Site logo


Switch to full style
Post up any 419 emails you received. All persons/companies depicted in these emails are either fictitious or have had their identities copied/stolen by the scammers.
Post a reply

Tue Mar 24, 2020 12:01 am

Corona Mask Non-delivery scam:

Dear friend,

We can provide:

Medical face mask: $0.29/pcs. with CE,FDA

MOQ:100k (Arrange delivery in 3 days)

KN95 mask: $0.98/pcs. with CE.

MOQ:100k (Arrange delivery around 3 days)

Thanks & Regards,

Received: by 2002:a05:651c:200f:0:0:0:0 with SMTP id s15csp3972007ljo;
Mon, 23 Mar 2020 04:30:35 -0700 (PDT)
X-Google-Smtp-Source: ADFU+vvI45xpayYa/Qn4zDlbVACoRfSuZfr0xwDtgoecywb5yg1ld6fcFz2guhUuf9jiEO/B7sRB
X-Received: by 2002:aa7:87ca:: with SMTP id i10mr23926698pfo.169.1584963035559;
Mon, 23 Mar 2020 04:30:35 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1584963035; cv=none;; s=arc-20160816;
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed;; s=arc-20160816;
ARC-Authentication-Results: i=1;;
spf=pass ( domain of designates as permitted sender)
Return-Path: <>
Received: from ( [])
by with ESMTPS id h11si9608718pgg.161.2020.
for < >
(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Mon, 23 Mar 2020 04:30:34 -0700 (PDT)
Received-SPF: pass ( domain of designates as permitted sender) client-ip=;
spf=pass ( domain of designates as permitted sender)
X-Sender-Id: n3qhlh5e81|x-authuser|
Received: from (localhost []) by (Postfix) with ESMTP id F0F7C1202BB for < >; Mon, 23 Mar 2020 11:30:32 +0000 (UTC)
Received: from (100-96-54-12.trex.outbound.svc.cluster.local []) (Authenticated sender: n3qhlh5e81) by (Postfix) with ESMTPA id 40AB31211D8 for < >; Mon, 23 Mar 2020 11:30:31 +0000 (UTC)
X-Sender-Id: n3qhlh5e81|x-authuser|
Received: from ( []) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384) by (trex/5.18.5); Mon, 23 Mar 2020 11:30:32 +0000
X-MC-Relay: Neutral
X-MailChannels-SenderId: n3qhlh5e81|x-authuser|
X-MailChannels-Auth-Id: n3qhlh5e81
X-Trouble-Callous: 66bdd37f746f43f7_1584963032453_1450406697
X-MC-Loop-Signature: 1584963032453:2722656544
X-MC-Ingress-Time: 1584963032453
Received: from [::1] (port=42504 by with esmtpsa
(TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.93) (envelope-from <>) id 1jGLHm-0008W1-En for ; Mon, 23 Mar 2020 13:30:26 +0200
Received: from [] ([]) by (Horde Framework) with HTTP; Mon, 23 Mar 2020 13:30:26 +0200
Date: Mon, 23 Mar 2020
Message-ID: <>
Subject: Re: N95 Masks
In-Reply-To: <>
User-Agent: Horde Application Framework 5
Content-Type: text/plain; charset=utf-8; format=flowed; DelSp=Yes
MIME-Version: 1.0
Content-Disposition: inline
Content-Transfer-Encoding: 8bit

Originating IP:
Originating ISP: Orange
City: Maroua
Country of Origin: Cameroon

Wed Mar 25, 2020 10:39 pm

Dear sir,
Thanks for the reply and information,
We will prepare contract so that you can.sign and send us copy . Our payment terms is as below: 50% TT deposit against contract and Proforma invoice 50% after reception of goods and inspection at delivery address.
So kindly get back to us with your full information so.that we can proceed

Thanks & Regards,
Buy protection Masks Ltd Co.
Tel:1 240 389 2331

Number billable as geographic number
Country or destination United States
City or exchange location Ashton, MD
Original network provider* Atx Telecommunications Services, Ltd


Fri Mar 27, 2020 12:25 am

Dear sir,
Attached is the invoice
Kindly confirm the reception and let us know if you.need extra information.
Thank you,

Fake invoice has incomplete bank details.

Sat Mar 28, 2020 6:36 pm

Dear sir ,
This are correct bank information :

Beneficiary Name:Buy protective mask ltd(P. YVES)
Account Number or
IBAN:DE63 1001 1001 2627 XXXXXX
Bank Nama: N26
Bank adress:Klosterstraße 62, 10179 Berlin, Allemagne

We are expecting your prompt revert

Protective Face Mask -

Sun Mar 29, 2020 7:19 am

The fraudsters pretend to be a supplier using a fraudulent website active from the domain name

They are not quite sure about their own name: Protective Face Mask, Ralf Wick Face Mask, JB Medical Disposables and TK Medical are all used on the fake website:

Ralf wick face mask is engaged into the manufacturing and exports of various Surgical Disposables, Hospital / Pharma Disposable Wear products made of Non-Woven Articles and Cosmetic products. Our extensive range of products includes all kinds of disposable face mask. We have every reason to be very satisfied with the results that have been achieved. Our strategic advice, coupled with prudent risk management, has helped them to perform to their revenue budget and beyond.
Our aim is to deliver Superior quality products and excellent services to our valued Customers maintaining highest standards of finesse and accuracy.

Our mission could be wrapped up in three words Quality, Comfort and Economy. Therefore, you can call up on JB Medical Disposables for Quality, Comfort and Economy in protective healthcare industry.

We are also committed to supply custom-made (specialized) products, where we feel machine-made products wouldn’t satisfy our customers. As the technological advance continues to improve in the healthcare industry, TK Medical also committed to continually upgrade, modify, design and products that are hygiene, fiber glass-free and up to clean room products as part of ISO 14001, we are also committed to use products that are safe, comfortable for health professionals and also safe to the environment.

Contact details:

+380 94 712 9876

Number billable as mobile number
Country or destination Ukraine
Original network provider* Intertelecom LLC (CDMA800)

Entry in the aa419 Databae of fraudulent websites:

From the domain name registration:

Domain name:
Updated Date: 2020-03-07
Creation Date: 2020-03-07
Registrar Registration Expiration Date: 2021-03-07

Registry Registrant ID:
Registrant Name: WhoisGuard Protected
Registrant Organization: WhoisGuard, Inc.

This is what the fake website looks like:


Sun Mar 29, 2020 3:33 pm

Dear sir ,
Use this Bank information

Bank Name: Afriland first bank
Account Number : 0518777XXXXXX
Bank address: D. B.
Swift code: CCEICMCX
Beneficiary : P. O. S.
IBAN: 10005 00002 0518777XXXXXX

Wed Apr 01, 2020 10:25 pm


How are you today ,hope everything is okay . We are expecting your prompt revert so that we can look forward.
Asap the payment is confirmed, we are going proceed immediately and we will send you tracking number immediately it is available.

Post a reply