The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
In November 2022, cybersecurity firm Cyjax reported that a WhatsApp-linked operation it called Fangxiao had impersonated more than 400 organizations and used tens of thousands of domains to funnel people toward surveys, prize lures, advertising and, in some observed routes, scams or Android malware. Those are historical findings—not a verified count or status for the campaign today.
What Cyjax reported—and when
Cyjax described Fangxiao as a long-running, profit-motivated campaign that used brand impersonation and promised rewards to draw people into a chain of web pages. Its November 2022 reporting said the activity had been observed across more than 42,000 unique domains. The report describes activity dating back to 2017; Cyjax’s accompanying blog account said it had identified more than 42,000 unique domains since 2019. The sources therefore use different starting points, and neither figure should be read as a current domain total.
Cyjax also reported that more than 400 organizations had been imitated by the time of publication, and that the number was still rising then. SecurityWeek, summarizing Cyjax’s findings in 2022, reported more than 24,000 landing and survey domains used since March 2022. The separate figures describe domains and impersonated organizations—not victims or confirmed infections.
- More than 300 new unique domains in one day: Cyjax reported this in October 2022 as an example of rapid rotation, not as a typical daily rate.
- More than 24,000 landing and survey domains since March 2022: SecurityWeek reported this figure in its 2022 coverage of Cyjax’s investigation.
These are investigators’ reported observations from 2022. The sources do not establish how many people were affected, how many devices were infected, or whether the same operation or infrastructure remains active.
#1 Best Overall
How the WhatsApp prize lure worked
1. A message used a familiar brand and a tempting offer
Cyjax said links arrived through WhatsApp and opened pages impersonating trusted organizations. The offers promised financial or physical rewards; some used topical anxieties such as COVID-19 to make the pitch feel timely. The familiar name supplied a veneer of legitimacy, while the prize gave recipients a reason to act quickly.
2. A survey or registration flow asked for engagement
Visitors could be sent to a survey domain and told they might win a prize after completing steps. In an observed flow, a user was asked to share the survey with other people, install an application and leave it open for 30 seconds. The pages also carried advertising. Requests to forward a message or install an app are important warning signs: they turn a supposedly private promotion into a way to recruit more visitors or push them toward another destination.
Rank #2
3. The destination could change
Cyjax observed chains of advertising and redirect sites, with destinations varying according to factors such as geography and browser user-agent. Some routes ended at suspicious sites or fake gift-card scams. In some observed routes for Android user-agents, users were directed to a download containing Triada malware.
That does not mean every visitor received malware, or that every site in a redirect chain was operated by Fangxiao. Cyjax noted that some external advertising-chain domains did not appear to be under the campaign’s control. The reported evidence supports a range of possible outcomes, not one universal result.
What “Chinese” attribution means here
Cyjax tracked the activity under the name “Fangxiao” and assessed with high confidence that its operators were based in China and motivated by profit. Its assessment drew on operational and infrastructure analysis, including a Mandarin-language page on a server identified during the investigation. Cyjax also inferred that the operation likely targeted people outside China because it used WhatsApp, which the firm said was banned in China.
This is a research firm’s attribution, not a public identification of named individuals or a court-established finding. The available reporting does not name a person responsible. As Cyjax put it in its report: “We have assessed with high confidence that this group is based in China, and we have identified activity dating back to 2017 over more than 42,000 domains, allowing us to observe its development.”
Rank #4
Cyjax also described Cloudflare protection and rapid domain changes as operational practices. These details help explain how the campaign could maintain a changing web presence; they do not establish its present-day infrastructure or activity.
Free tools Windows power users keep installed
One-click scans. No signup required.
How to assess a WhatsApp giveaway link
A legitimate promotion can have rules and entry steps, but a surprise prize that asks you to forward a message, install an app, or act under a countdown deserves extra scrutiny. For a promotion that appears to come from a known brand:
Best Value
- This fun, nerdy, geeky, retro Cybersecurity Awareness Month design is perfect to wear this October. Great for cyber security professionals and experts who keep people safe on the internet, safe online, and safe online.
- Wear this for October National Cyber Security Awareness Month this October, raise awareness about cyber security on smartphones, laptops at your school, in the classroom or on your college or university campus. Be safe online and make sure others are too!
- Lightweight, Classic fit, Double-needle sleeve and bottom hem
- Do not use the message link as proof that the offer is genuine.
- Open the brand’s official website or verified social account independently and look for the promotion there.
- Do not install an app or share a link with contacts just to claim an unexpected prize.
- If you already opened the page, avoid entering information or downloading anything unless you have independently verified the offer.
These are general precautions based on the warning signs in the reported flow, not a campaign-specific test or guarantee. A familiar logo, a completed survey or a message forwarded by someone you know does not by itself verify the offer.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What brand owners can take from the report
The reported use of many impersonating domains and rapid domain rotation makes domain monitoring and brand-protection services a relevant category for organizations. A service can support detection, but it is not a guarantee that every lookalike domain will be found or removed. When assessing options, organizations can ask about brand and domain coverage, alert speed, evidence collection, takedown workflow, geographic coverage, and pricing and contract terms. Cyjax describes a domain-monitoring service, but its campaign report does not compare vendors or establish that any particular service would have prevented this activity.
What remains unknown
The Cyjax investigation and SecurityWeek coverage date to 2022. The sources do not establish whether Fangxiao continued after that reporting, how its infrastructure may have changed, how many people were affected, or how many infections occurred. The reported domain and brand counts are useful evidence of the scale researchers observed at the time, not a current threat tally.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
