Texas-Based eWorldTrade and Pakistani Partner Abtach Exposed: Massive Scam Network Used Online Ads to Defraud U.S. Consumers

Pakistani Firm Shipped Fentanyl Analogs to US Using Scam Online Ads

A Texas firm recently charged with conspiring to distribute synthetic opioids in the United States is at the center of a vast network of companies in the U.S. and Pakistan whose employees are accused of using online ads to scam westerners seeking help with trademarks, book writing, mobile app development and logo designs, a new investigation reveals.

In an indictment (PDF) unsealed last month, the U.S. Department of Justice said Dallas-based eWorldTrade “operated an online business-to-business marketplace that facilitated the distribution of synthetic opioids such as isotonitazene and carfentanyl, both significantly more potent than fentanyl.”

Launched in 2017, eWorldTrade.com now features a seizure notice from the DOJ. eWorldTrade operated as a wholesale seller of consumer goods, including clothes, machinery, chemicals, automobiles and appliances. The DOJ’s indictment includes no additional details about eWorldTrade’s business, origins or other activity, and at first glance the website might appear to be a legitimate e-commerce platform that also just happened to sell some restricted chemicals.

However, an investigation into the company’s founders reveals they are connected to a sprawling network of websites that have a history of extortionate scams involving trademark registration, book publishing, exam preparation, and the design of logos, mobile applications and websites.

Records from the U.S. Patent and Trademark Office (USPTO) show the eWorldTrade mark is owned by an Azneem Bilwani in Karachi (this name also is in the registration records for the now-seized eWorldTrade domain). Mr. Bilwani is perhaps better known as the director of the Pakistan-based IT provider Abtach Ltd., which has been singled out by the USPTO and Google for operating trademark registration scams (the main offices for eWorldtrade and Abtach share the same address in Pakistan).

In November 2021, the USPTO accused Abtach of perpetrating “an egregious scheme to deceive and defraud applicants for federal trademark registrations by improperly altering official USPTO correspondence, overcharging application filing fees, misappropriating the USPTO’s trademarks, and impersonating the USPTO.”

Abtach offered trademark registration at suspiciously low prices compared to legitimate costs of over USD $1,500, and claimed they could register a trademark in 24 hours. Abtach reportedly rebranded to Intersys Limited after the USPTO banned Abtach from filing any more trademark applications.

In a note published to its LinkedIn profile, Intersys Ltd. asserted last year that certain scam firms in Karachi were impersonating the company.

FROM AXACT TO ABTACH

Many of Abtach’s employees are former associates of a similar company in Pakistan called Axact that was targeted by Pakistani authorities in a 2015 fraud investigation. Axact came under law enforcement scrutiny after The New York Times ran a front-page story about the company’s most lucrative scam business: Hundreds of sites peddling fake college degrees and diplomas.

People who purchased fake certifications were subsequently blackmailed by Axact employees posing as government officials, who would demand additional payments under threats of prosecution or imprisonment for having bought fraudulent “unauthorized” academic degrees. This practice created a continuous cycle of extortion, internally referred to as “upselling.”

“Axact took money from at least 215,000 people in 197 countries — one-third of them from the United States,” The Times reported. “Sales agents wielded threats and false promises and impersonated government officials, earning the company at least $89 million in its final year of operation.”

Dozens of top Axact employees were arrested, jailed, held for months, tried and sentenced to seven years for various fraud violations. But a 2019 research brief on Axact’s diploma mills found none of those convicted had started their prison sentence, and that several had fled Pakistan and never returned.

In October 2016, a Pakistan district judge acquitted 24 Axact officials at trial due to “not enough evidence” and then later admitted he had accepted a bribe (of $35,209) from Axact.

In 2021, Pakistan’s Federal Investigation Agency (FIA) charged Bilwani and nearly four dozen others — many of them Abtach employees — with running an elaborate trademark scam. The authorities called it “the biggest money laundering case in the history of Pakistan.”

The FIA said the defendants operated numerous websites offering low-cost trademark services to customers, before then ignoring them after receiving payment and later demanding more funds under the pretense of “up-sale” (extortion).

The FIA found that Abtach operates in conjunction with a Karachi firm called Digitonics Labs, which earned a monthly revenue of around $2.5 million through the extortion of international clients and maintaining phishing websites.

Also charged by the FIA was Junaid Mansoor, the owner of Digitonics Labs in Karachi. Mansoor’s U.K.-registered company Maple Solutions Direct Limited has run at least 700 ads for logo design websites since 2015, according to Google Ads Transparency.

Junaid Mansoor is actively involved with a Quran study business called quranmasteronline.com, founded by his brother Qasim Mansoor. The same Google account promoting this business also advertised scam websites selling logo and web design services.

Junaid Mansoor did not respond to requests for comment.

 

THE TEXAS NEXUS

KrebsOnSecurity discovered that entities involved in these scams maintain a significant presence in Texas, particularly through businesses like Retrocube LLC and 360 Digital Marketing LLC, both located at the same address as eWorldTrade in Dallas.

Multiple lawsuits have been filed against these companies by customers claiming fraud and breach of contract. Despite ongoing legal challenges, these companies continue to operate under different names, often shifting their online presence to evade scrutiny.

 

VICTIMS SPEAK OUT|

Ms. Will’s lawsuit is just one of many against these companies. Over the past four years, more than two dozen similar complaints have been filed. In one instance, a man in New Jersey sued Octagroup Technologies after paying $26,000 for a website that was never delivered. The court ruled in his favor as the defendants didn’t contest the case.

Leigh Riley, who sued 360 Digital Marketing LLC and Retrocube LLC, said she was misled into paying $40,000 for a book project. Riley documented numerous missed meetings and poor-quality drafts. She ended up writing most of the content herself after receiving unusable material. Despite being promised a polished book, the final version had the wrong title printed on it. Eventually, she accepted a $20,000 settlement to cut her losses.

Another victim, Walter Horsting, pursued legal action against Vox Ghostwriting for failing to deliver a usable novel after charging him $10,800. He found their claimed Los Angeles office to be vacant, eventually tracking their real location to the same Dallas address. Although he won his case, Horsting doubts he will recover the funds.

A mind map tracing these connections shows how this network involves various companies offering dubious services like ghostwriting, web development, and even academic cheating. Victims often faced additional blackmail attempts after initially being scammed.

 

GOOGLE RESPONDS

Google’s Ad Transparency data shows that this scam network ran over 500 ads for various services through 360 Digital Marketing LLC. After KrebsOnSecurity contacted Google about these campaigns, the number of active ads dropped to 10. Google stated that it removed billions of problematic ads last year, including 500 million related to trademarks, and is actively investigating the companies mentioned in this report.

Google recently announced that its ads transparency page will now display the payer’s name if it differs from the advertiser name, a change aimed at curbing ad fraud. The spreadsheet containing data on over 350 connected domains and advertiser names was published as part of the investigation.

Good job NatInfoSec for contributing research to this investigation. For more insights on Abtach and its global web of scam businesses, see the related Wikiwand entry.