Escrow.com fraud - A redirect of the legit one

[buyer2006]

These guys are getting smarter and smarter every day.
I was almost duped. The guys had a car for sale. When I asked for a copy of the title and a sales agreement, they included a virus with the email. The virus does something I think is VERY clever. They redirect my web browser, so that when I try to go to the legit site Escrow.com I end up in an identical looking site of their making. After completing registration and the transaction details, they said the payment was to go to an offshore account in Slovakia (big red flag). I tried logging on to Escrow.com at work and got the legit site, but could not log on (of course). Escrow.com, the legit site is in Irvine California, never send any money to any other site than Bank of America in Irvine California. Lesson learned. Cost to learn it $20 wasted on a carfax report.
Fraudulent guy goes under the name Alex Matters A.K.A. Alex Merrick.

[buyer2006]

this fraud guy is using the e-mail almatters@nerdshack.com
I have seen a few scams, all with the @nerdshack behind the e-mails.
This guy, if you trace his e-mail, comes from Romania. (open the details on his e-mail string and it shows rdsnet.ro, [Romania])

[peg]

I have adjusted your subject to this forum post. I didn't want the subject to indicate that the LEGIT escrow.com is actually a fraud. As you have pointed out, it is NOT a fraud.

Next. one of the easiest ways to recirect your browser to a fraud site is by using the HOSTS file (sometimes called lmhosts.) This file will override any dns entry. It's use (origianlly) was when Networks were small and there was no DNS. You would just create an entry in your HOSTS file to map to the particular computers. As the Internet grew this got to be too cumbersome as you had to update EVERY computer's host file, and then these files got very large.

Now the hosts files are used mainly for overriding DNS. When you enter a web address, the browser checks the HOSTS file FIRST and if it doesn't find it, it will try DNS. If it DOES find it, then it stops looking and goes to the appropriate IP Address (as defined by the hosts file).

There are other ways to redirect your browser, but the HOSTS file is one of the easiest. Of course if it was a "Virus" that adjusted your system, then you should make sure you do a complete virus scan, windows update, Browser Update (I suggest using firefox). Also consider running an scan for adware, malware, etc...

Finally, please provide details of the scammer for others to benefit. Email Addresses, Postal Addresses, Userid's (and associated websites), Phone numbers, etc.. The more informaiton the better.

[Eric Brewster]

Eric Brewster:
Buyer, ahhhhhh if I can say, "I told you so"; well then I told you so. You are luckly to have only lost $20 and then you smelled a rat trap with that scammer. Your in good company; yes the scammers are getting smarter and smarter with their frauds, there are thousands out there with the intent of stealing your money and livelyhood. You can trust very few on the internet since it has become an business place wide open to crooks that pretend to be actual business people.

Worse yet as many have found out, they are willing to say anything to see you part with your money. The worse scams yet, are the internet local bilkers on their infomercials and quickrich housing schemes that get you into the housing, landscaping and development market, get you to part with your entire lifesavings to the construct, buy and become an Housing Rep manager, by the time it is all said and done your lifesavings go up in smoke.....some to the tune of $400,000 into an con artist's pockets from BC, Toronto or from Calgary, Alberta.

[buyer2006]

How do I clear that bad file from my computer? I have uninstalled and reinstalled my browser (Firefox) and I still cannot get the real Escrow.com
The good news is, they closed down the fake one, as nothing is coming up now.
Again, the guys name is Alex Matters, Alias Alex Merrick. He goes by Almatters@nerdshack.com
He claimed that he was from Australia
the address he put on the sales contract was: 140 George street, Sydney, NSW, 1223 Australia
Address he put on the Title to the car was: 6725 Blackburn PL, Downers Grove Illinois 60576

[buyer2006]

I looked up the host file and sure enough, there it is. The IP address for the redirect is 69.16.223.123 It does not work anymore, but maybe someone on this site can find out where this scumbag is and send him some nasty virus or something....

[peg]

I looked up the host file and sure enough, there it is. The IP address for the redirect is 69.16.223.123 It does not work anymore, but maybe someone on this site can find out where this scumbag is and send him some nasty virus or something....

Unfortunately the IP address is probably for a host provider and not indicative of where the scammer really is. To actually get that information, the Host provider would have to verify their logs and see what IP address this scammer used to access the site. Even that is not a sure fire way. They may have used another computer to route their traffic through to mask them even further. This is not uncommon. These scammers don't want to get caught more than you want them to get caught. So they know how to avoid it.

Some do eventually get tracked down and caught. Some as a result of information posted on sites like this one. That is why it's improtant to put as much information about the scammers as possible (including IP Addresses as you have).

Thanks again for all the information and I am glasd you only were out 20 dollars for a carfax report.

[Eric Brewster]

Eric Brewster:
Paul G and Buyer; the story could get worse. The guy wanting to sell the car to you may have been using 5 computers at once, 2 for using his website......generating "purchasers tracking forms" in other words a illegal.....or intrusive program that searches out your ip address and locks on to it. His other computer probably follows the money trail of his "pegions" that leave money in all of his fake addresses and alerts him to when to go and pick up the money at the money exchanges. The third computer is his "wired up computer", his having all sorts of nifty things and many worm virus creaters to keep him abreast of the cops, angry fleeced people and his own fellow scam artists all over the world because there is very little honor amongst thieves.

His 4th computer would be his personal one that he uses to surf the internet normally with a normal ip address, to chat with and to meet other "normal people" because even in his proffession of fraud scams you have to do abit of an reality check. His 5th computer may be his "Wild Goosechase computer" that is set up with a host more programs each designed to let the authorities computers run around chasing their tails without ever really finding this guy.

One fellow that I became aware of had this sort of 5 computer setup and he was crashing internet websites for a long time untill many complaints were logged and eventually this guy was tracked down and a court case brought against him.

[truth_moment]

You think too much. i know all about this. they are NOT doing this(with 5pc's and so on). First thing...a small mistake that can put them in jail... THE IP FROM RDS.RO!!!!! Contact your FBI and they will know what to do to catch them. RDS gives an IP to a single pc so it's very very easy to put them behind the bars.
They don't represent ROMANIA. They are a small part in a poor country trying to make money by selling fake items.
And for money it's very easy. They convince you to send them the money in fake account, made with fakes ID in a country like UK, Germany, Spain, Australia, etc.. they can make them in every country you want. Even in America and Canada!!!!!
If you don't want to end broke, you have to give a call at FBI, and then mail me in privat for more details about them!!!!! And I will tell you all I know. I even have a discussion bord on this forum!!!!

[Eric Brewster]

Eric Brewster:
Hummmmmm, I think too much, truth_moment? Peg has got the right idea, when the internet was smaller some computer programs did do exactly like he said. But since it became bigger and your File Histories became larger from people surfing on the net, so too did the abilities of hackers and scammers to use these history search files to redirect your computer to false ip addresses to attempt to scam you from your life savings. Some Scammers as I have said use from 2-5 computers so that they can get away while burying their ip address trails.

Truth_Moment, the scammer in question from the info that was presented was from Romania, as well as being an romanian criminal.........I also suspect he or she was a part of a larger criminal organization, or was able to use so many ips he would be nearly impossible to trace. Oh I have contacted the FBI and my local police forces such as the RCMP in my own locality, because of an scam that was pulled on me from an "international third-worlder countryperson but as I had said before when you get from 5-50 or many spam or scam emails in about 3 weeks to a month then the local authorities are little interested in stopping the criminals and are more annoyed when they find out they are not really in Canada at all, but sitting at a terminal actually in Romania, Hungry, Spain, Britain, South Africa, West Africa etc. Also that these peoples have been pulling this scam for more than 1 year......worst yet these people are trying to get the good life by using other peoples post office boxes, homes and businesses to con honest people of their money......all for wanting to get an lower priced car or some sort of tv etc.

Comming from a poor country classed Third-World is alright but do you actually need to be an criminal that operates on an world wide scale, bilking hundreds of thousands of dollars to finance your criminal enterprises? I am glad, truth_moment you have a message board page here. The scammer tarnishes their country's reputation by both scamming their own countrymen and people abroad, their enterprises hurt themselves and everyone associated with them, their bribary and corruption simply expands larger and larger. These people are "wannabe petty criminals" that are wanting to be big criminals and some of them have graduated to much bigger scams. But because they have not got caught yet, they are still a couple of steps ahead of the authorities.

I could if I wanted too, put out all the ip links to the scammers that I get in my emails for all to see but there would be simply too many of them, so I had concentrated on the few scams that nearly found me sending money to them that had almost faked me out. A lot of people in my locality are finding the same thing out, the authorities already know about most of the international scammers and have for a few years, however the manpower needed to take these scammers down is not availiable and never will be. About all we can do is what Peg and others here are doing, telling people about the tip of the iceberg and what to look for when the scammers put the "bite on you."