Typos don't lie; The Price List + COA Trail That Exposed a Scam Ring

Contact #4: Same Script, New Name (Luna)

Krysia

By the time Luna appeared, the pattern was no longer theoretical.

On 3 February, I received a DM on PepChat from an account calling herself Luna. She had a green “NEW” label next to her name, a sign she had only just joined the platform and had not been vetted.

Her opening pitch followed the now familiar template:

She framed herself as a long-term peptide manufacturer, emphasised quality and trust, and reassured me there was “no pressure.” Almost immediately, she included her WhatsApp and Telegram contact details, the first nudge off-platform.

Nothing about the approach was unique. What mattered was what came next.

I asked a simple question:

Do you have a server?

She dodged it.

Instead of providing any public anchor point, a Discord, a channel, a community, she sent me her price list.

That was the moment it stopped being vague and became measurable.

Because Luna’s price list wasn’t just similar to Bella’s.

It was effectively the same document.

The structure matched.

The formatting matched.

The product layout matched.

Even the spelling mistake carried over, “Samaglutide” misspelled in the same way.

The prices were slightly different, but the underlying spreadsheet was clearly the same one being recycled.

Payment, shipping, and the familiar setup

I moved straight to logistics.

Luna listed accepted payment methods:

Alibaba

OKEx

Bitcoin

Credit card

When I asked about Apple Pay, she explained that Apple Pay could be used via a linked credit card , a workaround explanation rather than a direct acceptance.

Then shipping.

She quoted $60 for express and $45 for a dedicated line, with delivery estimates of 7 to 10 days and around 15 days respectively. The numbers differed from Bella’s, but the structure was familiar: speed, reassurance, and language designed to reduce friction.

She then followed up with:

“If you’d like, you can send me the list of products you’re interested in.”

Again, the funnel was clear: keep things moving, keep it one on one, keep it off-platform.

The COAs arrive, and the same red flags emerge

When I asked for COAs, Luna said the reports had been “tested by the customer.” She then sent Janoshik reports, but this time they were different to the ones previously shared by Bella and Alisa.

What stood out wasn’t duplication, it was editing.

The client name appeared Chinese, not like an end customer, and the manufacturer field had been blanked out. When I verified on the Janoshik website , the missing manufacturer resolved to shpeptide.com.

Alongside these, she also sent a random Finnrick COA, dropped into the conversation without explanation.

It wasn’t a clean testing trail.

It was a bundle designed to reassure rather than clarify.

Persistence after disengagement

After that exchange, I stopped engaging for a while but Luna continued messaging anyway.

She checked in repeatedly, asked if I had concerns, offered to chat, suggested adding contact details, and reiterated how easy communication would be via WhatsApp or Telegram

The tone stayed polite. The pressure stayed soft. The objective stayed the same: keep the channel open.

When I asked Luna why the manufacturer name was blocked out, her explanation was immediate and polished:

“The reason I blocked it in the certificate is to hide my company name for privacy and security purposes.”

COAs are meant to anchor responsibility. When the manufacturer is removed, it’s rarely for “security”, it’s usually because the document wasn’t theirs.

“SH is the abbreviation for Shanghai”

I asked directly who SH Peptide was, given that Luna had said she worked for Shanghai Keta / Keti Peptide.

Her response was short:

“SH is the abbreviation for Shanghai.”

Not a company explanation. Not a relationship. Just a linguistic dodge.

At that point, the simplest explanation was also the most likely: the COAs were probably fake, or at least manipulated enough to make them functionally meaningless.

Similarity reframed as coincidence.

When I finally put the question plainly, why her price list matched Bella’s, right down to the same misspelling of samaglutide, the response followed a familiar script.

She acknowledged the similarity, but immediately widened the frame.

Price lists look alike, she said.

Spelling formats overlap.

Suppliers source from the same manufacturers.

It was presented as industry coincidence rather than shared origin.

Then came the distancing language.

She said she didn’t personally know Bella.

She said they operated independently.

She shifted the focus away from documentation and toward delivery, consistency, and “building trust.”

What mattered most, she said, was product quality, not where the paperwork came from.

It was a smooth answer. Polite. Professional. Carefully constructed.

But it didn’t address the core issue: two vendors, the same structure, the same layout, the same typo, and no clear explanation for how that happened without shared materials.

So I changed the test.

I asked to see actual stock, real product, not spreadsheets and reassurance.

Luna agreed immediately, sent several stock photos, and then moved straight back into logistics: pricing, shipping, payment options, and how quickly she could provide tracking. When I asked about PayPal, it wasn’t offered. When I asked for crypto, a wallet address appeared instantly. When I asked for reassurance, the language became warmer: “dear,” “my dear,” “honey,” along with repeated prompts to add contact details “to facilitate communication.”

By that stage, the pattern was no longer subtle.

Legitimacy questions were met with explanations and smoothing.

Money questions were met with specifics.

And the documentation, the part that should have anchored accountability, had been edited, redacted, and reframed as a privacy issue.

That wasn’t a seller protecting customers.

It was a seller protecting distance.

What Luna confirmed

Luna didn’t prove she was linked to Bella. She denied it.

What she did confirm was something more useful: that the same materials could move across different names while the story stayed consistent.

A familiar spreadsheet.

A familiar typo.

A familiar set of “trust” phrases.

A familiar push off-platform.

And when challenged, a familiar script: industry overlap, coincidence, independent operations.

The names changed.

The workflow didn’t.

And at this point in the series, that was exactly what mattered.

Because this was no longer a single vendor problem.

It was a reuse problem.

The same assets circulated. The same paperwork was reshaped. And the same sales process repeated, across different faces, until most people stopped asking questions.

In the next episode, a community member went under cover as a customer and followed Bella’s process all the way through, not as an interviewer, not as an observer, but as a buyer.

Comments