WhatsApp Phishing Scams: How I Investigated a Suspicious Government Job Offer and Free MTN Data…

A government job opportunity. Free mobile data and airtime.

Two offers that could easily catch the attention of many Nigerians.

Recently, I received two messages that have been circulating on WhatsApp. One claimed the Federal Civil Service Commission (FCSC) had opened a recruitment portal for jobs across government agencies. The other claimed that as part of MTN Nigeria's 25th anniversary, it was rewarding eligible customers with free data and airtime.

READ FOR FREE HERE!

At first glance, both messages appeared attractive. But two things made me pause: the links provided did not immediately establish a connection to the organizations they claimed to represent, and it was just too good to be true.

Rather than dismissing the messages based on suspicion alone, I decided to investigate them.

My objective is simple: use practical cybersecurity/threat intelligence tools and techniques to examine these URLs, investigate their destinations and technical indicators, verify the claims against official sources, and determine what the available evidence actually tells us.

This is not about declaring every unfamiliar link malicious. It is about understanding how to investigate/verify suspicious links, recognize warning signs, and make evidence-based decisions before trusting what we receive online.

In this article, I'll document the process step by step, including the tools used, commands executed, screenshots, observations, and findings.

This investigation takes you through the process of analysing two suspicious WhatsApp links, examining their technical indicators, verifying their claims, and assessing the risks they pose.

For easy access, here is a guide to what this walkthrough covers.

The Two Suspicious Messages
Defining the Investigation Objectives
Setting Up the Investigation
Step 1: URL and Domain Analysis
Step 2: Reputation Analysis
Step 3: Technical Analysis Using urlscan.io
Step 4: Claim Verification
Step 5: Evidence-Based Assessment and Risk Analysis
Conclusion and Recommendations

1. The Two Suspicious Messages

Before opening any suspicious link, I started by preserving the original messages and examining the URLs themselves.

Case 1: The Federal Civil Service Recruitment Offer

URL: https://shrlnk{.}site/FCSC-Recruitment
Claim: An ongoing free government recruitment exercise across government agencies and states.

Case 2: The MTN 25th Anniversary Reward

URL: https://bit-ely[.]com/MTMN-25YEARS-ANNIVERSARY-REWARD
Claim: A 25th-anniversary promotion offering 10 GB of free data and ₦2,000 airtime.

There is also a detail worth investigating: the URL path uses MTMN rather than MTN. This could be a simple typo, but it is worth recording alongside the unfamiliar domain and the promotional claim.

The goal is simple: follow the evidence, not assumptions. So let's investigate…

2. Defining the Investigation Objectives

Before using any tools, I established what I wanted to find out.

For each URL, the investigation will answer five questions:

URL and domain analysis: What does the URL reveal, and does the hostname establish a credible connection to the organization being represented?
Reputation analysis: Have security services identified the URL or domain as malicious, suspicious, or previously observed?
Technical analysis: Where does the URL lead, what redirects occur, and what can available DNS and domain information tell us?
Claim verification: Can the specific recruitment announcement or reward be confirmed through official channels?
Evidence-based assessment and risk analysis: Do the combined findings support a malicious, suspicious, apparently legitimate, or inconclusive classification? What risks might someone face by interacting with either link, and what precautions should they take?

I'll investigate each link separately while following the same general methodology. This will make it easier to compare the evidence without assuming that both links have the same origin or purpose.

3. Setting Up the Investigation

For this investigation, I'll use a combination of browser-based security services, command-line tools, and official sources to examine the two suspicious WhatsApp links.

The initial toolkit includes:

VirusTotal: To examine URL and domain reputation, detection results, and available security intelligence.
urlscan.io: To analyse website behaviour, redirects, network requests, and page content where scan data is available.
Google Safe Browsing: To check whether the URLs or their destinations are identified as unsafe.
ICANN Lookup / WHOIS: To examine available domain registration information, including registration dates and registrar details where available.
Google Public DNS and dig: To investigate DNS resolution and available DNS records.
Certificate Transparency logs (crt.sh): To examine publicly logged TLS certificates associated with the domains, where available.
Official organisational websites: To verify the recruitment and promotional claims against information published by the organisations themselves.

Each tool serves a specific purpose. Findings will be cross-checked wherever possible, and no single scan result or absence of a detection will be treated as conclusive evidence.

I'll also maintain an evidence log containing the URLs, investigation timestamps, tool results, screenshots, and observations from each stage. This will help make the investigation transparent and easier to reproduce.

A Note on Safe Investigation

I'll prioritise passive analysis and existing threat intelligence, avoiding direct interaction with suspicious websites wherever possible. I will not submit personal information, enter credentials or OTPs, download unknown files, or complete forms. I'll also consider that some third-party scanning services may make submitted URLs and scan results publicly accessible.

With the scope established, we can begin the technical investigation.

4. Step 1 - URL and Domain Analysis

1.1 Break down the URLs

A URL contains distinct components, including its scheme, hostname, and path. The hostname identifies the domain being accessed; the path identifies a resource within that domain.

Here is our initial analysis based on the two URLs you provided.

URL 1 - FCSC Recruitment

Original URL: https://shrlnk.site/FCSC-Recruitment
Scheme: httpsIndicates an HTTPS (Secure) connection; it does not prove the website is legitimate.
Hostname: shrlnk.site The domain to investigate for a connection to the FCSC. Looking at it directly, it does not seem to be associated with FCSC.
Path: /FCSC-Recruitment Uses wording associated with the recruitment offer.

URL 2 - MTN Anniversary Giveaway

Original URL: https://bit-ely.com/MTMN-25YEARS-ANNIVERSARY-REWARD
Scheme: https Indicates an HTTPS connection; it does not establish trustworthiness.
Hostname: bit-ely.com The domain to investigate for a connection to MTN Nigeria.
Path: /MTMN-25YEARS-ANNIVERSARY-REWARD Contains wording associated with the anniversary reward.

1.2 Initial observations

At this point, the key observation is that the organisation-related wording appears in the URL paths, while the hostnames are shrlnk.site and bit-ely.com. Neither hostname visibly establishes an official connection to the organisation named in its message.

This is a red flag and reason to investigate further, not proof that either link is malicious. It's time to examine the domains and compare them with verified official domains.

1.3 Comparing the Domains with Official Sources

I compared the domains in the WhatsApp messages with the organisations' official online channels.

FCSC official recruitment portal: https://recruitment.fedcivilservice.gov.ng/

MTN Nigeria official website: https://www.mtn.ng/

Observation: Neither hostname matches the respective organisation's official domain. Both URLs also use unfamiliar domains associated with URL shorteners. This could potentially serve as redirect links, concealing their final destinations. This can be abused in phishing campaigns to make suspicious links appear more credible, although we have not yet established that either domain functions this way.

The domain mismatch warrants further investigation, so the next step is to examine the available domain registration information and investigate the links' destinations.

1.4 Domain Registration Analysis

To gather more information about the domains gotten from the Whatsapp messages, I checked their publicly available registration records using WHOIS. These records can reveal details such as registration dates, registrar information, and nameservers, although some information may be redacted.

Observation: The WHOIS results revealed several points worth investigating. shrlnk.site was registered on 15 July 2026, making it only three months old at the time of this investigation. This is particularly notable given its use in a message advertising government recruitment. bit-ely.com, registered on 9 January 2023, is older but still much newer than MTN's established brand.

Both domains use different third-party registrars (Namecheap and Tucows), but these are legitimate domain registration providers, so their involvement is not itself a complete red flag. Both records show DNSSEC as unsigned, which means DNSSEC validation is not indicated; this alone does not imply malicious activity. Overall, the domains' ages and lack of an evident connection to the claimed organisations (MTN, FCSC) warrant further investigation, but the WHOIS data alone cannot confirm malicious intent.

5. Step 2 - Reputation Analysis

The aim of this step is to determine whether security services have previously flagged either URL or domain for phishing, malware, or other suspicious activity.

2.1 VirusTotal Analysis

I submitted each URL to VirusTotal to review its security vendor detection results.

URL 1: FCSC Recruitment

URL 2: MTN Anniversary Giveaway

Observation: VirusTotal identified multiple security vendors flagging both domains as malicious or associated with phishing.

For shrlnk.site, several vendors classified the domain as phishing or malicious, while the specific FCSC recruitment URL https://shrlnk.site/FCSC-Recruitment, also received phishing and suspicious detections. The URL redirected to https://ng-civl.github.io/nigeria/, which does not visibly match the official FCSC recruitment domain but can be said to be the specially crafted site used for phishing purposes.

Similarly, bit-ely.com was flagged by multiple vendors for Phishing, and its MTN anniversary URL redirected to https://mtnm-at25-free-data.abancy.com/, a domain that does not visibly match MTN Nigeria's official domain.

These findings raise significant concerns about both links. Although security-vendor detections are not individually conclusive, the consistency of these detections across the original URLs and their redirects provides strong evidence that both links are potentially malicious and should be treated as unsafe.

2.2 Additional Reputation Checks

To strengthen the assessment, I will check the URLs using:

Google Safe Browsing: To see whether the URLs are identified as unsafe.

Google Safe Browsing

I checked both domains, shrlnk.site and bit-ely.com, using the Google Safe Browsing Site Status Tool. Both returned the same warning: "Some pages on this site are unsafe." Google reported that pages on these domains may attempt to trick visitors into sharing personal information or downloading software.

Observation: Google Safe Browsing independently flagged both domains for potentially harmful content, reinforcing the concerns raised by VirusTotal. These findings provide further evidence that both links should be treated as potentially malicious.

6. Step 3: Technical Analysis

In this step, I used urlscan.io to examine how both links behave when accessed in a controlled scanning environment. The goal was to identify their redirect chains, inspect the final landing pages, review external links and network activity, and identify behaviours that could indicate phishing or fraudulent activity.

URL 1: FCSC Recruitment

Observation - FCSC Recruitment: The urlscan.io investigation revealed that the recruitment link redirects from shrlnk.site to ng-civl.github.io/nigeria/, an unofficial destination that does not match the official FCSC recruitment domain and has been flagged by threat intel sources as phishing-related. The page claims that 249 positions are available, requests applicants' personal information, and instructs them to share the link with 15 friends or five WhatsApp groups before submitting an application. It also contains application links to unrelated domains, omg10.com and otieu.com. These findings, combined with the earlier VirusTotal and Google Safe Browsing warnings, strongly indicate that the link is unsafe and potentially designed to collect personal information and spread further through WhatsApp.

URL 2: MTN Anniversary Giveaway

Observation - MTN Anniversary Giveaway: The urlscan.io investigation revealed that the giveaway link redirects to mtnm-at25-free-data.abancy.com, a domain that does not match MTN Nigeria's official domain. The page promises free data, requests visitors' mobile numbers, and requires them to share the offer with 15 friends or five WhatsApp groups before activation. It also contains an external activation link to omg10.com. Importantly, VirusTotal flagged the destination's parent domain, abancy.com, through multiple security vendors for phishing and malicious activity. Combined with the unrelated destination and suspicious sharing requirements, these findings provide strong evidence that the giveaway link is unsafe and likely part of a phishing or fraudulent campaign.

7. Step 4: Claim Verification

After analysing both links, I checked the organisations' official channels to verify the claims made in the WhatsApp messages.

4.1 FCSC Recruitment

I checked the official FCSC recruitment portal. Although genuine recruitment opportunities exist, I could not verify the specific claim that 249 positions were available.

The suspicious link redirects to an unrelated GitHub Pages website and requires users to share it with 15 friends or five WhatsApp groups before proceeding.

Observation: The specific recruitment announcement remains unverified. The unrelated destination and forced-sharing requirement further undermine its credibility.

4.2 MTN Anniversary Giveaway

I checked MTN Nigeria's official website. Although MTN celebrated its 25th anniversary in August 2026, I could not verify the specific offer of free data and ₦2,000 airtime.

The scanned page also differed from the original message, requested users' mobile numbers, and required them to share the offer before proceeding.

Observation: The genuine anniversary does not authenticate the giveaway. The unverified reward, inconsistent claims, and suspicious page behaviour strongly suggest a fraudulent promotion.

Overall observation

Both messages use genuine organisations and events to appear credible, but neither specific claim could be verified through the official sources reviewed. Combined with the earlier technical and reputation findings, the evidence supports treating both links as unsafe.

8. Step 5: Evidence-Based Assessment and Risk Analysis

After completing the investigation, I consolidated the findings from URL and domain analysis, reputation checks, urlscan.io, and claim verification to assess the risks associated with both links.

5.1 FCSC Recruitment Link

Assessment: High risk - likely phishing or fraudulent recruitment.

Multiple security vendors flagged the link, Google Safe Browsing warned of unsafe content, and the landing page redirected to an unofficial destination. Its request for personal information and forced-sharing requirement further increased the risk.

Potential risks include exposure of personal information and further spread of the suspicious link through WhatsApp.

5.2 MTN Anniversary Giveaway

Assessment: High risk - likely fraudulent giveaway or phishing.

The link received multiple security warnings and redirected to an unrelated domain. The landing page requested mobile numbers and required users to share the offer before proceeding. The promised reward could not be verified through the official sources reviewed.

Potential risks include exposure of personal information, unwanted follow-up messages, and further distribution of the suspicious offer.

5.3 Recommended Precautions

Avoid opening or sharing either link.
Never submit personal information, passwords, banking details, or OTPs on unverified websites.
Verify recruitment announcements and promotions through official websites and customer-support channels.
Report suspicious messages to the relevant platform and warn others who may have received them.

9. Conclusion and Recommendations

This investigation revealed how cybercriminals can exploit trusted organisations like FCSC and MTN to make fraudulent links appear legitimate.

By combining threat intelligence, URL analysis, and claim verification, I found strong evidence that both links are unsafe.

As we observe Cybersecurity Awareness Month, this is a reminder that cybersecurity and online safety start with the decisions we make every day. Never trust a link solely because it uses a familiar organisation's name or logo. Always verify suspicious claims through official channels before clicking, sharing, or submitting personal information.

Stay vigilant, verify before you trust, and think before you share.

Have you ever received a suspicious recruitment or giveaway link on WhatsApp?

What did you do?

Share your answer in the comments, and let's help more people stay safe online this Cybersecurity Awareness Month.

If this walkthrough helped, clap (up to 50x), follow for more indepth investigation, and send it to someone to avoid falling for these.