info@thongsaithasri.com

by **Big Al** » Wed Sep 16, 2020 11:32 pm

Dear Client,

We can supply KN-95 respirators .

Thanks

Header:

Delivered-To:
Received: by 2002:a25:741:0:0:0:0:0 with SMTP id 62csp228725ybh;
Tue, 15 Sep 2020 23:18:02 -0700 (PDT)
X-Google-Smtp-Source: ABdhPJzdh1z3C/Zi4O4grPB1AAyOG4lsQkXHMeF+TESRdCgSOeaREbzO0VczQ/8Haiv12vFJWpcz
X-Received: by 2002:a17:902:8d86:b029:d1:9237:6dfd with SMTP id v6-20020a1709028d86b02900d192376dfdmr22414527plo.22.1600237082190;
Tue, 15 Sep 2020 23:18:02 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1600237082; cv=none;
d=google.com; s=arc-20160816;
b=aIO12r8MX1hhRsiN3lD6LcxRhd4cPrq4U3nYUWCesZJJFUQoJ3xWTlmwV9Bw7j364P
w0U1cKM7Ra92i1RkSjOMnggVFqp3n7HvMTpM4YqFhpdth/MYqzoxkkx9qNfAnCSWMAfM
qtMqdHbEoe50LvtznOpDWHIXTZl1o+jSSnT3Fi2n6qq1/oyZRLUnFfLMnZRfw4hk+tpJ
CoSb0uOuDN/mcMqp+HF6NWdUdJFe7fMUllKMrDBY8d7NNMIOvWLdSu7fLtGW3uqc/FYF
lEBCzv9Dqj+SZQzzlBQzB7gUF9BCR3ELvYwni+J0JLgQiukqsA+RCWcZRCdWi0+GjHvD
ur9A==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=content-transfer-encoding:message-id:user-agent:references
:in-reply-to:subject:to:from:date:mime-version:dkim-signature;
bh=OJeg9nI6OczmjRoFYYBqxT0JySW64tXRQ16/5qDKsTw=;
b=GKawRpay7peGYXclAIufWfcQ6MuaRn2mmoQ5DSSuHHCCROI0HS0KkuQiviMWEq9uxB
zua5m3q3RE9/E79wSkfk3+mlPDsQ/VUXBJm7RgOidY1hhuE1EfHk5O+N/SajnIbQN5Mc
OwczUr7TsDDqvGWcq3BDW9hl1Cq/2mi9OU0oi7+Qt6q8i19UNf8BWoRONt/2ldDu2jgj
Bj7taI6VytBeF9HccTy0B5zSgkRxf1lnQj0NNZQodC3cQuMkhjKmczm6S6QkZk2J+ysq
5gIB3wIQ10Dsyn0FAvaCbtm6LoHJSK3OPP07o2EgL2Y8i80EI0RA7G6YDxtj+lPJm41K
ImFA==
ARC-Authentication-Results: i=1; mx.google.com;
dkim=temperror (no key for signature) header.i=@thongsaithasri.com header.s=x header.b="4/4x12Y3";
spf=neutral (google.com: 108.170.11.130 is neither permitted nor denied by best guess record for domain of info@thongsaithasri.com) smtp.mailfrom=info@thongsaithasri.com
Return-Path: <info@thongsaithasri.com>
Received: from gains.enterpriseappscloud.com ([108.170.11.130])
by mx.google.com with ESMTPS id y20si12474171plp.415.2020.09.15.23.18.01
for < >
(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);
Tue, 15 Sep 2020 23:18:01 -0700 (PDT)
Received-SPF: neutral (google.com: 108.170.11.130 is neither permitted nor denied by best guess record for domain of info@thongsaithasri.com) client-ip=108.170.11.130;
Authentication-Results: mx.google.com;
dkim=temperror (no key for signature) header.i=@thongsaithasri.com header.s=x header.b="4/4x12Y3";
spf=neutral (google.com: 108.170.11.130 is neither permitted nor denied by best guess record for domain of info@thongsaithasri.com) smtp.mailfrom=info@thongsaithasri.com
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=thongsaithasri.com; s=x; h=Content-Transfer-Encoding:Content-Type: Message-ID:References:In-Reply-To:Subject:To:From:Date:MIME-Version:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help: List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=OJeg9nI6OczmjRoFYYBqxT0JySW64tXRQ16/5qDKsTw=; b=4/4x12Y3hnuZ9MDhFy66IpaPMu DjdBmFgB16p8NsBzFChXIP0BiyM46nCI6mOxWv8+tFTVeUHD9aJipwK8GYhbNWoMue8TYmpJTC2Hi j61a3b7fXI/StnXWXNaS1bPJNMV9QlD0kZNZcax2QVVoRON5dyNleAFUZ6ZMvE+/fpS6me8ftkq4i oG5Z13gdjs+pvkVQ/4HkDNOyPeWGry1ZLt55lbdwWDnDorydBUORtvHM9AwfSNib2yeZMjJV0WiHe 35Gzc+lFTbOPy8aMAYc4LzhHuvZzWl6TYbBENKJ3rTTEMRO2KUw679OK+F78J/K/kV9IriuDwAt24 22iFUMeA==;
Received: from [127.0.0.1] (helo=gains.enterpriseappscloud.com) by gains.enterpriseappscloud.com with esmtpa (Exim 4.94) (envelope-from <info@thongsaithasri.com>) id 1kIQmA-0004Fc-Of for ; Wed, 16 Sep 2020 11:48:42 +0530
MIME-Version: 1.0
Date: Tue, 15 Sep 2020 23:18:42 -0700
From: info@thongsaithasri.com
To:
Subject: Re: KN-95 facemask order.
In-Reply-To: <CABwrbKpjUfQQp8Gmed-XJdR1wDeegewQsAByc79h62Q=9Mp_wA@mail.gmail.com>
References: <CABwrbKpjUfQQp8Gmed-XJdR1wDeegewQsAByc79h62Q=9Mp_wA@mail.gmail.com>
User-Agent: Roundcube Webmail/1.4.8
Message-ID: <2e0e126d944b7d096b1c63359e179681@thongsaithasri.com>
X-Sender: info@thongsaithasri.com
Content-Type: text/plain; charset=US-ASCII; format=flowed
Content-Transfer-Encoding: 7bit

Orig IP: 108.170.11.130 | Orig ISP: Ssasn2 | City: Phoenix | Country: United States

by **Big Al** » Thu Sep 17, 2020 9:15 pm

Dear
Thanks for your reply.

The price per piece is 1 us dollar including delivery to your address .

The total cost of your order XXXXXX of the KN-95 respirators is XXXXXX
usd dollars.

Payment Terms - 30% Prepayment against proforma Invoice and sales to
cover the below cost:

- Local transportation from warehouse to Loading Port.
- Paying of Inspection and Insurance charges.
- Packaging .
- Paying Sea freight charges.

Balance 70% against copy of shipping documents .

We are looking forward to proceed on your order inquiries for shipment
to your destination so we need your full address of delivery to provide
you Proforma invoice ass:

Buyers name:
Full address of delivery :
Contact number:

Best Regards
Director
Abdul Azim

by **Big Al** » Fri Sep 18, 2020 9:21 pm

Dear

Find attached to this mail the Mail the Proforma invoice.

Kindly proceed with payment and revert with the payment receipt for
confirmation so that we process your order and make your shipment.

Best Regards
Director
Abdul Azim
Telephone +66823194715
WHATSAPP NUMBER +66849742780

Shipper Information from the fake invoice:
Thongsai Thasri
6/52 Mark Keang Subdistrict, Udon Thani 41000, Thailand
Postal Code: Udon Thani 41000, Thailand
Tel: +66953139035 / +66849742780

Bank account info from the fake invoice:
Kasikorn Bank Plc.
Account Name: M. G. L. P.
Account Number: 071-3-45XXXX
Swift Code: KASITHBK
Address: rat burana road
Country Thailand

by **firefly** » Sat Sep 19, 2020 9:26 pm

The supplier claims to be a company named Thongsai Thasri and uses a fake website active from the fraudulent domain name thongsaithasri.com.

Review of the "company" posted on TrustPilot in February:

Fake website, this business isn't real, they are found on alibaba, and communicate only using Whatsapp, there mobile phone is off when you call it, the scammer doesn't speak thai, sounds Arabic to me, they will keep on saying send money into account and no Alibaba escrow, and if you dig a little deeper you will see it's a fake website with money back and 100% guarantee of delivery claims all over because they are trying to scam you

From the fake website:

Incorporated in the year 2017,THONGSAI THASRI is a Thailand based Exporter and Supplier of extensive gamut of products. We are associated with some of the prominent vendors and distributors in industry providing qualitative variety of products as per quantity specified. Furthermore, we have well-established distribution network allowing us to reach buyers in Europe, Latin America, South America, Asia, Africa and other markets of the world.

The "variety of products" goes from seeds, sugar, oil, hides, frozen chicken, dry stock fish to tractors and face masks:

Contact details:

Address: 6/52 Mark Keang Subdistrict, Udon Thani 41000, Thailand.
Whatsapp: +66849742780
Email: info@thongsaithasri.com
Business Reg Tracking link: http: //dbd-go-thdbdwebthaiib.com
Business Reg tracking Number :1428067489047

+66849742780
Number billable as mobile number
Country or destination Thailand
Original network provider* Advanced Info Service Public Company Ltd (AIS)

Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=145786.

From the domain name registration:

Domain Name: THONGSAITHASRI.COM
Updated Date: 2019-11-20
Creation Date: 2019-11-20
Registrar Registration Expiration Date: 2020-11-20
Registrar: DNC Holdings, Inc

Domain Status: addPeriod
Registry Registrant ID: REDACTED FOR PRIVACY
Registrant Name: REDACTED FOR PRIVACY
Registrant Organization: Thongsai Thasri
Registrant Street: REDACTED FOR PRIVACY
Registrant City: REDACTED FOR PRIVACY
Registrant State/Province: REDACTED FOR PRIVACY
Registrant Postal Code: REDACTED FOR PRIVACY
Registrant Country: TH

This is what the fake website looks like:

by **firefly** » Sat Sep 19, 2020 9:46 pm

Business Reg Tracking link: http: //dbd-go-thdbdwebthaiib.com
Business Reg tracking Number :1428067489047

According to the DBDDataWarehouse Thailand, there is no company named Thongsai Thasri legally registered anywhere in Thailand.

The fraudsters thought already about that and they created a fake regulator website where the fake company shows as being "very ok":

The fake regulator pretends to be The Department of Business Development Thailand and uses a fraudulent website active from the domain name dbd-go-thdbdwebthaiib.com.

There is a "Track" function on the fake website, where the victim can check the Business Reg tracking Number provided on the fake supplier website.

In the case of Thongsai Thasri Business Reg tracking Number :1428067489047 what can be seen is the image posted above.

Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=145778.

From the domain name registration:

Domain Name: dbd-go-thdbdwebthaiib.com
Updated Date: 2020-08-23
Creation Date: 2019-11-15
Registrar Registration Expiration Date: 2020-11-15
Registrar: NameSilo, LLC

Registry Registrant ID:
Registrant Name: Domain Administrator
Registrant Organization: See PrivacyGuardian.org

This is what the fake website looks like:

There is no website mentioned in that fake registration entry of the "company", because the fraudsters will use the same "trading name" with multiple fake sites pretending to be the same company and showing the exact same tracking number.

by **firefly** » Sat Sep 19, 2020 10:01 pm

There is Thong Saithasri Medical Face Mask, using a fraudulent website active from the domain name thongsaithasrifacemask.com.

The victims are targeted with ads posted on free classifieds:

Medical and surgical disposable 3ply Face Mask available .contact us via our WHATSAPP NUMBER +66849742780
Our Website: www. thongsaithasrifacemask.com
Antony
26th March 2020

From the fake website:

Thongsai Thasri is one of the leading disposable surgical masks manufacturers in Thailand and specializes in surgical mask designs and manufacturing. The disposable surgical masks offer protection from both airborne and body fluid contaminants application in a wide range of workplace, such as hospital, office, clinic, and more.
Our factory is a manufacturer specialized in various medical product, including medical injection products, surgical dressing, protective wear, diagnostic instruments, medical rubbers, medical catheters, lab Appliance, hospital supply etc .Besides, we also undertakes OEM products.
We have obtained ISO, CE, FDA and ROHS certificates and built a whole management system and quality control system to assure our customers of high quality products.

According to a Notice of Counterfeit Certificates published on April 27, 2020:

ISO 13485:2019 certificate number 438852 QM 08 issued to THONGSAI THASRI for the scope “Suppliers and distributor of Pharmaceutical Products (Medical and surgical disposable Face Mask) providing aftersale services worldwide and based in Thailand.” Note that ISO 9001:2015 certificate 438852 QM15 is a valid certificate issued to Lighthouse Worldwide Solutions Ltd.
(...)
DQS Inc. deems these certificates invalid and has no knowledge of the associated management systems.

Contact details:

Address: 6/52 Mark Keang Subdistrict, Udon Thani 41000, Thailand.
Whatsapp: +66849742780
Tel: +66600035983
Business Reg Tracking link: http// dbd-go-thdbdwebthaiib.com
Business Reg tracking Number :1428067489047

Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=145781.

From the domain name registration:

Domain Name: thongsaithasrifacemask.com
Updated Date: 2020-08-30
Creation Date: 2020-03-02
Registrar Registration Expiration Date: 2021-03-02
Registrar: NameSilo, LLC

Registry Registrant ID:
Registrant Name: Domain Administrator
Registrant Organization: See PrivacyGuardian.org

This is what the fake website looks like:

by **firefly** » Sat Sep 19, 2020 10:13 pm

Another Thongsai Thasri claims to be a paper supplier, using a fraudulent website active from the domain name thongsaithasripaper.com.

From the fake website:

THONGSAI THASRI , a fully integrated pulp and paper mill, was incorporated in 1992. Located in Thailand's central plains in the mill began operating in 1993 and has an annual capacity of 600,000 tons of pulp and 600,000 tons of paper. Strategically situated from Bangkok and Laem Chabang Seaport, the Thongshai Thasri is close to both a sustainable source of wood and a huge rainwater reservoir with a capacity of 36 million cubic meters to sustain its manufacture of pulp and paper.

Contact details:

Address: 6/52 Mark Keang Subdistrict, Udon Thani 41000, Thailand.
Whatsapp: +66849742780
Email: info@thongshaithasripaper.com
Business Reg Tracking link: http: // dbd-go-thdbdwebthaiib.com
Business Reg tracking Number :1428067489047

Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=145798.

From the domain name registration:

Domain Name: THONGSAITHASRIPAPER.COM
Updated Date: 2019-11-20
Creation Date: 2019-11-20
Registrar Registration Expiration Date: 2020-11-20
Registrar: DNC Holdings, Inc

Domain Status: addPeriod
Registry Registrant ID: REDACTED FOR PRIVACY
Registrant Name: REDACTED FOR PRIVACY
Registrant Organization: THONGSAI THASRI PAPER
Registrant Street: REDACTED FOR PRIVACY
Registrant City: REDACTED FOR PRIVACY
Registrant State/Province: REDACTED FOR PRIVACY
Registrant Postal Code: REDACTED FOR PRIVACY
Registrant Country: TH

This is what the fake website looks like:

by **firefly** » Sat Sep 19, 2020 10:22 pm

After masks and paper, now garlic, with yet another fake supplier pretending to be Thongsai Thasri Garlic Supply.

From the fake website:

Thongsai Thasri is a small, independently-owned grower and supplier of premium quality garlic (seed and culinary). We provide exceptional quality garlic to nurseries, market growers, home garden enthusiasts, chefs, and anyone else looking for better garlic.

Contact details:

Address: 6/52 Mark Keang Subdistrict, Udon Thani 41000, Thailand.
Whatsapp: +66849742780
Tel: +66600035983
Email: thongsaithasrigarlicsupply@gmail.com
Business Reg Tracking link: http: // dbd-go-thdbdwebthaiib.com
Business Reg tracking Number :1428067489047

Entry in the aa419 Database of fraudulent websites: https://db.aa419.org/fakebanksview.php?key=145776.

From the domain name registration:

Domain Name: THONGSAITHASRIGARLICSUPPLY.COM
Updated Date: 2020-04-19
Creation Date: 2020-02-18
Registrar Registration Expiration Date: 2021-02-18
Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com

Registry Registrant ID: Not Available From Registry
Registrant Name: Brandon Wilson
Registrant Street: 333 Silom Road, Bangruk Bangkok, 333, Silom Rd., Suriyawong, Ban gkok 10500 Thailand,
Registrant City: Bangkok
Registrant State/Province: Bangkok
Registrant Postal Code: 10500
Registrant Country: TH
Registrant Phone: +66.6696756667
Registrant Email: suminyasurichay101@gmail.com

This is what the fake website looks like: