sales@najatradingivs.com

by **Big Al** » Tue Apr 07, 2020 1:05 am

Hello
Thank you for email the total cost of 100,000 pieces is 60500 Euros.
The delivery time is 48 hours after confirmation of payment.
Please kindly review and confirm your order I will issue you a proforma invoice.
Our terms of payment 50% TT deposit against the proforma invoice which will be
used to process your order and 50% after you receive a copy of the airway bill
and tracking number.

Best regards.
Carl

Header:

Delivered-To:
Received: by 2002:ac8:72d7:0:0:0:0:0 with SMTP id o23csp3093772qtp;
Mon, 6 Apr 2020 13:41:50 -0700 (PDT)
X-Received: by 2002:adf:e3c5:: with SMTP id k5mr1093657wrm.216.1586205710039;
Mon, 06 Apr 2020 13:41:50 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1586205710; cv=none;
d=google.com; s=arc-20160816;
b=hVMJuqZHmza7G6klQwni3VF5TbE9BWHQ/QfREvM4CJvkx3kjJELnaEGWCkzJrB3FXZ
h3nhlNRMNnjG0GizAJ6FWD1C8+r4cfmHxHMZppaAlGjBnjczbAcHEfLLi68RRtulLXmj
NHWEW/OEPi55Y6PsPPF46UKcfjZKDd5op/bREcUDVYJ1eXL6/aTHIl43QlQvNMUHYs/o
x1BpOmeuUn8XOQEIHdQt7vKdAHRopZYPPbb1SCgol7pnLsirsdQqDgDzi+Y6WOVzUg9/
0o0WzGSHrMHCCTOt8BBhWlI3DrvyYFTvwY8futIVqFkbFAtMc6VJJsl94KFLVdYULcMx
dJqQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=to:subject:message-id:date:from:in-reply-to:references:mime-version
:dkim-signature;
bh=vLjwCZCIPvymR94u4MJlgQVzZwPLRgvgfTCxyWezyWo=;
b=WWK6GbbJYupaxGacDK+bIu8+qIHo+vGVKivf9Cm2W9bWELYyojP0AE27/ycnGTUW84
2/FX5lelGvnAC0r2S71/IviXij/mUGfElXRncgxYz5lwwxW0OGBbmRY9V8jkIrIu0RJ+
z+7Yzzjpy56TxwAgsrbGrxgIC1egb/rvmxtMbuo64UGutv9fI8Tu7Hj7eNA4OlJDEetE
Q00WK+RLbF8cg45TvKHDxO8M03qku6mNXI89gO1gyhCAkcQa0PBSnheHkz3Wdd68PYLd
bAXEodyRl/uYj/qp5eYSXJog89/R/nWx+XbHL0oh2wtO9dFoqcxQ+5sT+Muur7Q2SdYc
cWZA==
ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass header.i=@najatradingivs-com.20150623.gappssmtp.com header.s=20150623 header.b=IEqTL3V7;
spf=softfail (google.com: domain of transitioning sales@najatradingivs.com does not designate 209.85.220.41 as permitted sender) smtp.mailfrom=sales@najatradingivs.com
Return-Path: <sales@najatradingivs.com>
Received: from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41])
by mx.google.com with SMTPS id n63sor472806wmn.11.2020.04.06.13.41.49
for < >
(Google Transport Security);
Mon, 06 Apr 2020 13:41:49 -0700 (PDT)
Received-SPF: softfail (google.com: domain of transitioning sales@najatradingivs.com does not designate 209.85.220.41 as permitted sender) client-ip=209.85.220.41;
Authentication-Results: mx.google.com;
dkim=pass header.i=@najatradingivs-com.20150623.gappssmtp.com header.s=20150623 header.b=IEqTL3V7;
spf=softfail (google.com: domain of transitioning sales@najatradingivs.com does not designate 209.85.220.41 as permitted sender) smtp.mailfrom=sales@najatradingivs.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=najatradingivs-com.20150623.gappssmtp.com; s=20150623;
h=mime-version:references:in-reply-to:from:date:message-id:subject:to;
bh=vLjwCZCIPvymR94u4MJlgQVzZwPLRgvgfTCxyWezyWo=;
b=IEqTL3V7QvzYX5GVOmD++wRrNbpfrN31B2HJaZVuNv0P85vk3J+ZlVx1IJYWSkrFgj
j8gsoZHj585S/r0yrBEABFrQwNpaIChZc991QyCbArzbyyleZxnyZopmPkHM2WvkLczR
U3Uf811nZBAbN6djFrz/x6d4ftQpNULbvP0ImbWRExmMrNSqscN1UONpETF4wgckqTaX
8MbxxK47A7X+YywXkcgrcAgClyZnNKyyDcS1NKP+4zh553ssY1Q8lJTOQYH+njrPO7c/
1qhV9JdAJPpua8d0wm3rGI5tmXpaJQUsYBlYkdP1D+OURmI7GCaLmbbXaI3JB2zdwTcy
/G1w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20161025;
h=x-gm-message-state:mime-version:references:in-reply-to:from:date
:message-id:subject:to;
bh=vLjwCZCIPvymR94u4MJlgQVzZwPLRgvgfTCxyWezyWo=;
b=TUJHbE5StBcr4iVTBpkruh+Q9Ot6RTqqjFPTWrsdbbD8tJiZCckwWqQP34XHP+Qhs6
Eb0ct6o3J5Nlx8FbqPxvC/ZRyHDdtcuaakOx8885lLhDQXVnOTUDWyzQG/v4wKg46uOw
iLmNnrVBvcW/bRgC0nvdZeoA2vWaVzP3GrL+HjUcaG5z4G5ox08kq94BQ4/NaiACbLf+
Vt47W+fcy3EGjnYJCaR5gkxetgA1BPeCQWY3eXV99/N7lJcFR/mT0R89aOOvzCRZm+Vo
QyP7a4NcKTNZ7rqzqqOia1pZzVZ1rPqVpfn9xJnWRv5TKSNtShmIMZYHhf8ls6iAHMX8
pYRw==
X-Gm-Message-State: AGi0PualxNfd8dtV/4grI4WGcq5/OWeA3oFCLvjXaicgYafp6507Yu1o VygqojfVJ1p1GhXhZVESeox8hnV4ZqlGVQ3EBe50sG9S
X-Google-Smtp-Source: APiQypJUudHqqDoikFFtJhkBUvEfXjhPY+KdNFIgfcIY0LuOwgksr8IWJAnIV/eJ8E94oeOpOAMXv4o6mbMWRwHbvzg=
X-Received: by 2002:a7b:ce09:: with SMTP id m9mr1158067wmc.156.1586205708854; Mon, 06 Apr 2020 13:41:48 -0700 (PDT)
MIME-Version: 1.0
References: <CA+amEBJjddHvtpaZsi09OPpmOJ4zfdZ8H7u8gMGhmzCssovG3Q@mail.gmail.com>
In-Reply-To: <CA+amEBJjddHvtpaZsi09OPpmOJ4zfdZ8H7u8gMGhmzCssovG3Q@mail.gmail.com>
From: Naja Trading IVS <sales@najatradingivs.com>
Date: Mon, 6 Apr 2020
Message-ID: <CAGi9ukUrZ1GeexkeOARxjcV48u7x++mnNb6Bat=5FQn72Lvadg@mail.gmail.com>
Subject: Re: N95 Masks
To: >
Content-Type: multipart/alternative; boundary="000000000000d138ad05a2a54b1e"

--000000000000d138ad05a2a54b1e
Content-Type: text/plain; charset="UTF-8"

by **Big Al** » Tue Apr 07, 2020 11:27 pm

Hello
Thanks for your feedback the total cost in USD is 65509 USD.
In order for us to proceed please send your delivery address
so I can issue you a proforma invoice.

Best regards.
Carl.

by **Big Al** » Wed Apr 08, 2020 10:48 pm

Thanks for your feedback I will send you a proforma invoice.

Best regards.
Carl

by **Big Al** » Fri Apr 10, 2020 12:48 am

Hi
You are welcome please send your delivery address I will issue you the proforma invoice.
Our terms of payment 50% TT deposit against proforma invoice and 50% after you receive
a copy of the airway bill and the tracking number of your order.

Best regards
Carl

by **Big Al** » Fri Apr 10, 2020 10:15 pm

Hello dear
Thanks for your reply I will issue you an invoice today.

Best regards.
Carl

Hello
Attached to this mail is a copy of your proforma invoice kindly proceed with the payment
so we can start processing your order immediately.
When you make the payment please send a copy of the payment receipt so I can forward
it to the department in charge of your order.

Best regards.
Carl

Bank account details from the fake invoice:
Bank Name: ING Bank
Account holder: N. T. IVS
IBAN: PL84 1050 1025 1000 0097 2382 XXXX
BIC/ Swift Code: INGBPLW
Bank address: Warsaw, Poland

by **firefly** » Fri Apr 10, 2020 11:47 pm

The fake supplier pretends to be a company named Naja Trading IVS and uses a fraudulent website active from the domain name najatradingivs.com.

The fraudsters stole the name, registration details, location and even the CEO name from a real company legally registered in Denmark since 2017. The real company does wholesale of wood, timber and building materials and has noting to do with the selling of face masks online.

The scammers are targeting their victims on trading platforms:

Company details from the trading platform:

Company Basic Information
- Company Name Naja Trading IVS
- Location Ebeltoft
- Business Type Trading
Company
- Year Established 1999
- Employees Total 101 - 500
- Annual Revenue USD 50,000,001 - 100,000,000
- Website www. najatradingivs.com
- Selling CategoriesHealth & Medical > Protective Disposable Clothing
Personal Care > Bath Supplies
Textiles & Leather Products > Nonwoven Fabric
- Keyword N95 surgical face masks, Hand sanitizers, inferred thermometer
Membership Information
- Membership ClassTRADE PRO
- Membership Year 1 year
- Last Online2 days ago
- EC21 Registered Date Mar 29. 2020
- Authentication Unverified
- EC21 Registered IP 210.61.180.***

The IP shows Taiwan.

by **firefly** » Fri Apr 10, 2020 11:52 pm

From the fake website:

We are a certified organization, at our end this would mean a bigger commitment, a zero error business process interface, a much larger responsibility of delivering appropriate results thereby enhancing the performance standards of entire team at our end. This would all result in a better and a much evolved customer satisfaction thereby strengthening our bonds with the markets.

We are also one of the fastest growing FMCG company in Europe, supplying over 40 countries around the globe. Besides trading in top 500 worldwide brands, we provide agencies to our customers to develop products like Beverages, Drinks, Oak Beauty soap & Gate & 7. We aim to bridge gap between genuine producers and final consumers.

Their "Surgical products" offer includes face masks, non contact thermometers, hand sanitizers and shoe covers:

Contact details:

Mr. Carl Dyrnesli,
Address: Juulsbakke 6 B, 8400, Ebeltoft - Denmark
Company Registration No: 38376497
Company VAT No. DK38376497
Phone
+4531883318
Email
sales@najatradingivs.com

+4531883318
Number billable as mobile number
Country or destination Denmark
Original network provider* Lycamobile Denmark Ltd

Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=143170.

From the domain name registration:

Domain Name: najatradingivs.com
Updated Date: 2020-03-27
Creation Date: 2020-03-27
Registrar Registration Expiration Date: 2021-03-27
Registrar: WEBCC

Domain Status: ok
Registry Registrant ID: Not Available From Registry
Registrant Name: Domain Admin
Registrant Organization: Whoisprotection.cc

This is what the fake website looks like:

by **Big Al** » Sat Apr 11, 2020 7:19 pm

Hi
Thanks for your reply yes as soon as we confirm your payment
we will dispatch your order immediately.

Best regards.
Carl

by **Big Al** » Sat Apr 11, 2020 11:31 pm

Hello
Thanks for your reply here is another account please kindly
use this account to make the payment.

Bank account details:

Bank Name: Handels Banken
Account holder: A. T.
IBAN: SE38 6000 0000 0004 96XXXXXX
BIC/Swift Code: HANDSESS
Bank address: Lokgatan 8, 21120 Malmo

When you make the payment please send a copy of the payment receipt so I can
forward it to the department in charge of your order, so they can deliver your order
immediately to your home address.
The delivery time is 48 hours by air after confirmation of payment.

Best regards
Carl

by **Big Al** » Tue Apr 14, 2020 12:04 am

Hello
We are waiting for the payment confirmation today so we can start loading and packaging
your order immediately

Best regards.
Carl