The scammers used a common tactic—they hijacked the name of the Pulse nightclub, attached the account to the various “hashtags” associated with the shooting, and built the account’s apparent profile by attaching an army of fake followers so they could draw the attention of people following conversations about the shooting. The Twitter account directed followers to a shortened Web address to make donations. That Web address linked to the six-month-old domain desifreemovies.net—a domain with a fake registration address in California and a contact e-mail account associated with the Hushmail anonymous e-mail service.
The site itself was a fairly transparent scam—a grammatically incorrect plain HTML page with fake Amazon Prime links and a note that if the links “don’t work in your area” to instead send Bitcoin to a specific anonymous address. Based on data from Blockonomics, the wallet pulled in 0.04293381 bitcoins (about $30 US)—so it wasn’t exactly successful in cashing in on the tragedy. The site was shut down after Ars contacted the hosting company.