Dark web sells COVID-19 masks at 10 times actual cost amidst severe shortage

Amidst the Coronavirus scare, this dark web site exploits people’s fears, to make a quick buck sells COVID-19 masks at 10 times actual cost.
Updated on
April 19, 2023
Published on
March 20, 2020
Subscribe to the latest industry news, threats and resources.
CloudSEK’s digital risk monitoring platform XVigil has spotted a dark web site that claims to sell N95 and Aura 3M medical masks, “to protect you against the Corona virus.” The site owners allege that they are wholesalers, and official suppliers for hospitals. They also emphasize that the masks are original and brand-new, and aren’t stolen goods. It is notable that the actors are using a vanity domain name: coronaygwcbcgpd6.onion that includes the keyword “Corona.”
Dark web site selling masks at 10 times actual cost
Dark web site selling masks at 10 times actual cost

The masks cost 10 times their actual price

On further investigation, we found that the masks are supposedly supplied by FarStar Medicals, a Germany based medical products manufacturer. However, the company doesn’t sell N95 respirators (only surgical masks), as per their official website.
The alleged stock for sale
The alleged stock for sale
  The site directs buyers to place orders by sending an email to: [email protected]. The masks, which come in packs of 10, cost EUR 89 ($96) for Farstar N95, and EUR 79 ($85) for Aura 3M. This is in contrast to the actual price, of a box of 20 3M N95 respirators, which is ~$17. The payment is accepted at 2 Bitcoin addresses (backed by BitPay):
  • 3FLQ4fHtXXn2cumA5NLKNUP7tMNCewB2Jv
  • 3AkqRhBwqS4yuT5YxWPBoEEGECtfs758gr
So far, the Bitcoin addresses haven’t received any payments.

Piggybacking on people’s fears

Over the last few weeks, we have seen a variety of COVID-19 themed malware campaigns and phishing attacks making the rounds. Most of those cases have involved phishing emails, with attachments that purport to contain important information about the virus. However, this scam directly exploits the high demand for medical quality respirators among the general public. Despite reassurance from the World Health Organization (WHO), that masks are only necessary for the sick, and those taking care of the sick, people continue to line up at pharmacies, and hoard masks. This, combined with the severe shortage of respirators for medical professionals, requires manufacturers to ramp up production by 40%. Amidst the growing crisis, sites such as these aim to piggyback on people’s fears and anxieties, to make a quick buck.

Get Global Threat Intelligence on Real Time

Protect your business from cyber threats with real-time global threat intelligence data.. 30-day free and No Commitment Trial.
Schedule a Demo
Real time Threat Intelligence Data
More information and context about Underground Chatter
On-Demand Research Services
Dashboard mockup
Global Threat Intelligence Feed

Protect and proceed with Actionable Intelligence

The Global Cyber Threat Intelligence Feed is an innovative platform that gathers information from various sources to help businesses and organizations stay ahead of potential cyber-attacks. This feed provides real-time updates on cyber threats, including malware, phishing scams, and other forms of cybercrime.
Trusted by 400+ Top organisations