A scam site posted an article today titled "FOX BREAKING NEWS:'Mr. Bean.(Rowan Atkinson)' died at 62 After Crashing his Car on Attempt perfecting a Stunt -Today July,2017". It seems to be spreading via a Facebook message that looks like this:
When people click the message they are shown a video player which pops up a "Security check" after two seconds of watching, which asks viewers to share the post to continue viewing.
Of course the video is fake, it is an old Youtube clip of a Fox News host eulogizing his colleague Brenda Buttner.
Victims of this hoax don't even get to see the rest of the video. Immediately after sharing the post on Facebook they are redirected to various shady advertising websites.
This seems to be a repeat of an earlier Rowan Atkinson death hoax from March 2017. Back then we posted a detailed technical analysis of how the scam worked. It seems the current attempt is technically quite similar. We've already detected several different URLs that are being spread which all redirect back to the main hoax page at http://owf.amwstvprems.com/#news/31.
- http://owf.amwstvprems.com/p0030IKEmtC2wYF3il4TNxk7ayRegq5/
- http://owf.amwstvprems.com/p0030JiOq9pVwbyUP8HRZDK2L4u1/
- http://owf.amwstvprems.com/p0030FFTjrM2aiQ8zvXksUg5/
We are curious to see if the scammers will be switching domain names every few hours like they did last time. The main page at owf.amwstvprems.com only has this cryptic message on it:
awan pap..
Google Translate was unable to tell us anything about the meaning of this. The site does share an IP address (68.66.197.78) with http://ofwtv.mswstvs.com, which does seem to have a similar scam going at http://ofwtv.mswstvs.com/#news/26 with a video titled "PAALAM 'BOSSING'VIC-Sotto 1954-2017. Salamat Marami kang Napaligayang Pilipino. Mahal ka Namin Bossing | Today July,2017" that Google translate says is Filipino and means "EVER 'BOSSING'VIC-SOTTO 1954-2017. Thank You Many Filipinos. We Love You Bossing | Today July, 2017".
We'll be using our Trendolizer tool to keep an eye on the spread of this hoax, check the graph at the end of this article to see how just one copy of it is being spread. If you notice anyone spreading the rumor around you can help by pointing them to this article here because nobody likes fake news.
