info@cmbtradings.com

[Big Al]

Good day ,

we sell N95 for $0.5/pcs , kindly confirm and price and give us your company details to issue you proforma invoice, we await your prompt reply.

Thanks

Header:

Delivered-To:
Received: by 2002:ad4:4248:0:0:0:0:0 with SMTP id l8csp368136qvq;
Wed, 1 Apr 2020 19:19:42 -0700 (PDT)
X-Google-Smtp-Source: APiQypIZpnkV1bEe/IKkTs6wKAOjBDBSSEP2So/SQiOzb2pHQ+t0wLRAmYIeqNClUxwJQMdYtNcx
X-Received: by 2002:a5e:990d:: with SMTP id t13mr791235ioj.52.1585793982277;
Wed, 01 Apr 2020 19:19:42 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1585793982; cv=none;
d=google.com; s=arc-20160816;
b=hbgNgrL+nuxwE0S+yLkBaHeTZcgEmbuTe0gGIpXwAGWBsB+09ELW1PLN9O5SWhx1s1
rO6psj+0rz3KGiU0ReVneT4jb/CRuvCGH5KWfsuudgoufNMCPp6/25ZqIWNhgvnpu6Ed
VgGJMiGBFJAo2yyogtkoQVPIFcKnHqi2rUz8xmnvpRVJKXO/GrWt9uvecnUnYHx1xL9h
08HPJtkOkukVpQUiO7umSf/yorXJGjZ6tFptXql8CsYRq1whxG1mP36NzgNzIWObpk3t
Fbv79D9GhGqD2b6zXTYplrgxfxUf5KBVz23s2TNmNuN2iagulMaa0PveYZKLALHLmTwl
JbSQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=user-agent:message-id:references:in-reply-to:subject:to:from:date
:mime-version:dkim-signature;
bh=6MfQVAKRX4hCzMM+ISNyPTbRl8rOh6trE7jYGjwJwMU=;
b=b57hFRXvZ0yQJOnKxAeufXxIsoL1OICaK9tx987HlGqlAYl/UoxQIanabAyccWlMqX
1fa/uqX3byUIBq7gMTNkMU09o04HCQ2uxPOj0Q1ypL/WEQ+FYuDdsTNQe3unHhf5kXcI
dqWDSd/tVUuVEwPHJOuOXqIrC1+mc1kZpwAMg6kskmiKSQ97N9z/Ei7rcibzJI2+xxE4
VarlCXBmdUhTseu26LE+zFnritjopS5cMeSJb8f6ITjkZE4Iy9Iu8WS5/QlijpS+ZQVu
IRmkUDPwZzYqqom0CZ5LX3qaSAvLcOnvZ1CSejwJPMOFvYRlAyGCZz53FQ3g5OPzwh3p
mGIw==
ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass header.i=@cmbtradings.com header.s=default header.b="j8MDW/Ex";
spf=neutral (google.com: 198.54.115.8 is neither permitted nor denied by best guess record for domain of info@cmbtradings.com) smtp.mailfrom=info@cmbtradings.com
Return-Path: <info@cmbtradings.com>
Received: from server191-2.web-hosting.com (server191-2.web-hosting.com. [198.54.115.8])
by mx.google.com with ESMTPS id a6si3260601ilh.85.2020.04.01.19.19.41
for < >
(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Wed, 01 Apr 2020 19:19:42 -0700 (PDT)
Received-SPF: neutral (google.com: 198.54.115.8 is neither permitted nor denied by best guess record for domain of info@cmbtradings.com) client-ip=198.54.115.8;
Authentication-Results: mx.google.com;
dkim=pass header.i=@cmbtradings.com header.s=default header.b="j8MDW/Ex";
spf=neutral (google.com: 198.54.115.8 is neither permitted nor denied by best guess record for domain of info@cmbtradings.com) smtp.mailfrom=info@cmbtradings.com
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=cmbtradings.com; s=default; h=Message-ID:References:In-Reply-To:Subject:To: From:Date:Content-Type:MIME-Version:Sender:Reply-To:Cc: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive;
bh=6MfQVAKRX4hCzMM+ISNyPTbRl8rOh6trE7jYGjwJwMU=; b=j8MDW/Exe6QzmXeC21toR61ax d0JkhJ1b/gfXasrWZOydpBu7popQdHPEoDNbkm1XzN+tWNaoFGsrUvP8IMEPpag2Yn5dhMlLwtIQ4 6uggfRXjkvNuX7SKlYgOF4fEcbuWf+LbDrITDIGtBsfdtlK6uERzNvQWNP2EyzS719bdwzRgnZGEE 6xXkrqlhW53OBqhfiO5CB/mICMRakxoVRVE0CWHv87LztakMn7GnfxrGOLAEfgIMbyEBpdZL8SxQd raEfN1omndvh6g+XyL/Mnfqh9z9IW1n+AX9qIyUOtwUL09gmUesMUdpsGQasp7eId884wzHGSYrMm eRQ8oqmFw==;
Received: from [::1] (port=54540 helo=server191.web-hosting.com) by server191.web-hosting.com with esmtpa (Exim 4.93) (envelope-from <info@cmbtradings.com>) id 1jJpSC-003y4d-Rp for ; Wed, 01 Apr 2020 22:19:41 -0400
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="=_b5ec41d43a7993f236b8e9dbf6c88674"
Date: Wed, 01 Apr 2020
From: info@cmbtradings.com
To:
Subject: Re: N95 Masks
In-Reply-To: <CABd=3yjx9syamYaJAfcWks98iGAvBWasu=8T56qM00egRyymLA@mail.gmail.com>
References: <CABd=3yjx9syamYaJAfcWks98iGAvBWasu=8T56qM00egRyymLA@mail.gmail.com>
Message-ID: <7b80f3cbfbc291e8e6b0d9ae3bccb83a@cmbtradings.com>
X-Sender: info@cmbtradings.com
User-Agent: Roundcube Webmail/1.3.8
X-OutGoing-Spam-Status: No, score=5.0
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server191.web-hosting.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - cmbtradings.com
X-Get-Message-Sender-Via: server191.web-hosting.com: authenticated_id: info@cmbtradings.com
X-Authenticated-Sender: server191.web-hosting.com: info@cmbtradings.com
X-Source:
X-Source-Args:
X-Source-Dir:
X-From-Rewrite: unmodified, already matched

--=_b5ec41d43a7993f236b8e9dbf6c88674
Content-Transfer-Encoding: 7bit

[firefly]

The fraudsters target their victims on Facebook as:

CMB Tradings
Shopping & Retail
+63 949 170 4403
sales.cmbtradings@gmail.com
https: // www. cmbtradings.com/
Page created - March 16, 2020

Sensi 3 ply surgical Mask,3m 8210 ,1860 3M™ Particulate Respirator , whole seller selling on a very good price. $5 /Box for 3 ply Sensi Brand and $0.5/Pcs for 3M 8210 & 1860. contact for more details Contact @ sales@cmbtradings.com

+639491704403
Number billable as mobile number
Country or destination Philippines
Original network provider* Smart Communications

[firefly]

The fake supplier pretends to be a business named CMB Tradings and uses a fraudulent website active from the domain name cmbtradings.com.

From the fake website:

CMB Tradings is dedicated to helping those who save and improve patient lives. For nearly 50 years, we’ve provided medical supplies and equipment to healthcare professionals and first responders. We are continually expanding our product offering to better meet the needs of fire and CMB, law enforcement, K-12 schools, colleges and universities, hospitals, physician offices, businesses, parks and more.

Contact details:

Unit 401, Fourth Floor, Trinidad Building, Yacapin street, corner Corrales Avenue, Cagayan de Oro City, 9000
P: +63 (966) 290 2462
E: info@cmbtradings.com

+639662902462
Number billable as mobile number
Country or destination Philippines

Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=143029.

From the domain name registration:

Domain name: cmbtradings.com
Updated Date: 2020-02-12
Creation Date: 2020-02-10
Registrar Registration Expiration Date: 2021-02-10
Registrar: NAMECHEAP INC
Reseller: NAMECHEAP INC

Registry Registrant ID:
Registrant Name: WhoisGuard Protected
Registrant Organization: WhoisGuard, Inc.

This is what the fake website looks like:

[firefly]

Emails received:

Dear Sir / Madam,

Thanks for the interest and the email in our products. CMB Tradings , A Trading company , We are a main distributor /supplier of High Quality Respirator Face Mask and other products around
Asia and worldwide . Fully registered and in partnership with many other companies to meet supplies for other product which we do not produce. We are willing and able to do business with your company. We
are willing, able and ready to supply you with high quality products at whole sale prices ,
Particulate Respirator 8210,1860 N95
Packing :160pcs/carton( 20pcs /box; 8box/carton)
3M 8210 is recommended for sanding, grinding, sawing, sweeping and insulating

Price CIF :
3M USD. 0.5/Piece
3 Ply Surgical Mask. USD 5/Box of 50 Pieces

Terms of Payment: 100%T/T against proforma Invoice .

Quality Guarantees:

USDA Approved.

Samples:Not applicable.

Shipment: 3-4 days max after payment

SGS inspection.

Please confirm your order so we can send you our Full Corporate Offer
and subsequently proceed with work. If you have other questions ,feel
free to contact us , Thanks once again for choosing our company, and
we hope for maximum cooperation and long term business relationship
with you.
--
Thanks and Regards

----------------------
Mrs. Rosine A. Ligaya
Sales/Marketing Manager
CMB TRADINGS
Address : Unit 401, Fourth Floor, Trinidad Building, Yacapin street, corner Corrales Avenue, Cagayan de Oro City, 9000 Philippines
Website :https: // www. cmbtradings.com/
Email : sales.cmbtradings@gmail.com OR sales@cmbtradings.com
Mobile # :+63 949 170 4403
WhatsApp # :+63 949 170 4403
-------------------------------------------------------------------------------
This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error, please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee, you should not disseminate, distribute or copy this email. Please notify the sender immediately by email if you have received this email by mistake and delete this email from your system. If you are not the intended recipient, you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited

Header:

Return-Path: <sales.cmbtradings@gmail.com>
Received: from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41])
In-Reply-To: <CAPqXmjfuz3HsQLe3gXDoOU8V-hRaZqHE1VicUTTRSQozMiPNLQ@mail.gmail.com>
From: Rosine Ligaya <sales.cmbtradings@gmail.com>
Date: Mon, 6 Apr 2020 04:26:23
Message-ID: <CAJs2e4bCXnjuFke3r+b5yNEuiJNNYi=Toyzd5jFrW4smDJdcxg@mail.gmail.com>

[firefly]

Messages received:

Our minimum order is 1,000 boxes

Well sorry but that’s our minimum order , at the moment we do not supply below that quantity

Okay kindly issue purchase order with your company details so we can issue you proforma invoice and proceed

We wanted you to confirm before we send the proforma invoice to you because we don’t want invoice to expire with you , will send now

Find attached proforma invoice, kindly send us copy of the transfer swift for confirmation, we await your prompt reply.
--
Thanks and Regards

----------------------
Mrs. Rosine A. Ligaya
Sales/Marketing Manager
CMB TRADINGS
Address : Unit 401, Fourth Floor, Trinidad Building, Yacapin street, corner Corrales Avenue, Cagayan de Oro City, 9000 Philippines
Website :https: // www. cmbtradings.com/
Email : sales.cmbtradings@gmail.com OR sales@cmbtradings.com
Mobile # :+63 949 170 4403
WhatsApp # :+63 949 170 4403
-------------------------------------------------------------------------------
This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error, please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee, you should not disseminate, distribute or copy this email. Please notify the sender immediately by email if you have received this email by mistake and delete this email from your system. If you are not the intended recipient, you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited

Fake document received with the message:



Bank account used in fraud:

Bank Name: RIZAL COMMERCIAL BANKING CORPORATION
Beneficiary Name: C. M. S. B.
Account Number #:903-xxx-xxxx
Swift Code: RCBCPHMM
Add: 6819 AYALA AVENUE, CORNER SENATOR GIL PUYAT AVE.
Country: PHILIPPINES

[CrabGuy]

Cmbtradings is also working as a company called ECRG-INC.COM. They use the email addresses: sales@ecrg-inc.com AND sale.ecrg.inc@gmail.com. They use an url: https: // www. ecrg-inc.com/. One of the email addresses sends the email to sales@cmbtrading.com. I discovered this when they sent me an email and I clicked on the email addresses. This was obviously a mistake on their part...but a mistake nonetheless. They are also based out of the Philippines. I asked if they had any affiliation to cmbtradings, but they denied any affiliation. The real question is why would the email address they gave me go to [mail to:]sales@cmbtrading.com when I clicked on it? No other email address does that when clicked on. Be wary, if you use them and you lose your money....you have been warned.

[firefly]

The fake site used in scam claims to be a supplier named ECR Global INC.

From their fake website:

ECR Global INC ‘s story began in 2002, as a DBA of Evergreen Company-the largest U.S. importer of beef and lamb from Australia and New Zealand at the time. ECRG INC. quickly flourished into a major exporter, initially handling seafoods into the South East Asian region.
In 2005, Nangpi Despujol acquired full ownership of ECRG INC. a subsidiary of ECRG INC.Supo GROUP, and ECR Global INC was formed with base in PHILLIPINE. It wasn’t long before the company recognized the need for greater product diversity. In time, we expanded our exports to include a variety of meats as well as premium agriculture goods, canned items, and more

The scammers stole the company history from a real US company having no connection with the scam.

Contact:

103 Rama St, Iloilo City, 5000 Iloilo City, Region 6 Philippines
+63 966 764 3390
Email: info@ecrg-inc.com

+639667643390
Number billable as mobile number
Country or destination Philippines

Entry in the aa419 database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=157538

From the domain name registration:

Domain name: ecrg-inc.com
Updated Date: 2022-04-11
Creation Date: 2020-04-10
Registrar Registration Expiration Date: 2023-04-10
Registrar: NAMECHEAP INC
Reseller: NAMECHEAP INC

Registry Registrant ID:
Registrant Name: Redacted for Privacy
Registrant Organization: Privacy service

This is what the fake supplier website looks like: