info@maxfacemask.com

[Big Al]

Thanks sir for your responds , Yes we can supply you N95 mask 100,000 pcs
we give 3M 8210 face mask at 0.9$\pcs CIF . we deliver through DHL or EGT
within 4 to 5 days of confirmed purchased . mask are certified .
so your 100,000pcs will cost 90,000$


For delivery we will need your detail information and get you a Proforma Invoice for payments
and our Invoice issued is only valid for 7 days as of date of issue . So we will be waiting
on your responds . Payments is wire transfer TT bank to bank against our PI ,

maxfacemask.com
Email info@maxfacemask.com
WhatsApp +66990286005

Header:

Delivered-To:
Received: by 2002:a05:6102:75c:0:0:0:0 with SMTP id v28csp1893593vsg;
Mon, 13 Apr 2020 23:40:12 -0700 (PDT)
X-Google-Smtp-Source: APiQypLV+wow8cYMC8Ye8iJ9FF52zFGFrpTXdUZJ5CoUDTAV5k8nIcVBCAjFGtjBiapi90CqC90W
X-Received: by 2002:a05:6830:11d5:: with SMTP id v21mr7577321otq.91.1586846412234;
Mon, 13 Apr 2020 23:40:12 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1586846412; cv=none;
d=google.com; s=arc-20160816;
b=soGqLodnEXCNqupMRomeKfS8osCIsEY3AI8FWwyjDUPw8HnMVWcfR5vCUmhH6gaElC
2KA62PY1tWWzzOaogAGxrVoeU+6i7XHfk9wTAFePT8jo9fUmMQ1gPHok+D6hf3JG3gaP
jpfTTiBPzZtmCcw6zLjDUzbLYfZ4fR+mVKS0V5cWV1i7IJS9e8iRcXNKGsOsuFVj511a
LTTHdP/tfAHP9sl0qJS0yuhzNpBgOnF6s67aWEVp8cskiHWqNlUVSoqZFK3Uf58qvIs8
iLK5f78Ih2+P6lco50ASaOCZ9bUJ9z+kYOac1oj3/VS+SWXWaD28L3QhsuB+DAzLSD5O
KGAQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=user-agent:message-id:references:in-reply-to:subject:to:from:date
:content-transfer-encoding:mime-version:dkim-signature;
bh=FnC31HSo5Ts+GPTtpMWUVvsvWkPi5Nc2uQgEQAZ6nhI=;
b=FPKSORKTAc/2VMZ2oRhPW8nel9WhcKcImvEDor7v3w58yVVSKirBQP/TIvDiO3GY0P
G2EQBOQC4yR7T755oSeYRuszjsFVokAKLRnIlRZhKOACnSMHHn3CvLGJM0cp5SBuQRUN
zc+Od6nrBlYmsDWsmujeeTORsvJAHpJvFKYjOF9mZ7grXH4NU32gCZC3N8ocb8J44X30
ZjkDwVCMTTIJNY3vJ0d+n8kIueaSsw7mUI7HI2qj9Qhx3jmRq++n9SeI7GTkAtHL2NJ+
Swwb9ydv39jNonZvXb59Tqdf/2DFFVqNZqHSwQWEWuMPzWLBxodr1y5+pPsOaN9+1YGd
v5Aw==
ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass header.i=@maxfacemask.com header.s=default header.b=K3OtuCod;
spf=pass (google.com: domain of info@maxfacemask.com designates 173.237.185.96 as permitted sender) smtp.mailfrom=info@maxfacemask.com
Return-Path: <info@maxfacemask.com>
Received: from rex.vivawebhost.com (rex.vivawebhost.com. [173.237.185.96])
by mx.google.com with ESMTPS id s133si5434543oig.254.2020.04.13.23.40.11
for < >
(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
Mon, 13 Apr 2020 23:40:12 -0700 (PDT)
Received-SPF: pass (google.com: domain of info@maxfacemask.com designates 173.237.185.96 as permitted sender) client-ip=173.237.185.96;
Authentication-Results: mx.google.com;
dkim=pass header.i=@maxfacemask.com header.s=default header.b=K3OtuCod;
spf=pass (google.com: domain of info@maxfacemask.com designates 173.237.185.96 as permitted sender) smtp.mailfrom=info@maxfacemask.com
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=maxfacemask.com; s=default; h=Message-ID:References:In-Reply-To:Subject:To: From:Date:Content-Transfer-Encoding:Content-Type:MIME-Version:Sender:Reply-To :Cc:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=FnC31HSo5Ts+GPTtpMWUVvsvWkPi5Nc2uQgEQAZ6nhI=; b=K3OtuCodaw+F+Kms0l4S7FrMsx 7FNKWUPFwvW9GDRhcCls/Tx0aI6/OY3ACOt51MNsqteC7WnbG2OEFxMrhgh6X/KARTndgP5gCxYFY csSLAqmSIFGHqTJeudC5Ynb1ERos0nPR9CZoqAfsVsBULKLQWcfhXjgKKcW8sph6oNyBqnIHaqn2b j6sthzcpbqcaTZePPCXu8vsPaTnKvza2ALXjgSxHB2T+gkDYU4uxhExSBEm4EaKLFSVJah6/8vSxv 9VcC8U7JD8c2AnplizQc6mEYPZ/UaKSTGfM1RweORoCXWbCCwvmBjQzVBcZa6LXk+ebF7+aCNWgwn qEHDIyzg==;
Received: from [::1] (port=40226 helo=rex.vivawebhost.com) by rex.vivawebhost.com with esmtpa (Exim 4.93) (envelope-from <info@maxfacemask.com>) id 1jOFEx-0000Mg-GZ for ; Tue, 14 Apr 2020 02:40:11 -0400
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII; format=flowed
Content-Transfer-Encoding: 7bit
Date: Tue, 14 Apr 2020
From: info@maxfacemask.com
To:
Subject: Re: N95 Masks
In-Reply-To: <CAEVhzYWiysW5-ppt=dAvxGDM3-2+aEDxGutA+=agJNQLCEUauA@mail.gmail.com>
References: <CAEVhzYWiysW5-ppt=dAvxGDM3-2+aEDxGutA+=agJNQLCEUauA@mail.gmail.com>
Message-ID: <6a2f9db55a89d1225f242bd6bba462d2@maxfacemask.com>
X-Sender: info@maxfacemask.com
User-Agent: Roundcube Webmail/1.3.8
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - rex.vivawebhost.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - maxfacemask.com
X-Get-Message-Sender-Via: rex.vivawebhost.com: authenticated_id: info@maxfacemask.com
X-Authenticated-Sender: rex.vivawebhost.com: info@maxfacemask.com
X-Source:
X-Source-Args:
X-Source-Dir:

Orig IP: 173.237.185.96 | Orig ISP: As-tierp-36024 | City: Fort Worth | Country: United States

Phone:
+66990286005
Number billable as mobile number
Country or destination Thailand
City or exchange location
Original network provider* Advanced Info Service Public Company Ltd (AIS)

[Big Al]

Dear sir
Thanks for your responds , we will get your Invoice ready within 24 hours for payments and proceedings
as also a fast and safety measure due to the Covid 19 pandemic we have decided to receive bitcoins as
a means of payments . So sir kindly notify to us if you can do bitcoin payments because they are instant
and reduces delivery time or Bank transfer . Please get back to us within 24 hours as well if you can so
we know how your Invoice be made . Delivery is within 4 to 5 days through DHL or EGT as from date of confirmed
purchase
regards and waiting on your responds
Mr Peterson

[Big Al]

Dear sir
will send you an Invoice within 24 hours
regards

DEAR SIR
ATTACHED IS A COPY OF A PI FOR YOUR ORDER , YOU ARE REQUIRED TO PAY 50% AGAINST THIS PI AND 50% AGAINST AIRWAY BILL
SO SIR YOU ARE REQUESTED TO MAKE PAYMENTS OF 45,000$ AGAINST THIS PI AND 45,000$ AGAINST AIRWAY BILL . SO SIR WHEN
YOU DO THE FIRST PAYMENTS SEND ME PROOF OF PAYMENTS AND WE WILL IMMEDIATELY PROCESS YOUR SHIPPING THROUGH DHL OR EGT
REGARDS AND WAITING ON YOUR RESPONDS

Bank account information from the fake invoice:
Bank Name... Siam Commercial Bank Plc
Account number...433048xxxx
Swift code ....SICOTHBK
Account names...K. Y.
Bank address...9Ratchadapisek Rd, Jatujak, Bangkok 10900 Thailand

[firefly]

The fraudsters are targeting victims on trading platforms:

Anti-Pollution Kn95 Ffp3 Dust Mask Kf94 Filter Face N95 Respirator
Email info@maxfacemask.com WhatsApp +1(262) 546 7844 Material PP nonwoven, activated carbon layer, melt blown filter, soft cotton, PP nonwoven Layer 5 Size 10.5x15.5cm or customized Type Ear loop or head strap Color Black, grey, dark blue MOQ 5000pcs Packing 1pc/bag, 20pcs/inner box, 600pcs/carton  Usage Protection from odor and particles such as those from painting, grinding, sanding, sweeping, sawing, bagging, or other dustyoperations Packaging & Shipping  Standard packing: 1pc/bag, 20pcs/inner box, 600pcs/cartonCarton size: 67X30X59cmGross weight per carton: 9.8KGStandard packing: 1pc/bag, 20pcs/inner box, 600pcs/cartonCarton size: 67X30X59cmGross weight per carton: 9.8KG

Company details on the trading platform:

Company El Bolero
Business Type Manufacturer
Established 1980
Employess 101 - 200 People
Annual RevenueUS $1 Million - US$2.5 Million
Industry Dermatology Equipment in USA
Products Dermatology Equipment, Masks
Ms. spens Peterson
USA

[firefly]

The fake supplier pretends to be a company named Max Face Mask, using a fraudulent website active from the domain name maxfacemask.com. Despite of providing in their correspondence a Thailand mobile number used on WhatsApp, the fake supplier website claims their location is USA.

From the fake website:

Thanks for visiting Max Face Mask. We pride our selves as one of the most Reliable Mask and Tissue distributors in America.
Max Face Mask is a manufacturer and distributes a vast range of medical and surgical products to healthcare institutions and retail markets around the globe. We are in no doubt one of the largest privately held manufacturer and distributor of healthcare products in America and is leveraging that success in international markets.A company started in. Holland and have expanded to other countries throughout the years including, France and also SE ASIA in the Philippines

Contact details:

893 Southwood Blvd
Incline Village
Nevada(NV)
89451
United States of America
info@maxfacemask.com
+12625467844

+12625467844
Type: Non-Fixed VoIP (e.g. Skype or Google Voice)
Original carrier: Choice One Comm Wi

Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=143317.

From the domain name registration:

Domain name: maxfacemask.com
Updated Date: 2020-03-28
Creation Date: 2020-03-16
Registrar Registration Expiration Date: 2021-03-16
Registrar: NAMECHEAP INC
Reseller: NAMECHEAP INC

Registry Registrant ID:
Registrant Name: WhoisGuard Protected
Registrant Organization: WhoisGuard, Inc.

This is what the fake website looks like:

[Big Al]

DEAR SIR
THANKS FOR YOUR REPLY , SIR WE WISH TO TELL YOU THAT ALL PAYMENTS WE RECEIVE AS PAYMENTS IN OUR COMPANY
HAVE BEEN PAID THROUGH THIS BANK ACCOUNT AND ITS AN INTERNATIONAL BANK . SIR WHEN YOU TELL ME THAT PAYMENTS
ARE NOT GOING THROUGH DO NOT KNOW WHAT TO SAY BECAUSE YOU ARE THE FIRST PERSON I AM HEARING THIS FROM YOU
OR COMPLAINING HOW PAYMENTS HAVE NOT GONE THROUGH , DEAR SIR YOU CAN KINDLY SEND ME THE SWIFT OF THE FAILED
TRANSFER SO I CAN TAKE TO MY BANK TO NOTIFY THEM ABOUT THE ISSUE , PLEASE YOU NEED TO DO THE PAYMENTS AGAIN
THROUGH THIS SAME ACCOUNT BECAUSE WE DO NOT HAVE ANY ACCOUNT THAT WE RECEIVE PAYMENTS APART FROM THIS WE HAVE
GIVEN YOU . THE SECOND MEANS OF PAYMENTS WE RECEIVE IS ALSO BITCOIN , SO PLEASE SEND ME THE SWIFT OF THE FAILED
TRANSFER LET ME TAKE TO OUR BANK TO VERIFY WHAT COULD BE THE PROBLEM . SECONDLY DO NOT KNOW IF YOU WILL BE OK
PAYING TO OUR COMPANY CASHIERS ACCOUNT WHILE WE VERIFY WHY THE TRANSFER FAILED . IF YOU ARE COMFORTABLE MAKING
THE PAYMENTS TO OUR COMPANY CASHIERS ACCOUNT DIRECTLY THEN LET ME KNOW

REGARDS AND AWAITS YOUR PROMPT RESPONDS

DEAR SIR
ACCEPT GREETINGS ONES MORE , YOU ARE RIGHT ABOUT PAYMENTS NOT GOING THROUGH , A CUSTOMER ALSO COMPLAINED THIS MORNING AGAIN , WE HAVE RECEIVED LC FOR A HUGE AMOUNT AND THE PROCESSING IS GOING ON AND MAYBE ITS THE REASON WHY PAYMENTS ARE NOT GOING THROUGH TO MY OWN IDEA , BUT WE HAVE FORWARDED THE ISSUE TO OUR BANK AND THEY ARE CHECKING ON THE REASON WHY ITS NOT GOING THROUGH . SO SIR TO AVOID YOU WAITING WE WILL BE USING THIS ACCOUNT BELLOW NOW FOR PAYMENTS WHILE THE ISSUE IS BEING RESOLVED . WE HOPE YOU UNDERSTAND AND PROCEED WITH THE PAYMENTS USING THIS ACCOUNTS BELLOW .

BANK ACCOUNT DETAILS FOR PAYMENTS
Account Name.......L. L.
Account number.....068320XXXX
Bank ..............Kashikorn Bank
Swift code ........kasithbk
Address............Bangkok 10140 Thailand


Sir when you are done you send us the swift for confirmation , we will be very happy for your understanding and a prompt responds .
Thanks and regards

[Big Al]

DEAR SIR
THANKS FOR YOUR RESPONDS , WE WILL BE WAITING TO GET THE SWIFT TO PROOF THE PAYMENTS WHEN YOU ARE DONE AND WILL IMMEDIATELY PROCEED WITH SHIPPING PROCESS
REGARDS AND WAITING TO READ FROM YOU THEN

[Big Al]

DEAR SIR
ACCEPT GREETINGS , HOPE ALL IS WELL ? JUST WISH TO KNOW IF EVERYTHING NOW IS GOOD
AND HAVE YOU MADE THE PAYMENTS ?
REGARDS

[Big Al]

DEAR SIR
GREETINGS WE JUST HAVE BEEN WAITING JUST TO READ FROM YOU WHAT THE UPDATES MAY HAVE BEEN
WHAT, YOU DO NOT EVEN RESPOND RATHER LETTING US KNOW A CHANGE OF MIND WILL BE VERY GOOD
SIR . PLEASE CAN YOU GET US A MAIL WITH YOUR DECISIONS OR WHAT IS WRONG THAT YOU CAN NOT WRITE US
REGARDS

[Big Al]

BANKING DETAILS
BENEFICIAL ACCOUNT NAMES ......E. B. LLC
ACCOUNT NUMBER.................131323XXXX
BANK NAME......................WELLS FARGO
SWIFT CODE.....................WFBIUS6SXXX
ABA ROUTING ...................121042882
BANK ADDRESS ..................2 GRANT AVE , SAN FRANCISCO , CA 94108

THAT IS THE OPEN ACCOUNT YOU REQUESTED AND ITS IN THE USA , HOPE ALL IS NOW AS YOU REQUESTED .
PLEASE LET ME KNOW WHEN PAYMENTS WILL BE DONE AND PLEASE VERIFY WHY PAYMENTS ARE NOT FOING
THROUGH INTERNATIONALLY WITH YOUR ACCOUNTS . REMAIN ATTENTIVE TO READ FROM YOU
REGARDS AND AWAITING YOUR RESPONDS