Email fraud deserves campaign-level analysis.

Why this exists

Too much malicious email analysis stops at a single URL, attachment, or sender. Those details matter, but the more useful question is what they reveal about the broader campaign: how targets are selected, which pretexts recur, what infrastructure is reused, and how the operation changes over time.

The initial collection focus is high-volume malspam and generic phishing because it creates enough evidence to build repeatable parsing, enrichment, clustering, and reporting workflows. Business email compromise and payment-diversion analysis will expand as authorized samples and partnerships grow.

Research principles

• Preserve the source. Keep raw messages and collection context intact.
• Separate fact from inference. Shared infrastructure is evidence, not automatic attribution.
• State confidence clearly. Uncertainty is part of useful intelligence.
• Minimize private data. Collect and publish only what the research requires.
• Produce something usable. Reporting should support investigation, detection, or prevention.

What the name means

“Escrow Experts” describes the project’s interest in escrow fraud, wire fraud, and the trust relationships exploited in payment-diversion schemes. It is a research identity—not an escrow company, title agency, payment processor, or funds-transfer service.

Research questions can be sent to intelligence@escrowesperts.com.