Ray Shell visited a grocery store in North Carolina in early April and noticed nearly every customer was wearing a mask. He decided it was time to get one.
Shell, an acclaimed stage actor who played Rusty the steam engine in the original production of Andrew Lloyd Webber’s Starlight Express, knew masks were in short supply because of the coronavirus pandemic. But he’d recently received an email from an unfamiliar address advertising one called SafeMask. Shell was cautious — it was spam, after all — but his anxiety won out.
“The picture of [the mask] looked as if it was nice and sturdy and I could use it more than once,” he told BuzzFeed News. “So that's why I went for it.”
Shell paid the exorbitant price of $39.99 for two SafeMasks (comparable respirators normally sell for $0.75 online) and felt better — until days went by and they never arrived. He thought he’d been scammed. He called a number for customer support listed on his invoice, and the person who answered told a different story.
“He said there's been such a demand for these masks, as you can imagine, that they are like a month behind. He said, ‘You probably won't get yours for another month,’” Shell said. “I made a very, very crude joke: ‘I hope I'm alive by then.'”
Over the past two months, governments and hospitals have struggled to purchase enough personal protective equipment. As people realized the deadly threat posed by the coronavirus, they too began searching for masks.
Into that climate of fear and uncertainty came SafeMask, an overpriced, initially unauthorized, and misleadingly marketed mask that may be the most promoted piece of safety equipment on the internet. It’s earned potentially millions of dollars thanks to the oldest online sales channel: email.
SafeMask is sold by Ricardo Jorge Pereira de Sousa Coelho, a Portuguese millionaire with a collection of supercars and companies and residences in Malta, the Seychelles, Hong Kong, the United Arab Emirates, and Estonia. In an interview with BuzzFeed News, he denied misleading people and said he just sold the mask.
Nevertheless, beginning in February, at least 1 billion emails were sent promoting SafeMask, according to an investigation by BuzzFeed News and the Institute for Data, Democracy & Politics at George Washington University. Many of these emails targeted American conservatives and were sent to mailing lists owned by a trio of real estate flippers who operate websites like RepublicanPost.net, RightOnNews.com, and LeapFrogAmerica.com.
SafeMask customers said they were led to believe the mask was reusable, which it is not. SafeMask payment sites displayed an image labeled as an N95 respirator even though buyers were shipped something else. SafeMask emails also promoted European-made FFP2 respirators before they were approved for sale in the United States.
After this story was published, a new claim about SafeMask emerged. A file that de Sousa provided to BuzzFeed News as proof his masks were certified for the European market appeared to have been forged, according to Apave, the French testing company named on the document.
“We compared this certificate with our internal records and we found a number of discrepancies which lead us to believe that this certificate has not been issued by our services and that it is most likely a falsified document,” Tatiana Martin, a commercial assistant in Apave’s testing and certification center, told BuzzFeed News.
Through his lawyer, de Sousa did not return a request for comment.
As fear grew and the death toll mounted, so did the intensity of SafeMask's marketing. In March, Facebook, Google, Amazon, and other platforms banned mask ads, and authorities in the US, Canada, and elsewhere enacted zero tolerance policies for price gouging and false claims. Meanwhile, misleading SafeMask emails were blasted by the millions. SafeMask ads were sent to email lists on survivalist blogs, tactical equipment stores, and Horoscope.com. They were promoted on partisan news sites and posted as a press release on MarketWatch.com and on a Brazilian Facebook page with close to 1 million followers. Other SafeMask emails were more indiscriminate, and found their way into the inboxes of people like Shell. Bulk emailers began using the .icu domain, evoking “intensive care unit” and creating the impression that the masks were from medical facilities. (The .icu suffix, approved in 2018, stands for "I see you.")
Neil Schwartzman, executive director of the Coalition Against Unsolicited Commercial Email, told BuzzFeed News coronavirus mask spam is among the most malicious spam he’s ever seen. “Everybody is terrified at this point, and if I offer a miracle cure it’s more likely to be accepted now than ever before. People are leveraging that fear and profiting from it.”
Last summer, de Sousa’s Maltese company, MDE Commerce, promoted a robotic vacuum backed by a slick Facebook marketing campaign. Its video ads said it was developed by two vacuum engineers who worked for a big manufacturer before quitting to create their own more affordable version.
Rachel Downhour paid $80 for a vacuum at MegaDeals.ltd and was shocked at what showed up in her mailbox a few weeks later. “In the advertisement it looks like it’s going to be a full-size, 14-inch vacuum, and you receive it and it’s in this little tiny envelope that fits in your mail slot,” the Montana resident told BuzzFeed News. She said the vacuum never worked.
Unhappy MegaDeals customers gathered on PayPal’s support forum, while dozens more vented their frustration on ReportScam.com. Downhour channeled her frustration into a Facebook group called Scammed by Megadeals that now has more than 800 members. Customers claimed they were given fake tracking numbers for their orders or were told by MegaDeals customer service they could receive a refund if they sent the product back at their own expense, but were given nonexistent addresses in Estonia, Slovakia, Malta, or China.
De Sousa still sells vacuum cleaners, along with drones, neck massagers, and a product that “empowers your dogs to brush daily.” But his most recent hit is SafeMask.
De Sousa, 31, runs his operation from Tallinn, Estonia, where he owns a warehouse and office space. Along with MDE Commerce, he’s the sole owner of at least two active Estonian companies, one of which, DB2 Management OÜ, generated close to $30 million in revenue and $5 million in profit in 2018, according to business records. MDE Commerce earned a profit of over $1 million on revenue of $4.3 million the same year. He also owns a confusing thatch of companies incorporated in the Seychelles and Switzerland. De Sousa’s luxury vehicles include a McLaren supercar and a Ferrari with the license plate 404 LOL.
De Sousa said he’s been involved in affiliate marketing since 2008 and told BuzzFeed News that SafeMask spam was the work of rogue affiliate marketers working independently of his company.
“If you find anyone that is unauthorizedly advertising on spam or showing anything that you believe to be wrong, then I am more than happy if you provide this to me, because this is not something that we accept or are happy to see on our end,” he said.
Affiliate marketing is a commission-based sales model known for using aggressive and deceptive tactics to sell products and services. SafeMask pays a commission running from $23 to $28 per sale to anyone responsible for bringing customers to its websites. This attracts gun-for-hire affiliate marketers who use email blasts, online ads, social media promotions, and other scuzzy tactics to drive people to SafeMask.
Although he denied it in a phone call, based on domain data and information from a source in the affiliate industry, it appears that de Sousa operates a company called H8M8 that handles the affiliate relationships for his e-commerce products, including SafeMask.
As for the price of the masks, he said shipping costs had eaten into his revenue. “We are not making big profits off them,” de Sousa said.
“That’s not really something I’m aware of,” de Sousa said when told that he is selling masks that cost 10 or more times the normal price.
He also said there was no reason for customers to think the masks were reusable.
“The images of the masks are clearly disposable. No one is saying that the mask will last forever. That is something that is unreasonable to expect,” he said.
One reason why people thought the masks were for long-term use is that customers were upsold a three-year guarantee for $9.99 at checkout. De Sousa said he was unaware of that. “We will be refunding these guarantees — I can promise you that,” he said.
He declined to say why he sold European-certified masks to Americans prior to them being approved for use in the US, how many masks he has sold, or how much they cost him to purchase.
There is no actual “SafeMask.'' It’s the brand name de Sousa created as early as late January to resell masks he had purchased wholesale. So far that’s two different masks, one made in Turkey and one from China, although some emails sent by affiliate marketers displayed at least one other.
Many Americans who received emails promoting SafeMask saw a white mask with a distinctive blue filter. The mask shown is the Mandil FFP2/V Combi, and its manufacturer said it does not sell it in the US.
"I have no idea how they got there," Vittorio de Blasiis, the owner of DPI, the Rome-based manufacturer of the Mandil, told BuzzFeed News. He said the Madil mask typically sells for between $1.30 and $7 each.
"We absolutely do not sell in the US, because our products have an EU certification, not an American one,” de Blasiis said. "This is all very strange."
The European FFP2 certification is roughly equivalent to the American N95 standard. Prior to an emergency order issued on March 24 by the Food and Drug Administration, FFP2 masks were not approved for the US market.
“Such masks are being sold out extremely quickly due to huge demand from other responsible citizens in the United States,” said one SafeMask email sent to millions of Americans prior to FDA approval.
Early SafeMask customers received a different FFP2 mask with a blue filter. It’s called the “VIP Mask,” and it’s made by Rivatek, a Turkish company. (It's also the mask with an allegedly forged certification document.)
Lorraine McNeill-Krall, a 72-year-old retiree in New Brunswick, Canada, received five after paying the equivalent of $95. Like Shell, she thought the masks were reusable. Her twin brother has been using one for grocery runs and other errands, McNeill-Krall told BuzzFeed News. "I paid so much for them. It's discouraging, especially because I’m on a pension,” she said. “We’re all nervous and we wanted protection.”
SafeMask's trail doesn’t end with marketing affiliates writing misleading emails. Someone has to deliver the messages.
Sendlane, a San Diego startup, sent close to a million emails promoting SafeMask to lists on behalf of its customers this year, according to an analysis by researchers at George Washington University. Data from email insight and security firm Validity also showed Sendlane delivered entirely unsolicited SafeMask emails — spam.
Sendlane was founded in 2013 by Jimmy Kim, Zak Meftah, and Anik Singal, three men with backgrounds in affiliate marketing. (What may be Singal's greatest contribution to affiliate marketing is Lethal Commission, a 2011 Bollywood-style feature film about the industry, which he produced and stars in.)
In 2018, Kim, a former car salesperson whose birth name is Hyong Su Kim, and two different partners agreed to a $7 million settlement with the FTC for allegedly running a “deceptive and illegal” affiliate scheme. The FTC claimed the men deceived customers by selling moneymaking “products marketed as ‘secret codes’ that were actually generic software products.” Among their other offenses, Kim and his partners violated a federal anti-spam law by “sending commercial email messages that included misleading subject lines,” the FTC claimed.
Do you have a tip about affiliate marketing or coronavirus products? To learn how to reach us securely, go to tips.buzzfeed.com. You can also email us at firstname.lastname@example.org.
To satisfy the terms of the settlement, Kim and his partners paid the FTC $698,500, which was used to refund their customers.
“With regard to this settlement, I was strictly the product creator and exited that business when I learned of how it was being marketed,” Kim told BuzzFeed News. “You’ll notice my involvement expired in 2014.”
Kim said Sendlane was designed to help affiliate marketing campaigns, but only ones that send emails with permission.
But over the past 45 days, 177,567 SafeMask emails sent by Sendlane were caught in spam traps operated by Validity.
CAUCE's Schwartzman previously worked for a company that monitored spam traps and enforced penalties against rogue email service providers. “Ten spam trap hits would get you suspended,” he said. “This stuff is just stunning.”
"It’s absolutely a concern for us” that email delivered by Sendlane ended up in spam traps, Kim said.
“Our business is to deploy email on behalf of our client-base who is looking to communicate with their customers," he said. "We do not curate these emails nor do we represent them. We simply ensure their deliverability.”
On March 16, roughly a week before the FDA allowed FFP2 masks in the US, more than 100,000 subscribers to the RightWingAmericans.com email list received a message titled “FFP2 Face Mask Finally Available in the United States Could Help Against Deadly Virus Outbreak.”
The message featured a prominent image of the Mandil FFP2/V Combi with a distinctive blue filter under the headline “Protecting Yourself and Your Family Is Vital.”
Since February, millions of versions of that email were sent by more than a dozen conservative email lists, according to emails collected by BuzzFeed News, George Washington University, and eDataSource, an email marketing database. At least 80% of emails promoting SafeMask collected by eDataSource were delivered by Sendlane.
Emails promoting SafeMask were sent multiple times by eight conservative mailing lists controlled by the same owner, including RightWingAmericans.com, ConservativePeak.com, PoliticalLookout.com, and TheLibertyRevolution.com. Each list sends daily roundups of right-leaning headlines with links to their respective websites. They also send emails with sponsored offers for concealed carry firearm licenses, free Trump hats, and health remedies.
The sites, which were registered in the past year, have nearly identical templates and descriptions, and list street addresses in Ohio, South Carolina, and Milwaukee that belong to mailbox rental outlets. They don’t cite an owner or name anyone involved.
Using domain registration and technical records such as IP addresses, site analytics codes, and other information, BuzzFeed News and George Washington University connected these and roughly 50 other conservative websites and mailing lists to Mark Evans, a resident of West Palm Beach, Florida, originally from Ohio.
Evans bills himself online and in his expensive business workshops as “Mark Evans DM.” The initials stand for "deal maker." His online biography claims he started in real estate and now runs two eight-figure businesses while coaching other entrepreneurs and traveling the world. His Instagram is filled with images of Rolls-Royce cars, cigars, private jets, and photos taken in exotic locales.
Through corporate LLCs, including Racine Assets, Cash Flow Lead Gen, and Direct Mailers, Evans operates a large network of conservative sites and email newsletters. BuzzFeed News and George Washington University found Evans’ sites were some of the most prolific senders of SafeMask promotions.
As recently as April 10, a Racine Assets site called RightOnNews.com emailed a promotion for SafeMask with the subject line “2020 Pandemic WARNING: This mask adds an extra layer of protection…”
Some of the lists also sent emails that made false claims about actor Denzel Washington, singer Willie Nelson, or president George W. Bush to sell CBD products and a “diabetes curing pill.” The emails led people to websites designed to look like Fox News or Business Insider to trick them into paying what was marketed as a small fee for a free trial of the product. In fact, customers were subscribed to an expensive monthly subscription to the product, a fact not disclosed on the purchase page.
Evans did not respond to multiple emailed requests for comment.
Evans wasn’t the only marketer to target conservatives with SafeMask pitches. Joe Evangelisti, who describes himself as a real estate “flip king” in a self-published book, offers conservative email lists for rent.
“Our team is highly engaged with conservative views, and it just is a great way to sell advertising,” Evangelisti, who lives in Haddonfield, New Jersey, and has appeared on Evans' podcast, told BuzzFeed News.
He said his lists have hundreds of thousands of subscribers but declined to give an exact number or say how many his lists his company operates. The emails from Mammoth Conversions’ brands typically include a few headlines meant to appeal to conservatives, along with sponsored links.
“It’s taken years of trust to build that up and to find the right advertisers that will speak to our subscribers without annoying people,” he said.
Sales material for his sites from last year gave a sense of what he thinks speaks to his subscribers. The Patriots Make History list, which claims to have roughly 130,000 names, “does extremely well with offers that focus on financial gains, retirement, gold, and ‘income bible’ promotions,” it said.
Evangelisti’s site LeapFrogAmerica.com, which has reprinted entire articles from other conservative sites without permission, sent at least three SafeMask promotional messages, the first on Feb. 18. Another of his sites, PatrioticRetirement.com, which is filled with content automatically aggregated from other outlets, sent its list a promotion for alcohol wipes offered by the same company that sold SafeMasks.
Evangelisti did not reply to follow-up emails asking about the mask and wipe ads and whether his company earned a commission on purchases.
A third conservative email list operator who promoted SafeMask is Jake Spaulding, a 22-year-old living in Huntsville, Texas, roughly an hour north of Houston. Spaulding, who said he knows Evangelisti and has met Evans, told BuzzFeed News he expanded into conservative email marketing last year with the creation of Spaulding Publishing. He said his conservative email business is building him a "war chest" to purchase commercial real estate once the pandemic passes.
“In the next 12 months, I expect to start buying some deeply discounted commercial real estate,” he said. “So I'm just putting all my focus into building the [email marketing] company bigger, faster while I’ve got this advantage of everyone being at home checking their emails.”
Spaulding said he has 600,000 subscribers, and he sometimes sends offers that earn him sales commissions, including recent emails promoting alcohol wipes and masks. The email lists connected to two of Spaulding’s sites — RepublicanPost.net and ConservativeAmericaToday.com, which has reprinted the full text of articles from conservative outlets such as the Washington Examiner without permission — sent SafeMask promotions in March.
“We weren't trying to price-gouge anyone, and there's a lot of that going on right now,” he said. “So I had one of my team members go through each offer that was sent out and make sure that they're not trying to extort my audience.”
He didn’t respond to follow-up questions about the high price and dubious claims made by SafeMask. “At this time I’m really not wanting to give out any more information about my business,” he said.
Hours after de Sousa spoke to a reporter last week, SafeMask’s price dropped by approximately 75% and the offer of a three-year guarantee was removed. As of April 20, SafeMask payment sites had removed the masks and begun selling "BackHero," which it bills as a posture corrector.
Shell, meanwhile, is still waiting for his masks.
He sees how fear and misleading marketing drove him to overpay for a mask that will be of limited use.
“The thing about it is it coincided with the whole news cycle,” he said.
“I didn't want to pay $40, right? So in fact, I resisted it, and then when Dr. Fauci recommended [wearing a face covering] and said that we really should do everything we can to try to keep ourselves safe, that's when I went and got it.” ●
Additional reporting by Holger Roonemaa in Tallinn and Alberto Nardelli in London.