lrich3538@gmail.com

[Big Al]

Hello,

We can serve you,100,000 masks will be shipped in 6 working days.
We supply KN95 masks fob to shanghai 1.29 USD/PCS with FDA and CE passed.you need to pay a 20% deposit. Freight at your own expense.
If you are interested, you can contact us.

Header:

Return-Path: <lrich3538@gmail.com>
Received: from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41])
From: Linda Rich <lrich3538@gmail.com>
Date: Mon, 30 Mar 2020
Subject: Re: N95 Masks

[Big Al]

Hello, We can serve you,100,000 masks will be shipped in 6 working days. We supply KN95 masks fob to shanghai 1.29 USD/PCS with FDA and CE pass

[firefly]

Email received:

Hello, xxx
bank transfer is currently not supported. If you have a large order, we can provide Western Union, of course, there will be a large order price.
Best regards.

Header:

Return-Path: <lrich3538@protonmail.com>
Received: from mail-40132.protonmail.ch (mail-40132.protonmail.ch. [185.70.40.132])
Date: Mon, 13 Apr 2020 12:15:59 +0000
To:
From: lrich3538 <lrich3538@protonmail.com>
Reply-To: lrich3538 <lrich3538@protonmail.com>
Message-ID: <HjPS2RmiSdhxpTCaQHczQF0CGXkAtUOJJQErzHhZogB9PYdqC5c91eSurmfiIblndWsUU-KJoeIANXZ8LrkX1CyZKLbqNp3LVe1W1BkfeAc=@protonmail.com>
References: <CAPqXmjewywsKBytxwp254o1VSVHqis9sK9R1x9s8=60_um0qRQ@mail.gmail.com>

Both email addresses lrich3538@protonmail.com and lrich3538@gmail.com are used online with fake websites offering face masks for sale. Even if one fraudulent domain name gets suspended, the fraudster simply redirects the victim to another of his fake websites not suspended yet.

[firefly]

From the fake website:

We are a mask manufacturer, with a number of certification, qualifications and product patents. We directly supply products to our customers. We have more than 3000 square meters factory and more than 200 employees.

At the moment you can only pay with credit/debit cards, such as:
MasterCard
American Express
JCB

For WHOLESALE ORDERS, PLEASE EMAIL. EMAIL:lrich3538@gmail.com

Entry in the aa419 Database of fraudulent website: https://db.aa419.org/fakebanksview.php?key=143778.

From the domain name registration:

Domain name: n95-medical-masks.com
Updated Date: 2020-04-01
Creation Date: 2020-04-01
Registrar Registration Expiration Date: 2021-04-01
Registrar: NAMECHEAP INC
Reseller: NAMECHEAP INC

Registry Registrant ID:
Registrant Name: WhoisGuard Protected
Registrant Organization: WhoisGuard, Inc.

This is what the fake website looks like:

[firefly]

From the fake website:

We are a mask manufacturer, with a number of certification, qualifications and product patents. We directly supply products to our customers. We have more than 3000 square meters factory and more than 200 employees.

At the moment you can only pay with credit/debit cards, such as:
Visa
MasterCard
American Express
Discover

For WHOLESALE ORDERS, PLEASE EMAIL. EMAIL:lrich3538@protonmail.com

Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=143779.

From the domain name registration:

Domain Name: CORONAVIRUSMASKSALE.COM
Updated Date: 2020-03-20
Creation Date: 2020-03-04
Registrar Registration Expiration Date: 2021-03-04
Registrar: 1API GmbH

Registry Registrant ID:
Registrant Name: REDACTED FOR PRIVACY
Registrant Organization: REDACTED FOR PRIVACY
Registrant Street: REDACTED FOR PRIVACY
Registrant City: REDACTED FOR PRIVACY
Registrant State/Province:
Registrant Postal Code: REDACTED FOR PRIVACY
Registrant Country: DE

This is what the fake website looks like:

[firefly]

There are also n95mask2020.com and maskforcoronavirussale.com.

Soon after being registered, n95mask2020.com redirected to maskforcoronavirussale.com.

maskforcoronavirussale.com was suspended:

Now, n95mask2020.com redirects to n95coronavirusmaskusa.com.

Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=143781.

From the n95mask2020.com registration:

Domain Name: N95MASK2020.COM
Updated Date: 2020-04-24
Creation Date: 2020-04-03
Registrar Registration Expiration Date: 2021-04-03
Registrar: 1API GmbH

Registry Registrant ID:
Registrant Name: REDACTED FOR PRIVACY
Registrant Organization: REDACTED FOR PRIVACY
Registrant Street: REDACTED FOR PRIVACY
Registrant City: REDACTED FOR PRIVACY
Registrant State/Province: FL
Registrant Postal Code: REDACTED FOR PRIVACY
Registrant Country: US

From n95coronavirusmaskusa.com website:

We are a mask manufacturer, with a number of certification, qualifications and product patents. We directly supply products to our customers. We have more than 3000 square meters factory and more than 200 employees.

At the moment you can only pay with credit/debit cards, such as:

Visa
MasterCard
American Express
Discover

For WHOLESALE ORDERS, PLEASE EMAIL. EMAIL:lrich3538@protonmail.com

Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=143780.

From the domain name registration:

Domain Name: N95CORONAVIRUSMASKUSA.COM
Updated Date: 2020-03-20
Creation Date: 2020-03-04
Registrar Registration Expiration Date: 2021-03-04
Registrar: 1API GmbH

Registry Registrant ID:
Registrant Name: REDACTED FOR PRIVACY
Registrant Organization: REDACTED FOR PRIVACY
Registrant Street: REDACTED FOR PRIVACY
Registrant City: REDACTED FOR PRIVACY
Registrant State/Province: Baden-Wuerttemberg
Registrant Postal Code: REDACTED FOR PRIVACY
Registrant Country: DE

This is what the fake website looks like:

There is also n95coronavirusmaskitaly.com, redirecting to the same n95coronavirusmaskusa.com.

Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=143783.

From the domain name registration:

Domain Name: N95CORONAVIRUSMASKITALY.COM
Updated Date: 2020-03-23
Creation Date: 2020-03-12
Registrar Registration Expiration Date: 2021-03-12
Registrar: 1API GmbH

Registry Registrant ID:
Registrant Name: REDACTED FOR PRIVACY
Registrant Organization: REDACTED FOR PRIVACY
Registrant Street: REDACTED FOR PRIVACY
Registrant City: REDACTED FOR PRIVACY
Registrant State/Province: AK
Registrant Postal Code: REDACTED FOR PRIVACY
Registrant Country: US

And n95masksindia.com redirecting to the same n95coronavirusmaskusa.com.

Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=143784.

From the domain name registration:

Domain Name: N95MASKSINDIA.COM
Updated Date: 2020-03-23
Creation Date: 2020-03-06
Registrar Registration Expiration Date: 2021-03-06
Registrar: 1API GmbH

Registry Registrant ID:
Registrant Name: REDACTED FOR PRIVACY
Registrant Organization: REDACTED FOR PRIVACY
Registrant Street: REDACTED FOR PRIVACY
Registrant City: REDACTED FOR PRIVACY
Registrant State/Province: AK
Registrant Postal Code: REDACTED FOR PRIVACY
Registrant Country: US

Also coronavirusmaskindia.com, redirecting to the same n95coronavirusmaskusa.com.

Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=143785.

From the domain name registration:

Domain Name: CORONAVIRUSMASKINDIA.COM
Updated Date: 2020-03-23
Creation Date: 2020-03-06
Registrar Registration Expiration Date: 2021-03-06
Registrar: 1API GmbH

Registry Registrant ID:
Registrant Name: REDACTED FOR PRIVACY
Registrant Organization: REDACTED FOR PRIVACY
Registrant Street: REDACTED FOR PRIVACY
Registrant City: REDACTED FOR PRIVACY
Registrant State/Province: AK
Registrant Postal Code: REDACTED FOR PRIVACY
Registrant Country: US

And again buyn95maskonline.com redirecting to the same n95coronavirusmaskusa.com.

Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=143786.

From the domain name registration:

Domain Name: BUYN95MASKONLINE.COM
Updated Date: 2020-03-23
Creation Date: 2020-03-06
Registrar Registration Expiration Date: 2021-03-06
Registrar: 1API GmbH

Registry Registrant ID:
Registrant Name: REDACTED FOR PRIVACY
Registrant Organization: REDACTED FOR PRIVACY
Registrant Street: REDACTED FOR PRIVACY
Registrant City: REDACTED FOR PRIVACY
Registrant State/Province: AK
Registrant Postal Code: REDACTED FOR PRIVACY
Registrant Country: US

And last, wheretobuyn95masksnearme.com redirecting to the same n95coronavirusmaskusa.com.

Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=143787

From the domain name registration:

Domain Name: WHERETOBUYN95MASKSNEARME.COM
Updated Date: 2020-03-23
Creation Date: 2020-03-06
Registrar Registration Expiration Date: 2021-03-06
Registrar: 1API GmbH

Registry Registrant ID:
Registrant Name: REDACTED FOR PRIVACY
Registrant Organization: REDACTED FOR PRIVACY
Registrant Street: REDACTED FOR PRIVACY
Registrant City: REDACTED FOR PRIVACY
Registrant State/Province: AK
Registrant Postal Code: REDACTED FOR PRIVACY
Registrant Country: US

[firefly]

From the fake website:

We are a mask manufacturer, with a number of certification, qualifications and product patents. We directly supply products to our customers. We have more than 3000 square meters factory and more than 200 employees.

At the moment you can only pay with credit/debit cards, such as:

Visa
MasterCard
American Express
Discover

For WHOLESALE ORDERS, PLEASE EMAIL. EMAIL:lrich3538@protonmail.com

Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=143782.

From the domain name registration:

Domain Name: N95CORONAVIRUSMASKSOUTHAFRICA.COM
Updated Date: 2020-03-23
Creation Date: 2020-03-12
Registrar Registration Expiration Date: 2021-03-12
Registrar: 1API GmbH

Registry Registrant ID:
Registrant Name: REDACTED FOR PRIVACY
Registrant Organization: REDACTED FOR PRIVACY
Registrant Street: REDACTED FOR PRIVACY
Registrant City: REDACTED FOR PRIVACY
Registrant State/Province: AK
Registrant Postal Code: REDACTED FOR PRIVACY
Registrant Country: US

This is what the fake website looks like:

[firefly]

What all these fake websites have in common, except the same fraudster using them?

There are no face masks for sale. The websites accept credit / debit cards only for payment because those websites are created with the solely purpose of harvesting credit card details and use that information for stealing your money from that card: