Coronavirus spam selling the 'Pandemic Survival' ebook
How not to survive the coronavirus pandemic? I stumbled upon the following email in my spam folder the other day. The email is painting a picture of Wuhan, where the police – according to the sender – is knocking on doors and this violation could happen to my city as well.
The pitch was enticing enough to click on it to see what ‘my last chance’ was to survive the coronavirus pandemic and the dystopian police state.
So I took my OSINT toolkit and what I found was a network of websites pushing fear-mongering ebooks amidst the COVID-19 pandemic. I also found a webshop providing platform for products with questionable benefits and a successful business making a bank with affiliate marketing.
![The spam email advertising PandemicSecrets[.]org.](/assets/images/survivecoronavirus-spam.jpg)
The money page
The link from the spam above took me to a straightforward one-page site with a video player on top mimicking YouTube. The first half of the 20-odd minute video is an endless tirade about the government confiscating guns, using lethal force, turning the army against people and mandatory vaccinations when the coronavirus becomes widespread.
![The money page of PandemicSecrets[.]org.](/assets/images/pandemicsecrets-org-main.jpg)
The product the video is pushing is a $37 ebook with the title ‘Pandemic Survival’ featuring a collection of pandemic survival practices.
The narrator of the video, ‘Clayton Mathews’ – after claiming he is a well-known ‘pandemic expert’ – promises that the book features a collection of ‘government secrets’ that has been acquired by covert tactics.
Luckily I managed to get hold of a copy of Pandemic Survival from psurvival[.]org (more about this later). After skimming through the 74-page pamphlet, however, I only found trivial things like:
- proper handwashing techniques; and
- banal tips including ‘going for a pee’ to stay warm; and
- drink something warm when it is getting cold.
The order process
The enormous ‘Add to Cart’ button on the page is taking to an online retailer called ‘BuyGoods’ where an order can be placed for the book. The product is then delivered online via email with a download link pointing to psurvival[.]org inside.
Interestingly, even though the download page refers to itself as a members-only page, there is no authentication protecting the download links whatsoever. As a result, ‘Pandemic Survival’ and its related ebooks are available for everyone to download in a PDF format from the website.
Domain names
The Pandemic Survival money page has been hosted on numerous domain names until they got taken down either by the hosting provider or the owner.
I managed to identify the following domains associated with the ‘Pandemic Survival’ ebook:
- pandemicsecrets[.]com
- covid19reveal[.]com
- pandemicproof[.]com
- pandemic-survival[.]org
- survivecoronavirus[.]org
- pandemic-survive[.]org
- studythevirus[.]com
The webshop selling Pandemic Survival
The ebook is a digital download available through BuyGoods, which is one of the ‘largest digital information distributor’ selling products for ‘tens of millions of dollars’ according to Clayton Mathews from the video.
Mr Mathews claims that purchasing through BuyGoods is safe, as the shop has never had a single security breach because ‘BuyGoods is using SSL security’ to keep the website secure from hackers.
Public reputation and response
I was curious about what others think about BuyGoods and the products the marketplace is selling. Shockingly, a simple Google search reveals that the platform appears to have mixed reviews.
Per the San Diego Consumer Action Network, BuyGoods is an “off-shore haven for many of the scam artists” providing a platform for ‘infoscam’ products.
As for the product selection, a sample of the products include:
-
weight-loss programs promising up to 12 pounds (5 kg) loss per week; and-
-
a tinnitus treatment which is “not a product from conventional medicine, but a simple food supplement” (or a scam according to Contra Health Scam).
In contrast, each supplier and product at BuyGoods “goes through an extensive review process to ensure the products has demonstrated customer success“. The weight-loss system is backed by scientific studies and BuyGoods “always aim to provide a great experience” according to themselves.
Who is running BuyGoods?
That said, BuyGoods appears to be closely associated with a company named Yomali, which is “a global group of technology companies, developing software products & services, designed to help great companies Sell More Online”.
According to the website, Yomali offers a comprehensive range of services under different brands to those aspiring to sell online:
- a complete e-commerce platform (SoftwareProjects.com);
- traffic generation / affiliate marketing (MaxWeb);
- payments processing (GetPayment).
So where is the company located?
According to the Google Cache, Yomali is a registered business in Malta. Interestingly, the company address (GPL Building Level 2, Triq Il-Ghadam, Mriehel, BKR 3000, Malta) shows up in the Panama Papers.
According to Panama Papers, the identity of the owners is not clear as the ownership structure of Yomali Limited is obscured by a complex web of company trusts. For example, Lawrence Zahra is listed as the director, who is connected to 30+ businesses unrelated to Yomali.
The London address (483 Green Lanes, London, N13 4BS) featuring on the current iteration of the Yomali website belongs to a mailbox rental company called Prime Secreterial (i.e. not a real office). The registered director of Yomali Holdings Limited in the UK is Amir Idan, a software developer according to the company register.
Unfortunately, none of the public business registers did help me with clarifying who are the owners of BuyGoods or Yomali. So let’s have a look at the ‘Teams’ page on Yomali.com for some pointers, shall we?
The Yomali leadership team
The ‘Team’ page under ‘Who we are’ features Andrei Covaci as responsible for ‘online monetization’ and coincidently, he is the CEO of BuyGoods. In a 2019 interview, Mr Covaci said he helps his clients selling more online with “building funnels, setting up autoresponders and customizing checkout pages”. Mr Covaci is excited that the online marketing community is “cleaning up their act” as he found that the majority of the marketing tactics were “shady” before.
Another key person of Yomali (according to the Team page) appears to be Anna Gita (also known as Anca Andreica), the CEO of MaxWeb. Her company is a “is a leading affiliate network, that specializes in maximizing results for both affiliates and advertisers”.
In a recent piece on Entrepreneur.com, Ms Gita suggests that affiliates like her can make up to $50,000 per day with email, Google advertising, and on TikTok.
The connection between BuyGoods and MaxWeb is strong as - according to Ms Gita and Mr Covaci’s Facebook profiles - they both live in the same sleepy town in Romania called Baia Mare.
Another example of the strong ties is the Quantum Fat Burning weight-loss program sold on BuyGoods, as Quantum relies on the MaxWeb technology for click tracking.
Lastly, both BuyGoods and Yomali Group has the same registered address according to OpenCorporates, and both businesses were incorporated just two days apart. This may indicate that BuyGoods, Yomali and MaxWeb are all related.
Summary
Personally, I found the advertising practices of Pandemic Survival questionable as the ad came in through an unsolicited email message. The platform providing an online marketplace for Pandemic Survival appears to offer products of similar nature and seems to have an ambiguous business ownership structure.
In closure, MaxWeb is presumably driving traffic to BuyGoods with email campaigns, Google ads and Facebook ads. As mentioned on the Yomali website, both BuyGoods and MaxWeb are tied to the Yomali ecosystem along with other Yomali services like the GetPayment payment processor.
In conclusion, whoever is advertising Pandemic Survival knows what they are doing as they seem to rely on the comprehensive range of Yomali services spanning from advertising through payment processing to fulfilment.