4.ru scam is not the only scam on the Internet that aims to deceive users into providing personal and/or financial information. We have already reported other similar scams such as Chrome search contest 2022, You’ve made the 5-billionth search, Geek Squad EMAIL SCAM 2022, USPS Redelivery text Scam. Due to the large number of fraudulent sites, you need to be careful when clicking on links and close suspicious sites as soon as they appear on the screen.

Why am i getting Tinyurl4.ru spam text messages?

Usually, Whatsapp spam messages are not coming from another smartphone. They mainly originate from a computer and are sent to your smartphone via a Whatsapp messaging account. Some adware can infect your smartphone so it turns into a spam-sending machine. So, if your Whatsapp messenger displays or sends the Tinyurl4.ru Whatsapp Scam regularly, then it is possible that Adware or PUAs are installed on your device.

Adware is type of malware that can cause problems for your Android device. It can generate numerous additional popup, banner, pop-under and in-text link advertisements; gather your personal data such as login details, online searches, etc; run in the background and drag down your Android OS running speed; give more chances for other adware, PUAs even malware to get on your mobile device. Usually, adware gets into smartphones as part of a bundle with free software, sharing files and other unsafe apps that users downloaded from the Web.

How to protect against Tinyurl4.ru Whatsapp Scam?

To avoid becoming a victim of scammers, it is important to always keep in mind:

Don’t reply directly to Tinyurl4.ru message.
Don’t click on any links in the Tinyurl4.ru message.
Don’t give out personal information.
Report spammers to WhatsApp.
Mark the Tinyurl4.ru message as SPAM and delete it.
Scan your device for adware/malware/PUAs.
Install an anti-phishing software.

Remove Tinyurl4.ru virus

If you suspect that your smartphone is infected with malware, you accidentally clicked on a link in the Tinyurl4.ru scam, or just want to scan your device for malicious apps, then use this guide. You may find some minor differences in your Android device. No matter, you should be okay if you follow the steps outlined below: remove all suspicious and unknown apps, reset web browsers settings, run free malicious software removal utilities. Some of the steps below will require you to close this webpage. So, please read the step-by-step instructions carefully, after that bookmark it for later reference.

To remove Tinyurl4.ru Whatsapp Scam pop-ups, please follow the steps below:

Uninstall unknown and suspicious apps
Remove push notifications
Remove Tinyurl4.ru Whatsapp Scam pop-ups using Malwarebytes
Reset Android browser
Reset Android phone (Factory Reset)

Remove unknown and suspicious apps

The best way to start removing Tinyurl4.ru Whatsapp Scam pop-ups is to uninstall all unknown and suspicious apps. Using the standard features of Android, you can do it easily and quickly. This step, despite its simplicity, should not be missed, as removing unnecessary and suspicious apps, you can get rid of unwanted advertisements, browser redirects, malware, adware and viruses.

First of all, make sure that the Android phone does not have any apps running. To do this, open the list of running applications and remove all apps from it. Another option, just restart the phone, after which do not start anything.

Now you can start removing unnecessary apps. Open Android Phone settings, select APPS here. You will be shown a list of installed applications, similar to the one shown in the following example.

Several times, very carefully review this list, most likely one of the apps listed here is a virus, adware or malware that shows ads or installs unwanted games on your phone. To remove a suspicious app from Android Phone, just click on its name and select UNINSTALL in the window that appears, as shown in the figure below.

If you can not figure out what to delete and what to leave, use the following criteria for determining adware, malware and viruses. The app is suspicious if: it consumes a lot of memory (for example, it’s called a calculator, and consumes hundreds of megabytes of memory), the app name is completely unfamiliar to you (check the app name through Google search), the app requires strange permissions (for example, a calculator requires permission to send sms and access to the address book). At this stage, you need to be even a bit suspicious than usual.

Remove push notifications

If you want to remove notifications (unwanted ads) from the notification area of your Android phone, you need to change some settings, which determines which websites can send you browser notifications. These notifications are often used to send various unwanted ads to Android device.

Tap ‘Settings’.
Tap ‘Notifications’.
Find and tap the internet browser (Chrome) that shows spam notifications.
Find unknown and suspicious websites, other rogue notifications and set the toggle button to ‘OFF’ on them one-by-one.

Remove Tinyurl4.ru Whatsapp Scam pop-ups using Malwarebytes

Malwarebytes Mobile Security (Malwarebytes for Android) is a free app for phones running Android operating system. It can easily find and quickly remove viruses, potentially unwanted programs (PUPs), adware, trojans and other malicious software.

Download Malwarebytes, using the following link, and install it on your phone. After the application is installed, start it. You will see a window similar to the one shown in the example below.

Read the information about the Malwarebytes for Android, and then click “Got it” button.

You will see the main window, as shown in the figure below. Click “Fix now” button.

Malwarebytes will attempt to automatically update the virus database, and then immediately start the full scan procedure. In the process of scanning, Malwarebytes for Android will scan your phone for Trojans, spyware, viruses and other malicious programs.

When the scan is completed, Malwarebytes will report the detected viruses and in case of detection of malicious programs, offer to remove them. Just follow the prompts.

To use Malwarebytes for Android, you do not need to buy a premium (paid) version of the app. The first 30 days you can use all the features of this antivirus completely for free, and after 30 days, the device’s auto-protection will be turned off, but you can continue to use Malwarebytes for Android to check your phone for malware and remove it in case of detection.

Reset Android browser

Adware and other malware can change the Android settings. But most often malicious software makes changes to the browser settings, modifying the home page or search engine. Therefore it is very important, after scanning the Android device with antivirus software, also check the browser settings and restore its normal values.

Start the browser. Click on the icon in the form of three points, which is located in the right corner of your phone. In the menu that opens, select Settings.

You will see a list of browser settings. Find the “Search Engine” option and click on it. In the window that opens, select Google.

Go back to the list of browser settings. Now click “Home page”. Check that the switch is in the ON position. If necessary, move it to this position. Then click on the line below, which says “Open this page”. In the window that opens, enter the address of your home page or the line “about:blank” (without quotes). In this case, the blank page will be used as the homepage.

In addition to the above, it is also recommended to clear data that was saved by the browser while the phone was infected. To do this, in the list of settings, find the Privacy item and click it. Scroll the page to the bottom until you find “Clear browsing data”, press it. You will see the window as shown in the figure below.

In the “Time range”, select the time period that covers the period when your Android phone was infected with malware, then click “CLEAR DATA” button. During this procedure, your Google account will not be deleted, passwords, bookmarks and other personal information will be saved.

Reset Android phone (Factory Data Reset)

If nothing of the above is helpful and you failed to get rid of Tinyurl4.ru Whatsapp Scam pop-ups manually or using antivirus software, then most likely the malware can only be removed by resetting the phone.

In order to reset Android phone, and thus remove scam pop-ups, do the following. Open Phone Settings, scroll down to General management. Click it. You will see a window similar to the one shown in the pictures below.

Find the “Reset” option and click on it. You will see a list of possible ways to reset the phone settings, select the “Factory Data Reset” option.

Click “Factory Data Reset” button. ATTENTION! All your personal data from the phone’s internal memory will be deleted, all phone settings will be restored to their original state. The internal memory of the phone will be TOTALLY cleared.

Finish words

If you receive a scam message that is similar but not the same as the example above, make sure you remove any personal info in this message, then post it as comment on this article. This helps us to warn users about current scams, monitor trends and disrupt scams where possible.