info@jirapronpalahong.com

[Big Al]

Dear sir
Thanks for contacting us regarding face mask product we can supply KN -95 and 3m 1860 .we can supply an order XXXXXX pcs and more

Thanks

Header:

Delivered-To:
Received: by 2002:a54:2504:0:0:0:0:0 with SMTP id q4csp228453eco;
Wed, 16 Sep 2020 02:17:38 -0700 (PDT)
X-Google-Smtp-Source: ABdhPJwd+6cqon2mpyYtCeBLWG1ydVALg8Vh4pocGZs+J0QwayEFVPnD3tcKBBlKA91BYIE7EaTv
X-Received: by 2002:a5d:5281:: with SMTP id c1mr25422418wrv.184.1600247858430;
Wed, 16 Sep 2020 02:17:38 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1600247858; cv=none;
d=google.com; s=arc-20160816;
b=Ch4488SsCaJMSEKAAFcUkRPmLyEuqlfw9/061YMQaC9GBhxk5CWvbVRMNwyXcVOhIr
BQKmZUo1UdDWgnKh0HU7xprtz1HOkbm+IXS7k+2mzEcWlq+ncae5X35mmN9dcl/JTSsU
coTfrMvfZJdRuNvxZoYCv/RDX1I09gbxuhiohEjRXgIBzhdw5xQOSRqGyLJcWrWB9fTY
rR+ml4TmEJgnwDDHmj5Tn7h8ifI6byXBBJI0jcqRItGxY8AXPbrYv7FEGeNM5mmmImRa
LOBld3XGJZgnU868PAKFYcEdwl3V0eC7119cv9dfdfvlUgCqiuxBxn5CvgZ32UdKsw4z
1yXQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=references:in-reply-to:message-id:reply-to:date:mime-version
:subject:to:from:dkim-signature;
bh=oTqFA/+2Fs5D6GjfHVMc4Xgl3PoDobMx/FHEJ3SwmlE=;
b=b/lcXpzmjVYX98+5wwGpGcjHSHoPHo+AS5ruqrkLUV6yroG3rKNDLr5FK2zW6rg+QG
/l61+vdYPjMS6PWqj43tlZU3aKB6sPFJCFfn3YGNp8xR0PYVe4sejuZC6eViZE4SmMWG
0EJhkUci0/K9Oyz7cJT8AFnhw8TI+KylplhNGBc8Ycq13pckrCHDAYS4PotVUnp1o2rt
i7T5h1Mg0k0kc9fyg7yQQjsuEbuqC9MVDMAlwvXH/+NRAUQaDiOqPYQ8DWpLn6nSvYC3
ltLJR2lHRctfj/+ILWfeInEyFQWN9rvIm8kOl7K4x55QdaQUMZHAvTSsrhX8W7jDsxtO
kG9Q==
ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass header.i=@jirapronpalahong.com header.s=default header.b=AIacjBQd;
spf=pass (google.com: domain of info@jirapronpalahong.com designates 91.148.168.143 as permitted sender) smtp.mailfrom=info@jirapronpalahong.com
Return-Path: <info@jirapronpalahong.com>
Received: from atom.vivawebhost.com (atom.vivawebhost.com. [91.148.168.143])
by mx.google.com with ESMTPS id v13si2142314wml.140.2020.09.16.02.17.37
for < >
(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
Wed, 16 Sep 2020 02:17:38 -0700 (PDT)
Received-SPF: pass (google.com: domain of info@jirapronpalahong.com designates 91.148.168.143 as permitted sender) client-ip=91.148.168.143;
Authentication-Results: mx.google.com;
dkim=pass header.i=@jirapronpalahong.com header.s=default header.b=AIacjBQd;
spf=pass (google.com: domain of info@jirapronpalahong.com designates 91.148.168.143 as permitted sender) smtp.mailfrom=info@jirapronpalahong.com
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=jirapronpalahong.com; s=default; h=References:In-Reply-To:Content-Type: Message-ID:Reply-To:Date:MIME-Version:Subject:To:From:Sender:Cc: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive;
bh=oTqFA/+2Fs5D6GjfHVMc4Xgl3PoDobMx/FHEJ3SwmlE=; b=AIacjBQd9jhyMqVkseiV4JPLS AIKII3ezMAzT2KCA+A4YMlfivh3g9q7GaIo5b2KPNLA5VF9F3Fik85BcGcZBvkCTvXgivnxEJJy8+ U+K6cOPUmikWbFhA8HDjFaMV8iAlGJDFvh/6e55uPYfS+yR/iM86CSJseXOgreyYMQW4F1KCcj183 RsnZgviqK4ePL1W5Ec/SZTnUo1m6wMgsyjC/CGbDsGAlfNOYEZtu0P10VgLiDmAYvnYdCvxXho/0/ zpnk6FXYNPt/tj0EeTqcJym4MFOXdAMONWFpMHjlXuwvKAf5LgWudZn9j19In5hq/1KcyWuo8eFXD oCJHLQ6Fg==;
Received: from f28.my.com ([185.30.177.90]:60124) by atom.vivawebhost.com with esmtpsa
(TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.93) (envelope-from <info@jirapronpalahong.com>) id 1kITZI-0005ok-J6 for ; Wed, 16 Sep 2020 05:17:36 -0400
X-Mailru-Internal-From: info@jirapronpalahong.com
From: info@jirapronpalahong.com
To:
Subject: Re: Covid Mask order KN-95
MIME-Version: 1.0
X-Mailer: My.com Mailer 1.0
Date: Wed, 16 Sep 2020 12:17:34 +0300
X-Letter-Fingerprint: al2arbstvi8QzARKdFEW6TFp3RIAMxvd
X-Priority: 3 (Normal)
X-Mailru-Compose-Stats: {"UserSessionTime":1937432,"Host":"e-aj.my.com"}
Reply-To: info@jirapronpalahong.com
Message-ID: <1600247854.554941452@f28.my.com>
Content-Type: multipart/alternative; boundary="--ALT--e65ffce55cd7411fb6822d8e655539051600247854"
In-Reply-To: <CAMW9G=0=MRKoQqAEz+5zzj8UBS3Nbf8yKJrceyPyOYU6QFO2aw@mail.gmail.com>
References: <CAMW9G=0=MRKoQqAEz+5zzj8UBS3Nbf8yKJrceyPyOYU6QFO2aw@mail.gmail.com>
X-7564579A: EEAE043A70213CC8
X-77F55803: 68A6F98766B02875A0F21CC061F2095323D2FBEB2644075C90B4729618E99909BC6A863F6426C69AC72A8547A9ECFEB296645BADCD593FF3
X-C8649E89: 32E6125AA5B442D4C3B2D19A53B047337E63033E5F08C9E0748192B5302CFB83ED4D2FBB5B58050F
X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu530nj6fImhcD4MUrOEAnl0W826KZ9Q+tr5+wYjsrrSY/u8Y3PrTqANeitKFiSd6Yd7yPpbiiZ/d5BsxIjK0jGQgCHUM3Ry2Lt2G3MDkMauH3h0dBdQGj+BB/iPzQYh7XS329fgu+/vnDhTsxzz/l1HzbEdOomN2n2RA==
X-Mailru-Sender: 8F8BF18704F8AFD5F4D81E01697EFC57F28DF420CD5286ACE5C128CDFE4292C77192F6DCD257F744146DD86D3D1DDE3E516640CEEC7DF823D79201E827DA94C1C1066F626AABBBD93DDE9B364B0DF289AE208404248635DF
X-Mras: Ok
X-Spam: undefined
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - atom.vivawebhost.com
X-AntiAbuse: Original Domain - gmail.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - jirapronpalahong.com
X-Get-Message-Sender-Via: atom.vivawebhost.com: authenticated_id: info@jirapronpalahong.com
X-Authenticated-Sender: atom.vivawebhost.com: info@jirapronpalahong.com
X-Source:
X-Source-Args:
X-Source-Dir:

----ALT--e65ffce55cd7411fb6822d8e655539051600247854
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: base64

Orig IP: 185.30.177.90 | Orig ISP: My.com B.v. | City: n/a | Country: Netherlands

[Big Al]

Dear sir

Yes we can supply you with Any quantity demanded. When do you want the good to be ship?
Send us you full order so we can proceed with Proforma invoice

Thanks

[Big Al]

Dear sir

Our payment term is 50% TT against proforma invoice and 50TT when goods arrive destination port

Price 1.60$ per piece

If that is okay we shall send you invoice Tomorrow

Thanks

Dear sir

Attached is the proforma invoice for you your order please checks and get back to us for any amendments.

BN,Due to higher tax rate to supply face mask we have to indicate on the invoice that medical equipment so as to deduct the tax .

We looking forward to your reply

Thanks

Seller Info from the Fake Invoice:
GCS Green Co. LTD.
Address: Phahon Yothin Rd, Chiang Rai, Thailand
Tell: +66970899591
Registration: 0355562000285

Bank account from the fake invoice:
Bank Name: Siam Commercial Bank PCL.
Acc Name: G. G. C. LTD
Acc Number: 284300XXXX
Swift Code: SICOTHBK
Address: Chatuchak, Bangkok
10900 Thailand

[firefly]

The fake supplier claims to be Jirapron Palahong / KS Global Product Supply and uses a website active from the fraudulent domain name jirapronpalahong.com.

The fake website advertises dried fruits, nuts and seeds for sale.

On various trading platforms, the offer is for face masks:

About Jirepron palahong :-
Registered in 2020 , Jirapron palahong has made a name for itself in the tist of top suppliers of Face Mask .N35 Mask in Thailand. The supplier company is located in Yela, Yala and is one of the leading sallers of listed products.
Jirapron palahong is listed in Trade India's list of verified sellers offering supreme quailty of 3M 8210 Breathable Face Masks Super Grade 3M &710
Face Mask .3M 8290 Anti Bacterial Face Masks etc. Buy Face Mask NOG Mask in bulk from us for the best quality products and service.

Well, it was listed, but not anymore - the account is now removed.

Contact details on the fake website:

Email: info@jirapronpalahong.com
Address: Phahon Yothin Rd, Chiang Rai, Thailand
Tel: +66967087682

Number billable as mobile number
Country or destination Thailand
Original network provider* True Move Company Ltd

Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=145771.

From the domain name registration:

Domain Name: JIRAPRONPALAHONG.COM
Updated Date: 2020-02-15
Creation Date: 2019-12-16
Registrar Registration Expiration Date: 2020-12-16
Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com

Registry Registrant ID: Not Available From Registry
Registrant Name: Brandon Wilson
Registrant Street: 333 Silom Road, Bangruk Bangkok, 333, Silom Rd., Suriyawong, Ban gkok 10500 Thailand,
Registrant City: Bangkok
Registrant State/Province: Bangkok
Registrant Postal Code: 10500
Registrant Country: TH
Registrant Phone: +66.6696756667
Registrant Email: suminyasurichay101@gmail.com

This is what the fake website looks like:

[Big Al]

Dear sir ,

We are also looking forward in building a long lasting relationship with you.send us a can copy of the payment receipt once you are done with payment which will take to our bank for confirmation of payment

Thanks

[Big Al]

Dear sir

You can use this account to make the payment

BENEFICIARY NAME: J. P.

ACCOUNT NUMBER: 002-007XXXX

BANK NAME: BANGKOK BANK PUBLIC COMPANY LIMITED.

SWIFT CODE: BKKBTHBK.

BANK ADDRESS: BUILDING 2, RUTCHADAPISEK ROAD, CHATUCHAK BANGKOK 10900 THAILAND.

Dear sir

What was the reason the transfer did not go through?if you have any difficulty with that account you can used this account to make the payment


BANK NAME:KASIKORNBANK PLC
ACCOUNT NAME: J. P.
ACCOUNT NUMBER: 063844XXXX
SWIFT CODE: KASITHBKXXX
BANK ADDRESS: 1 Soi Rat Burana 27/1, Rat Burana Road, Rat Burana Sub-district, Rat Burana District, Bangkok 10140

We are looking forward to read from you again

Thanks

Also when making payment do not used face mask as reason for transfer Used medical suppliers .

[maeryella]

i think i am in touch with these people now. we have made payment and 1 week later, still saying payment has not been credited to their bank account. i need help. what are the next steps to make. now its not responsive in whatsapp. but emails are being read.

[Big Al]

You should file a report with your local police.
Then take the police report to wherever you sent the money through and try to get any payments reversed.

If you sent the scammer a copy of your ID or Passport, you should get your line of credit frozen.

[maeryella]

We are transacting overseas. Would it be possible they could reverse the transaction?