It was inevitable that unscrupulous individuals would take advantage of the recent theme park tragedy, and sure enough we’re seeing reports that fake videos are in circulation of the crash. While there are a number of pages pushing these fake videos located at
[subdomain]viewant(dot)com
many of them have been taken offline and currently look like this:
![Roller page taken down](https://www.malwarebytes.com/wp-content/uploads/sites/2/2015/06/roller1.jpg)
There are some fresh ones still going around though – here’s a post someone has made to Twitter in the last hour or so:
![Twitter links](https://www.malwarebytes.com/wp-content/uploads/sites/2/2015/06/roller2.jpg)
Most of the links in circulation are flagged by various browsers for spam / phishing / scams, such as the below subdomain in Chrome:
![Flagged for scams](https://www.malwarebytes.com/wp-content/uploads/sites/2/2015/06/roller3.jpg)
However, the above page is still live at time of writing – and even without the proliferation of subdomains touting the scam, you can still see it in action by simply visiting
viewant(dot)com/roller
Here’s the fake YouTube video landing page:
![Fake Youtube video](https://www.malwarebytes.com/wp-content/uploads/sites/2/2015/06/roller4.jpg)
The page has no text, save for the title of the page in the browser itself which says “Latest video: Roller Coaster Cars Collide in Alton Towers”. Clicking the play button brings up a prompt to share to Facebook in order to continue:
![Share to continue](https://www.malwarebytes.com/wp-content/uploads/sites/2/2015/06/roller5.jpg)
From there, the site will send clickers to
damnlink(dot)com/post-8-full-video(dot)html
![Click to watch!](https://www.malwarebytes.com/wp-content/uploads/sites/2/2015/06/roller6.jpg)
which requires yet another video icon to be pressed – this time, redirecting to a page full of survey offers.
![Survey offers](https://www.malwarebytes.com/wp-content/uploads/sites/2/2015/06/roller7.jpg)
The survey offers differ by region – most of the offers we saw (from winning £500 or a PS4 to £100 Amazon vouchers) required visitors to enter their name, DOB, email, phone number and post / zip code at a bare minimum.
There are reports of installs being offered up on some of the other pages according to earlier reports; this would be fairly typical for a set of survey offers, but it depends on ad network being used and can vary from one location to another.
As with all of these scams, the people behind it will make money each time a survey offer is completed.
The last time we saw someone profiting from a tragedy in this way was when we wrote about fake Flight MH17 missile pages, but you can guarantee similar efforts will be online the moment another disaster strikes.
Racking up some quick cash from a survey scam is a bottom-rung, quick and easy technique to pull off.
Unfortunately, low technical ability and a lack of ethics has never been a barrier to increasing the funds in a bank account, so please steer clear of these fakeouts and let your friends and colleagues know if you happen to see them sharing one of these videos – you’ll be doing everyone a favour by getting it taken offline.
Christopher Boyd