escrow car fraud- the payback(hopefully)

Have you been frauded at at an Online Escrow Site? Put your story, questions and comments here!
Click Here to return to escrow-fraud page


Moderators: georg, suziecue, JaxHot

Postby peg » Tue Jun 05, 2007 2:33 pm

dominus wrote:Ok, Ok... I don't have that much time anyway... I must buy a car 8)

Can someone explain me what happened exactly with the sucker... How did he put his own bank account directly to the escrow-europa official link? Pm is also good if cannot be told there.

Tnx guys once again.

This things are easy to do when you control both sites.

What "Site" are you considering the "escrow-europa official link" ?
- peg -

-- eschew obfuscation!! --
If we were able to help you please consider making a donation to support this site.
Donation button at the top of page.
User avatar
peg
Site Admin
Site Admin
 
Posts: 827
Joined: Sun Feb 09, 2003 6:25 am
Location: United States

Postby dominus » Tue Jun 05, 2007 2:37 pm

peg
I'm talking about this page:
URL REMOVED TO PROTECT SENSITIVE DATA

Can You explain me plz... I can't see anything wrong, just the name of the bank account seems "strange".

ADMIN EDITED
dominus
Infant
 
Posts: 19
Joined: Sun Jun 03, 2007 2:26 pm

Postby georg » Tue Jun 05, 2007 2:38 pm

dominus:

check your computersystem:
c:\windows\system32\drivers\etc\host

if this existent:
208.179.102.59 http://www.escrow-europa.com
208.179.102.59 escrow-europa.com

then you are pharmed....delete this quickly
User avatar
georg
Moderator
Moderator
 
Posts: 442
Joined: Mon Mar 13, 2006 9:44 am

Postby dominus » Tue Jun 05, 2007 2:42 pm

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost
208.179.102.59 http://www.escrow-europa.com
208.179.102.59 escrow-europa.com
208.179.102.59 http://www.escrow-europa.com
208.179.102.59 escrow-europa.com
208.179.102.59 http://www.escrow-europa.com
208.179.102.59 escrow-europa.com
208.179.102.59 http://www.escrow-europa.com
208.179.102.59 escrow-europa.com
208.179.102.59 http://www.escrow-europa.com
208.179.102.59 escrow-europa.com
208.179.102.59 http://www.escrow-europa.com
208.179.102.59 escrow-europa.com
208.179.102.59 http://www.escrow-europa.com
208.179.102.59 escrow-europa.com
208.179.102.59 http://www.escrow-europa.com
208.179.102.59 escrow-europa.com
208.179.102.59 http://www.escrow-europa.com
208.179.102.59 escrow-europa.com
208.179.102.59 http://www.escrow-europa.com
208.179.102.59 escrow-europa.com
208.179.102.59 http://www.escrow-europa.com
208.179.102.59 escrow-europa.com
208.179.102.59 http://www.escrow-europa.com
208.179.102.59 escrow-europa.com
208.179.102.59 http://www.escrow-europa.com
208.179.102.59 escrow-europa.com


That's my whole hosts file. What should I delete? and what means pharmed?
dominus
Infant
 
Posts: 19
Joined: Sun Jun 03, 2007 2:26 pm

Postby peg » Tue Jun 05, 2007 3:00 pm

Delete EVERYTHING accept the localhost entry (and anything that begins with the # sign)
- peg -

-- eschew obfuscation!! --
If we were able to help you please consider making a donation to support this site.
Donation button at the top of page.
User avatar
peg
Site Admin
Site Admin
 
Posts: 827
Joined: Sun Feb 09, 2003 6:25 am
Location: United States

Postby peg » Tue Jun 05, 2007 3:03 pm

dominus wrote:peg
I'm talking about this page:
URL REMOVED TO PROTECT SENSITIVE DATA

Can You explain me plz... I can't see anything wrong, just the name of the bank account seems "strange".

ADMIN EDITED


I removed the URL because there is some potentially sensitive data there (YOURS!) and I am sure you don't want it shared with others.

I have seen that URL (and others like it) and have alerted those involved
- peg -

-- eschew obfuscation!! --
If we were able to help you please consider making a donation to support this site.
Donation button at the top of page.
User avatar
peg
Site Admin
Site Admin
 
Posts: 827
Joined: Sun Feb 09, 2003 6:25 am
Location: United States

Postby dominus » Tue Jun 05, 2007 3:05 pm

Ok, tnx... It was only my email there ;)

I received an email now from: escrow-fraud.AT.escrow-fraud.DOT.com
saying:
You are a scammer and a pathetic one at that.... You have already been black listed. Stop modifying the HOST file of peoples computers to perpetrate a fraud.

See you in the search engine!


Is this the work of the same guy or Someone of You thinks I'm the fucker??


ADMIN EDIT: Spam proofed email address
dominus
Infant
 
Posts: 19
Joined: Sun Jun 03, 2007 2:26 pm

Postby georg » Tue Jun 05, 2007 3:07 pm

delete all
208.179.102.59

this is the faker-site (and you have it become with the document in the e-mail from the "seller")
User avatar
georg
Moderator
Moderator
 
Posts: 442
Joined: Mon Mar 13, 2006 9:44 am

Postby peg » Tue Jun 05, 2007 3:09 pm

dominus wrote:Ok, tnx... It was only my email there ;)

I received an email now from: escrow-fraud.AT.escrow-fraud.DOT.com
saying:
You are a scammer and a pathetic one at that.... You have already been black listed. Stop modifying the HOST file of peoples computers to perpetrate a fraud.

See you in the search engine!


Is this the work of the same guy or Someone of You thinks I'm the fucker??


ADMIN EDIT: Spam proofed email address


Damm!!! I sent them to the wrong ones...
- peg -

-- eschew obfuscation!! --
If we were able to help you please consider making a donation to support this site.
Donation button at the top of page.
User avatar
peg
Site Admin
Site Admin
 
Posts: 827
Joined: Sun Feb 09, 2003 6:25 am
Location: United States

Postby CapriceFéline » Tue Jun 05, 2007 3:11 pm

Hello domius,

it means that you have entered a mirrowed website. It is not the original escrow-europa but an identical fake site with the same Url. With one of the mails they sent you, they deviated you to a false file.
Now, if you want to get into contact with the original legit escrow-europa, you can't, you are always deviated.
So people believe they register on the legit escrow-europa.

I am not a professional with these kind of things. Perhaps ask Wikipedia or google in your mother language to have it better explained.

Greetings
Caprice
Wer kein freundliches Gesicht hat, sollte keinen Laden aufmachen. Chinesisches Sprichwort.
CapriceFéline
Adult
 
Posts: 89
Joined: Tue Apr 25, 2006 9:54 pm
Location: Germany

PreviousNext

Return to Escrow Fraud

Who is online

Users browsing this forum: No registered users and 4 guests

cron