Site logo


Switch to full style
Post up any 419 emails you received. All persons/companies depicted in these emails are either fictitious or have had their identities copied/stolen by the scammers.
Post a reply

Sun Mar 22, 2020 12:31 am

Corona Virus Mask Non-delivery scam

Hello thank you for visiting our Pharmacy which is here to satisfy your emergency needs to safe lives. For we can supply your number you are asking for and even more with available discounts. Please get in touch with our sales agent online through WhatsApp to conclude your order thank you.

WhatsApp Number: +447466448880
Direct call: +443301289172

https:/ /

Received: by 2002:a67:e105:0:0:0:0:0 with SMTP id d5csp2050229vsl;
Sat, 21 Mar 2020 10:34:13 -0700 (PDT)
X-Google-Smtp-Source: ADFU+vtgGM3FbUQ3qhsCMSuTqi9IFEqwObenj5EcjUfqlJxuhz2PebK/S2qwwKaLHMHRYQ/LIPPv
X-Received: by 2002:aa7:9906:: with SMTP id z6mr16500006pff.112.1584812052945;
Sat, 21 Mar 2020 10:34:12 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1584812052; cv=none;; s=arc-20160816;
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed;; s=arc-20160816;
ARC-Authentication-Results: i=1;;
dkim=pass header.s=default header.b=DH1kqu6+;
spf=softfail ( domain of transitioning does not designate as permitted sender)
Return-Path: <>
Received: from ( [])
by with ESMTPS id 62si6834270pjo.111.2020.
for < >
(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Sat, 21 Mar 2020 10:34:12 -0700 (PDT)
Received-SPF: softfail ( domain of transitioning does not designate as permitted sender) client-ip=;
dkim=pass header.s=default header.b=DH1kqu6+;
spf=softfail ( domain of transitioning does not designate as permitted sender)
X-Sender-Id: interserver|x-authuser|
Received: from (localhost []) by (Postfix) with ESMTP id 966ED100F71 for < >; Sat, 21 Mar 2020 17:34:11 +0000 (UTC)
Received: from (100-96-23-19.trex.outbound.svc.cluster.local []) (Authenticated sender: interserver) by (Postfix) with ESMTPA id 00A6E100F3F for < >; Sat, 21 Mar 2020 17:34:10 +0000 (UTC)
X-Sender-Id: interserver|x-authuser|
Received: from ([UNAVAILABLE]. []) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384) by (trex/5.18.5); Sat, 21 Mar 2020 17:34:11 +0000
X-MC-Relay: Junk
X-MailChannels-SenderId: interserver|x-authuser|
X-MailChannels-Auth-Id: interserver
X-Grain-Bitter: 69be320a03901d6e_1584812051359_1046679247
X-MC-Loop-Signature: 1584812051359:1191646359
X-MC-Ingress-Time: 1584812051359
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;; s=default; h=Message-ID:References:In-Reply-To: Subject:To:From:Date:Content-Transfer-Encoding:Content-Type:MIME-Version: Sender:Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help: List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=gfT2ktLHB9MnG8+FPxXmw0WvV4U26j8+65eZt4li8s0=; b=DH1kqu6+2LRRZ5BmsLNsLzyb1e BI0UwhOxHleNUoGh64mas8hj71Se8vJpTA1Pnokn2M8PKRy0ybLAl/MPbcAAX51C+Ns1AJI9xmJO6 lUGHlcPUszuTKS3Va+b36HnfUGx9jTxt45TDCs/Ah5R9QkitOWeFZJr/iUI8A157UK0/B4/Nh37c2 EHm/g3PvKvY1FXq46MonXW8YnVJ1Lc4x3LSNJdK70z8/59IiT3QIfJ5ii+oMPRBqj9ulqlZZCJPaC EPKBF6kJ6lgAR7WtW7P/NvdLE6JCGLk/9V5axpP4mKEyA09JVyE8PFb5NsXVm7MfiRGq6xSTa5fdy HkAMksGQ==;
Received: from [::1] (port=54474 by with esmtpa (Exim 4.93) (envelope-from <>) id 1jFi0f-002m3C-6C for ; Sat, 21 Mar 2020 13:34:09 -0400
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII; format=flowed
Content-Transfer-Encoding: 7bit
Date: Sat, 21 Mar 2020
Subject: Re: N95 Masks
In-Reply-To: <>
References: <>
Message-ID: <>
User-Agent: Roundcube Webmail/1.3.8
X-OutGoing-Spam-Status: No, score=-1.0

Number billable as mobile number
Country or destination United Kingdom
City or exchange location
Original network provider* Lycamobile UK Limited

Number billable as national geographic number
Country or destination United Kingdom
City or exchange location

Sun Mar 22, 2020 5:14 pm

All good, our 3M N95 Safety Face Masks Respirators cost $10 for a pack of 10 pieces. For your order, we will deliver a pack for $3 each. Hence, 50,000 pieces will equal 5000 packs where each pack is made up of 10 pieces.
When you are ready then send your company informations to prepare your shipping invoice. Thank you.

https:/ /

Tue Mar 24, 2020 12:22 am

Below is your invoice to conclude delivery.
Take note that 30% W/T (Wire Transfer) down payment is to help seller meet up with shipment or transportation expenses to buyer. This might include: inland transportation charges, inland taxes,cargo load, inspection, final packaging, port to port, transportation charges etc..



Bank account details from the fake invoice:
TW ACCOUNT NAME........................IBRAHIM T.
IBAN..............................DE32 7001 1110 6057 XXXXXX
BANK.........................................................Handelsbank ZIPCODE....................................................80687
ADDRESS..................................................Munchen, Germany


Tue Mar 24, 2020 6:55 am

The fake supplier claims to be a company named Medico Pharmaceutical and uses a fake website active from the domain name

From the fake website:

At Medico-Pharmaceuticals, we have a large stock of mask wear to fight against the coronavirus and other contagious diseases. With a mission to create an atmosphere for easy access and purchase of our preventive products at affordable rates to save humankind.
Medico-Pharmaceuticals is the number one source for surgical face masks and related products. It is our goal to provide you and your staff with the highest quality of personal protection products and service solutions

Contact details:

New York, NY 10160
Whatsapp +447466448880

New York is in this case in Duala, Cameroon.

Entry in the aa419 Database of fraudulent websites:

From the domain name registration:

Updated Date: 2020-03-11
Creation Date: 2020-03-11
Registrar Registration Expiration Date: 2021-03-11
Registrar: NetEarth One, Inc.

Registry Registrant ID: Not Available From Registry
Registrant Name: ngah bowel
Registrant Street: maison blanche
Registrant City: douala
Registrant State/Province: littoral
Registrant Postal Code: 237
Registrant Country: CM

Registrant Phone: +237.690480438
Registrant Fax Ext:
Registrant Email:

This is what the fake website looks like:


Wed Mar 25, 2020 11:15 pm

Hello good day,
The amount due for payment in dollar cost $4,500 which equates to €4,185 (depending on present exchange rates). Given that our company is in Europe, you will pay the amount due in Euros as stipulated in your invoice. So immediately you effect payment, send us a receipt of confirmation and we immediately proceed with the shipping process of your goods. Thank you

https:/ /

Sat Mar 28, 2020 7:44 pm

Hello good day.
We have waited for your feedback without any response from you. Our business email has a little fault which is in the process of correction. This is to confirm your order which has been kept pending for confirmation of delivery. Please get back to us with feedback as soon as possible. Thank you.



Return-Path: <>
Received: from ( [])
Sat, 28 Mar 2020
Subject: Awaiting Order confirmation

Sun Mar 29, 2020 4:03 pm

Thank you for your reply.
Your order had been kept on the waiting to be canceled after a week of non-compliance. To prepare for shipping please do the part payment of 30% ($4,500) (€4,050) to handle your shipping charges.
Send a confirmation of payment receipt after payment has been made so your order can be placed active as soon as possible. Thank you.


Mon Mar 30, 2020 9:18 pm

Hello good day, we are sorry for the inconveniences caused. Please bear with us as we will send you another account from one of our distribution centers within a moment to finalize your payment. Thank you

Hello due to the lockdowns in Germany and other places it affected some bank transactions. Below is our alternative bank account at one of our production centers in China. Please do the payment and communicate the confirmation receipt of payment to enable us begin shipping preparations immediately. Thank you.

Account Name: H. J.
Surname: H.
Name: n. j.
Account: Acc Number: 622827008125855XXXX
Bank: Agricultural Bank of China Guangdong Branch
Address: , Panyu City.


Hello greetings. I hope everything went on successfully since the other account had an issue. The management apologizes again for the inconveniences caused. Please keep us updated immediately you are done to prepare your order as it’s now on priority for delivery upon confirmation from your bank. Than you.

Post a reply