www.escrow.com has been pharmed

[Grachtenhamster]

There had been various reports by victims that this wellknown serious escrow service has been pharmed. The mirrored site was hosted in Romania (where else?), but is currently down. However, I'm sure the next one is in the pipeline already.

The pharming trojan is sent by the scammers as mail attachment, and changes the file "hosts". At the original site already the starting page is "https", the pharmed site only shows http".

Be aware!

There are also reports that http://www.escrow-europa has been pharmed!

[Marie la Belge]

Hello.
I had a report indeed, about 6 months ago !
The mirrored site was very quickly down.

[Grachtenhamster]

The pharmed "escrow.com" site went down only last week. Actually the IP is used for another fake escrow.

[JaxHot]

Oh no it wasn't down fast.....
It was reported fast but apparently certain Romanian police officials can't handle the task.
In its place right now is a fake shipping site.

[scambuster]

the attack was planned ahead and viruses were sent out.
the pharmed escrow site was alive for over 2 weeks ! it was sitting on an IP number in romania....
lets see what happens after january 2007 whjen romania has joined the EU .....

[Grachtenhamster]

lets see what happens after january 2007 whjen romania has joined the EU .....

I will ask then for asylum in Switzerland....!

[Grachtenhamster]

the attack was planned ahead and viruses were sent out.

I'm not sure. I know a case where the scammers had sent the victim after the "deal" had been closed an e-mail with an "exe" attachment camouflaged as picture file.