customerservice@weeraphanburng-or.com

by **Big Al** » Mon Sep 07, 2020 4:15 pm

Hello sir , Accept greetings from our good firm .
we would supply you with XXXX of the 3M Full Facepiece Respirators

PRICE / PIECE : 0.15$USD / PIECE
PRICE FOR 4000: 600$USD .

To send the 4000 pieces would need your details as such as :

Full names
address
city
country
Tel

Once we get the details, we would issue proforma invoice and send you, then proceed with first shipment .
The shipment would take 3 days to arrive your address by air

we would be looking forward to reading from you .

Regards
Management Team

Header:

Delivered-To:
Received: by 2002:a6b:7d4c:0:0:0:0:0 with SMTP id d12csp3692994ioq;
Sun, 6 Sep 2020 23:47:33 -0700 (PDT)
X-Google-Smtp-Source: ABdhPJzD2bd2BdGWO6namE4mUp2ek4Y6w+2KQq01qcGY2FHYdKgJFY3nnD9wlvSTcCvYFX7X/GLn
X-Received: by 2002:a17:90b:2341:: with SMTP id ms1mr17979513pjb.80.1599461253459;
Sun, 06 Sep 2020 23:47:33 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1599461253; cv=none;
d=google.com; s=arc-20160816;
b=SZ9GkXBOJ227UvVDCD/Pkdql5EdAtBnPJR4/bQZ+qHRAHUwfKsNypnJK7L+AV+vNMu
vMudJ/yrgoIyk2hG1cZbmZII9tUNTprJZjxeOIMG/5qhrh6q7irr3hxSUjJf6VYmkC9i
9S8b/y8aOUV6LmvF7qoN4KYxqcCAkPXdv9H6XKLiCSa/Uoqp6ve7lZHvpkycWzrKUjyT
L52+7GhgamGRgeK5cR1BvJljtSYeTXV2MyW3cxSpAIinFGLx9zUNb3QTbgUYI3AOUsXU
be0/3r0SrTTUWpq1wYI41SRnn0xyYvz3es7fgFKgiSciiSp1xf2LuARYkgYB24H81GxN
qGPQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=message-id:user-agent:references:in-reply-to:subject:to:from:date
:mime-version:dkim-signature;
bh=iNDnlVzXyXxoKDEFtDtYTlLHxv0XZRLofzXnMi9vV+I=;
b=BiQWju5P45YRtytRxO4NRLQcbcZxOkBszJAkHQxJDa9K9LvF3bwjhBIKWYbK+5/vmM
pvHaLZ1PXuKE5hDXOW4SM61JpI+5PzvkIGm/xFWKbbOcbMMLzxgmR+sxqIhWd/v9pEIM
iMzJnvlM9YCWS6Z/RMmNEXswjRf9Jub8a4Eeyga1aKYQ3d03gZJGRoz5Abv1K5akNCZR
42IcUOd3oiLXr5x9Q7Aq39iL5veXd84LXKogwD+0n55OcVzRrRlXehawrnaiVMMzxYV4
Dx8lJfXxw8tWfh/Sjvi9nuorS4CT25rvYpTF4ppLwsUozJIlXSevIz9QBypBEzwnUMl9
do2w==
ARC-Authentication-Results: i=1; mx.google.com;
dkim=temperror (no key for signature) header.i=@weeraphanburng-or.com header.s=x header.b=Wd+iUCOY;
spf=softfail (google.com: domain of transitioning customerservice@weeraphanburng-or.com does not designate 198.15.109.90 as permitted sender) smtp.mailfrom=customerservice@weeraphanburng-or.com
Return-Path: <customerservice@weeraphanburng-or.com>
Received: from gains.enterpriseappscloud.com ([198.15.109.90])
by mx.google.com with ESMTPS id 70si13246320pla.12.2020.09.06.23.47.31
for < >
(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
Sun, 06 Sep 2020 23:47:32 -0700 (PDT)
Received-SPF: softfail (google.com: domain of transitioning customerservice@weeraphanburng-or.com does not designate 198.15.109.90 as permitted sender) client-ip=198.15.109.90;
Authentication-Results: mx.google.com;
dkim=temperror (no key for signature) header.i=@weeraphanburng-or.com header.s=x header.b=Wd+iUCOY;
spf=softfail (google.com: domain of transitioning customerservice@weeraphanburng-or.com does not designate 198.15.109.90 as permitted sender) smtp.mailfrom=customerservice@weeraphanburng-or.com
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=weeraphanburng-or.com; s=x; h=Content-Type:Message-ID:References: In-Reply-To:Subject:To:From:Date:MIME-Version:Sender:Reply-To:Cc: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive;
bh=iNDnlVzXyXxoKDEFtDtYTlLHxv0XZRLofzXnMi9vV+I=; b=Wd+iUCOYmUe5VHdvtV6r88EA6 Br7VEAj6+M7judVKVdl5uzfW+73F8gsmGky6AmSUYZpJ4SbAM/fJJeYxuwBiPPreOrNhI3FJ8jIs5 OVymP1RWcMznNBd9rrqOi/I/xRSHiMjlDbJWyc5UDkCOZCwO/ezEnfKdcnGO+EzQqQEWlJcF2qJpI 0mZb+MHt0j9KSF6JHgs+Bt/jWGdYUpbz3e4kshXVQnDLYJYhH5IGaphS7dFLg8+o5jnnOfsY/3Mlq xffZ3iTZU/niSYbCUki28aeYAqfghHpP8EKFZSxcKC48QbBSu3fdfgyu5OKMCYbFwugDwo6DRwFlY 3rYsazcXQ==;
Received: from [127.0.0.1] (helo=gains.enterpriseappscloud.com) by gains.enterpriseappscloud.com with esmtpa (Exim 4.94) (envelope-from <customerservice@weeraphanburng-or.com>) id 1kFAnh-0004rV-Gd for ; Mon, 07 Sep 2020 12:08:49 +0530
MIME-Version: 1.0
Date: Mon, 07 Sep 2020
From: customerservice@weeraphanburng-or.com
To:
Subject: Re: 3M Ultimate FX Full Facepiece Reusable
In-Reply-To: <CAG7vLpxC7_zCG6gMz_Te_rsBr2=YGfnCz2EqfW2S7tq1fXhwBA@mail.gmail.com>
References: <CAG7vLpxC7_zCG6gMz_Te_rsBr2=YGfnCz2EqfW2S7tq1fXhwBA@mail.gmail.com>
User-Agent: Roundcube Webmail/1.4.8
Message-ID: <dd08c0f2b69371b51eba7a37169b41a9@weeraphanburng-or.com>
X-Sender: customerservice@weeraphanburng-or.com
Content-Type: multipart/alternative; boundary="=_092980a2684fe8f39d26dbe027b57c8a"
X-Antivirus-Scanner: Clean mail though you should still use an Antivirus
X-Authenticated-Id: customerservice@weeraphanburng-or.com

--=_092980a2684fe8f39d26dbe027b57c8a
Content-Transfer-Encoding: 7bit

Orig IP: 198.15.109.90 | Orig ISP: Ssasn2 | City: Phoenix | Country: United States

by **Big Al** » Tue Sep 08, 2020 9:17 pm

Hello. Accept greetings from our good firm . sorry for the misunderstanding , we didn't know you needed 3M FF-402 Ultimate FX Full Facepiece Reusable Respirator with Cool Flow Valve

Price per pirce of FX FF-400 respirators : 80$USD / Piece

Price for XXXX Pieces : XXXXXX$USD

We would ship by air, it would take 3-6 days to arrive your address Destination in the .

TO ship to your address, we would need your company details such as :

names
City
Tel

Once we get the above we would issue proforma invoice and send you, the confirm .

Looking forward in reading from you .

Regards

Management Team

by **Big Al** » Thu Sep 10, 2020 1:09 am

Hello. Accept greetings from our good firm .

we receive your details , we are working on your Bill of invoice , once ready today we would send you today then confirm deposit and then process and dispatch your order .

Regards

Management Team

Hello. Accept greetings from our good firm . See copy of proforma Invoice.

You would have to make a deposit of XXXXX$USD as per the invoice and instruction from our Finance department, so that we can start filling of your order at the Ministry of Public Health, then confirm within 1-2 days and then notify you, start processing and dispatch your order immidiately .

Regards

Management Team

Fake Exporter info:
Weeraphan Burng-or
SOI 3/45 Mueang Lad Phrao Bankkok 10140 Thailand
TEL: +66840723894
FAX: +6612654198
WWW: Weeraphan Burng-or.com
E-mail: customerservice@weeraphanburng-or.com

Bank account from the fake invoice:
Bank Name: Siam Commercial Bank PCL. THE
SWIFT Code: SICOTHBK
Account Name: W. B.
Account Number: 324439XXXX
Address: Chatuchak Bangkok 10900
Country: Thailand

by **firefly** » Thu Sep 10, 2020 4:02 pm

The supplier claims is a fake company named Weeraphan Burng -OR and uses a fraudulent website active from the domain name weeraphanburng-or.com.

From the fake site:

LEADER IN PERSONAL PROTECTIVE
Since 1996, we supply corporate individual clients, supporting world's critical organizations directives at most critical moments.

Weeraphan Burng -OR , Which was established in 2009 and specialized in nonwoven and plastic disposable product. 9 years experience sales service, production , quality control, stable supply and professional work team. our sales teams provide our service and high quality product to world market. our main business is Europe, America, Russia and middle east. In Weeraphan Burng -OR protective, We committed to supply a good production environment, then produce best quality product with lowest price. We hope in Weeraphan Burng -OR we will help our staff dream come true

Contact details:

Address: SOI 3/45 MUEANG LAD PHRAO
City: Bangkok 10140
Whatsapp: +66840723894
Email: customerservice@weeraphanburng-or.com

Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=145785.

From the domain name registration:

Domain Name: WEERAPHANBURNG-OR.COM
Updated Date: 2020-03-12
Created Date: 2020-03-12
Registrar Registration Expiration Date: 2021-03-12
Registrar: Porkbun LLC

Registry Registrant ID:
Registrant Name: Whois Privacy

This is what the fake website looks like:

by **firefly** » Thu Sep 10, 2020 4:12 pm

Same location, another fake supplier: Sophittarung Jaroenchai, using a fake website active from the domain name pannarongkaokongpaper.com.

From the fake website:

SOPHITTARUNG JAROENCHAI is a company specialized in manufacturing and exporter of Fertilizers and Inorganic Chemicals
Our products include Sodium Nitrate, Sodium Nitrite, Barium Nitrate, Barium Chloride, Barium Hydroxide, Potassium Nitrate and Strontium Nitrate etc. We also have close partnerships with other plants in China in order to provide our customers with the ONE-STOP service for their purchase demand of materials.
Established in the year of 2001 by a team of chemical experts, now it has more than 500 employees, among whom 80 are technicians.

Our company established in 1996 at Uthai Thani Thailand. We are focusing on the innovation and developments of advance materials and owns numbers of the US and Chinese patents.
We owns patented technologies in the fields of Liquid crystal Materials, Dyed Liquid crystal mixtures, Anti-glare Automotive mirrors, Semi-conductive Epoxies, “Smart” Windows, Electronic Window Films, Advance coating materials, Specialty electronic chemicals, Patented Chelating resins etc.

Contact details:

SOPHITTARUNG JAROENCHAI
Address: SOI 3/45 MUEANG LAD PHRAO
City: Bangkok 10140
Whatsapp: +66840723894

Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=145782.

From the domain name registration:

Domain Name: pannarongkaokongpaper.com
Updated Date: 2020-08-23
Creation Date: 2019-11-15
Registrar Registration Expiration Date: 2020-11-15
Registrar: NameSilo, LLC

Registry Registrant ID:
Registrant Name: Domain Administrator
Registrant Organization: See PrivacyGuardian.org

This is what the fake website looks like:

by **firefly** » Thu Sep 10, 2020 4:23 pm

Rinse an repeat with Sophita Rungjaroenchai - sophittapapers.com.

Created in 1981, Sophita Rungjaroenchai has established it self as one of the most trusted Paper producer and suppliers in Thailand with market all over the world. As the demand for our products keep rising the cost of production keeps falling there by causing sustainable reduction in our paper cost.

Contact details:

SOI 24,1 TAMBON MUEANG UDON THANI DISTRICT
UDON THANI
41000
THAILAND
customerservice@sophittapapers.com
+66840723894

Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=145783.

From the domain name registration:

Domain name: sophittapapers.com
Updated Date: 2020-02-08
Creation Date: 2020-02-08
Registrar Registration Expiration Date: 2021-02-08
Registrar: NAMECHEAP INC
Reseller: NAMECHEAP INC

Registry Registrant ID:
Registrant Name: WhoisGuard Protected
Registrant Organization: WhoisGuard, Inc.

This is what the fake website looks like:

by **firefly** » Thu Sep 10, 2020 4:31 pm

And again Sophitta Rungjaroenchai, using yet another fraudulent website active from the domain name sophittarungjaroenchai.com.

STANDARD GRANULATED FERTILIZERS AND INORGANIC CHEMICALS SUPPLIER
SOPHITTA RUNGJAROENCHAI is a company specialized in manufacturing and exporter of Fertilizers and Inorganic Chemicals
Our products include Sodium Nitrate, Sodium Nitrite, Barium Nitrate, Barium Chloride, Barium Hydroxide, Potassium Nitrate and Strontium Nitrate etc. We also have close partnerships with other plants in China in order to provide our customers with the ONE-STOP service for their purchase demand of materials.
Established in the year of 2001 by a team of chemical experts, now it has more than 500 employees, among whom 80 are technicians.

Our company established in 1996 at Uthai Thani Thailand. We are focusing on the innovation and developments of advance materials and owns numbers of the US and Chinese patents.
We owns patented technologies in the fields of Liquid crystal Materials, Dyed Liquid crystal mixtures, Anti-glare Automotive mirrors, Semi-conductive Epoxies, “Smart” Windows, Electronic Window Films, Advance coating materials, Specialty electronic chemicals, Patented Chelating resins etc.

Contact details:

Address: SOI 3/45 MUEANG LAD PHRAO
City: Bangkok 10140
Whatsapp: +66840723894
Email:customerservice@sophittarungjaroenchai.com

Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=145784.

From the domain name registration:

Domain Name: SOPHITTARUNGJAROENCHAI.COM
Updated Date: 2020-03-23
Created Date: 2020-03-23
Registrar Registration Expiration Date: 2021-03-23
Registrar: Porkbun LLC

Registry Registrant ID:
Registrant Name: Whois Privacy

This is what the fake website looks like:

by **Big Al** » Thu Sep 10, 2020 11:15 pm

Hello , Accept greetings from our good firm .

Noted and we look forward confirm from you and for a longterm Business between us .

Regards
Management Team

Greetings from our good firm. We would like to get update from you .

Regards
Management Team

by **Big Al** » Fri Sep 11, 2020 11:17 pm

Hello . Accept greetings from our good firm .

We understand, Might be its a problem with your bank. We would be looking forward in confirming from you today as instructed by your Bank that you should try again today or try a different account .

We also accept cryptocurrency payments with BTC, Just in case you would want to make the payment through that, as it is faster and instant .

Looking forward in reading from you while hoping for a long-term Business .

Regards
Management Team

by **Big Al** » Sat Sep 12, 2020 8:55 pm

Hello .

Accept greetings from our good firm . We do not see any reason why your bank could not effectuate the transfer because we do not have any problem with our company bank account . It’s valid and active as we have been receiving transfers in the account. That means there should be a problem from your end .

We do not have any problem with receiving payment via bitcoin and have never had any problems with our BTC transfers . we have received transfers via our Bitcoins wallet . We just received a bitcoin transfer Of 652,000$USD via bitcoin from one of our clients in Canada on Friday and the order is already in process to be shipped to Ontario.

We would advice you use Bitcoin as that would be easier for both of us .

looking forward in reading from you .

regards
management team