A Texas corporation recently accused of conspiring to distribute synthetic opioids within the United States is at the core of a large network of businesses in both the U.S. and Pakistan, whose staff are alleged to have utilized online advertisements to defraud Western individuals seeking assistance with trademarks, book authorship, mobile application creation, and logo designs, a recent investigation has uncovered.

In a formal accusation (PDF) made public last month, the U.S. Department of Justice stated that the Dallas-based eWorldTrade “operated an online business-to-business marketplace facilitating the distribution of synthetic opioids such as isotonitazene and carfentanyl, both of which are significantly more potent than fentanyl.”

Established in 2017, eWorldTrade[.]com now showcases a notice of seizure from the DOJ. eWorldTrade functioned as a wholesale distributor of consumer products, encompassing clothing, machinery, chemicals, vehicles, and appliances. The indictment from the DOJ provides no further specifics regarding eWorldTrade’s business, origins, or activities. At first glance, the site may appear to be a bona fide e-commerce platform that just coincidentally sold some controlled chemicals.

Nonetheless, an inquiry into the founders of the company reveals their ties to an extensive web of websites that have been involved in fraudulent schemes related to trademark registration, book publishing, exam preparation, and the development of logos, mobile apps, and websites.

Documents from the U.S. Patent and Trademark Office (USPTO) indicate that the eWorldTrade trademark is held by an Azneem Bilwani based in Karachi (this name is also present in the registration records for the now-confiscated eWorldTrade domain). Mr. Bilwani might be better recognized as the head of the Karachi-based IT firm Abtach Ltd., which has been highlighted by the USPTO and Google for executing trademark registration fraud (the main offices for both eWorldTrade and Abtach share an identical address in Pakistan).

In November 2021, the USPTO accused Abtach of executing “a disgraceful scheme to mislead and defraud applicants for federal trademark registrations by improperly altering official USPTO correspondence, inflating application filing fees, misappropriating the USPTO’s trademarks, and impersonating USPTO officials.”

Abtach provided trademark registration services at suspiciously low rates compared to the legitimate costs exceeding USD $1,500 and asserted that they could secure a trademark within 24 hours. Reports suggest that Abtach rebranded to Intersys Limited after the USPTO prohibited Abtach from submitting any further trademark applications.

FROM AXACT TO ABTACH

A significant number of Abtach’s employees previously worked for a comparable firm in Pakistan named Axact, which was shut down by local authorities for fraudulent practices in 2015. Axact’s downfall followed shortly after The New York Times published a front-page article exposing the company’s most profitable scam: Numerous websites selling fake college degrees and diplomas.

Individuals who bought counterfeit certifications were later extorted by Axact staff posing as government officials, who demanded further payments under threats of prosecution or imprisonment for having acquired fraudulent “unauthorized” academic degrees. This method initiated a perpetuating cycle of extortion internally referred to as “upselling.”

“Axact extracted money from no less than 215,000 individuals across 197 nations — one-third of whom were from the United States,” The Times reported. “Sales representatives utilized threats and false promises while impersonating government officials, generating the company at least $89 million in its last operational year.”

Numerous senior Axact officials were apprehended, imprisoned, held for several months, put on trial, and sentenced to seven years for diverse fraud offenses. However, a 2019 investigative report on Axact’s diploma mills discovered that none of those convicted had commenced their prison sentences, and several had fled Pakistan without ever returning.

“In October 2016, a district judge in Pakistan acquitted 24 Axact officials due to ‘insufficient evidence’ and subsequently admitted to having taken a bribe (of $35,209) from Axact,” states a chronicle (PDF) published by the American Association of Collegiate Registrars and Admissions Officers.

In 2021, Pakistan’s Federal Investigation Agency (FIA) accused Bilwani and nearly forty others — many of whom were Abtach employees — of orchestrating an intricate trademark scam. The authorities described it as “the largest money laundering case in the history of Pakistan,” naming various Texas-based enterprises they claimed assisted in transferring the proceeds of cybercrime.

The FIA stated that the accused controlled numerous websites that provided affordable trademark services to clients, subsequently “neglecting them after receiving the payments and thereafter demanding further funds from clients/victims under the guise of up-selling (extortion).” The Pakistani law enforcement agency reported that about 75 percent of clients were provided with counterfeit or forged trademarks as a consequence of the frauds.

The FIA discovered that Abtach collaborates with a Karachi-based firm named Digitonics Labs, which generated approximately $2.5 million monthly through “extorting international patrons under the pretense of up-selling, selling fake/falsified USPTO certificates, and operating phishing sites.”

According to Pakistan’s authorities, the suspects also perpetrated numerous frauds relating to ebook publication and logo design, subjecting clients to advance-fee fraud and extortion—where scammers requested additional payments for claimed “copyright release” while threatening to disclose the trademark.

Also implicated by the FIA was Junaid Mansoor, the proprietor of Digitonics Labs in Karachi. Mansoor’s U.K.-registered entity Maple Solutions Direct Limited has published no fewer than 700 advertisements for logo design websites since 2015, as reported by the Google Ads Transparency page reports. The organization currently has about 88 ongoing ads on Google as of today. 

Mr. Mansoor is actively involved in and advocates for a Quran study venture named quranmasteronline[.]com, which was established by Junaid’s sibling Qasim Mansoor (Qasim is similarly mentioned in the FIA criminal probe). The Google ads promoting quranmasteronline[.]com were financed by the identical account that advertises multiple fraudulent websites offering logo and web design services. 

Junaid Mansoor has not replied to requests for comments. An address in Teaneck, New Jersey, where Mr. Mansoor previously resided is listed as the official address of exporthub[.]com, a Pakistan-based e-commerce platform that appears strikingly similar to eWorldTrade (Exporthub claims its offices are located in Texas). Notably, a Google search for the domain shows ExportHub currently exhibits several listings for fentanyl citrate from suppliers in China and other regions.

The CEO of Digitonics Labs is Muhammad Burhan Mirza, a former employee of Axact who was detained by the FIA during its investigation into money laundering and trademark fraud in 2021. In 2023, prosecutors in Pakistan brought charges against Mirza, Mansoor, and 14 other Digitonics staff members for fraud, impersonating government officials, phishing, cheating, and extortion. Mirza’s LinkedIn profile indicates he now operates an educational technology/life coaching business called TheCoach360, claiming to assist young individuals in achieving “financial freedom.”

When contacted via LinkedIn, Mr. Mirza refuted any connections to eWorldTrade or its affiliated companies in Texas.

“Additionally, I possess no knowledge regarding the companies you’ve cited,” stated Mr. Mirza, who did not answer follow-up inquiries.

The present status of the FIA’s fraud case against the accused remains uncertain. The investigation faced early complications due to accusations of corruption and bribery. In 2021, Pakistani authorities claimed that Bilwani paid a substantial bribe to FIA investigators. Meanwhile, attorneys representing Mr. Bilwani argued that while their client did indeed make a bribe payment, it was solicited by government officials. Mr. Bilwani has not responded to requests for comments.

THE TEXAS CONNECTION

KrebsOnSecurity has discovered that the individuals and entities central to the FIA investigations have established a substantial presence in the United States, with a notable concentration in Texas. The Texas-based ventures promote websites that sell logo and web design, ghostwriting, and academic dishonesty services. Many of these entities have recently faced lawsuits for fraud and breach of contract from disgruntled former clients, who allege that the companies persistently upsold them while failing to deliver the promised work.

For instance, the FIA complaints cited Retrocube LLC and 360 Digital Marketing LLC, two entities that share a street address with eWorldTrade: 1910 Pacific Avenue, Suite 8025, Dallas, Texas. Also registered at that Pacific Avenue location is abtach[.]ae, a web design and marketing company located in Dubai; and intersyslimited[.]com, the new designation for Abtach after it was prohibited by the USPTO. Other businesses listed at this address promote services for logo design, mobile app development, and ghostwriting.

360 Digital Marketing’s website 360digimarketing[.]com is controlled by an Abtach front company known as Abtech LTD. Meanwhile, corporate records indicate that 360 Digi Marketing LTD is a U.K. entity whose officials include former Abtach director Bilwani; Muhammad Saad Iqbal, previously Abtach, now CEO of Intersys Ltd; Niaz Ahmed, a former Abtach associate; and Muhammad Salman Yousuf, once a vice president at Axact, Abtach, and Digitonics.

“““html

Labs.

Google’s Ads Transparency Center reveals that 360 Digital Marketing LLC conducted a minimum of 500 advertisements endorsing various platforms offering ghostwriting solutions. Another organization linked to Junaid Mansoor — a firm named Octa Group Technologies AU — has executed around 300 Google ads for book publishing services, promoting ambiguously titled websites such as amazonlistinghub[.]com and barnesnoblepublishing[.]co.

Rameez Moiz is a Texas local and prior product manager at Abtach who has represented 360 Digital Marketing LLC and RetroCube. Moiz informed KrebsOnSecurity that he ceased collaboration with 360 Digital Marketing during the summer of 2023. Mr. Moiz did not reply to subsequent inquiries, but his Upwork profile indicates that as of April 2025 he is employed by Dallas-based Vertical Minds LLC.

In April 2025, California inhabitant Melinda Will filed a lawsuit against the Texas company Majestic Ghostwriting — operating under the name ghostwritingsquad[.]com —  claiming they defrauded her of $100,000 after employing them to assist in writing her book. Google’s ad transparency page displays that Moiz’s employer Vertical Minds LLC paid for approximately 55 ads for ghostwritingsquad[.]com and associated websites.

VICTIMS SPEAK OUT

Ms. Will’s lawsuit is merely one of over two dozen claims filed in the last four years in which complainants have taken legal action against a member of this group’s web design, wiki editing, or ghostwriting services. In 2021, a man from New Jersey sued Octagroup Technologies, claiming they cheated him when he paid in excess of $26,000 for the design and promotion of a web-based mapping service.

The claimant in that instance did not respond to outreach for comments, but his grievance alleges that Octagroup and numerous other companies it engaged yielded minimal work while subjecting him to constant upselling. This case was ruled in favor of the claimant as the defendants failed to contest the issue in court.

In 2023, 360 Digital Marketing LLC and Retrocube LLC faced a lawsuit from a woman stating they defrauded her of $40,000 concerning a book she sought assistance in writing. That legal action conveniently showcased an image of the office entryway at 1910 Pacific Ave Suite 8025, prominently displaying the logos of 360 Digital Marketing, Retrocube, and eWorldTrade.

The lawsuit was filed pro se by Leigh Riley, a 64-year-old veteran IT professional who compensated 360 Digital Marketing to collaborate with a business called Talented Ghostwriter to co-author and promote a series of books she had outlined regarding spirituality and healing.

“The primary reason I engaged them was due to my lack of understanding regarding what I refer to as the formula for writing a book, and I recognize there’s substantial marketing involved in publishing,” Riley elaborated in an interview. “I know nothing about that realm, and they appeared persuasive that they could manage all facets. Until I found out they couldn’t construct a coherent sentence in English.”

Riley’s thoroughly documented lawsuit (not linked here due to containing sensitive personal information) includes screenshots of communications with the ghostwriting crew, which was consistently assigning her new writers and editors while neglecting her on scheduled calls concerning project updates. Riley mentioned that she ended up penning most of the book herself because the output they provided was unfit for use.

“Ultimately, after months of assurances that the books were printed and on their way, they arrived at my doorstep with the incorrect title on the book,” Riley recounted. When she requested a refund, she claimed the individuals assisting her with the promotional website barred her from accessing the site.

Riley opted to initiate a lawsuit, naming 360 Digital Marketing LLC and Retrocube LLC, among others. The businesses proposed to resolve the issue for $20,000, which she accepted. “I didn’t have the funds to hire a lawyer, and I decided it was time to mitigate my losses,” she stated.

Riley conveyed that she could have spared herself a considerable amount of distress by conducting simple research on Talented Ghostwriter, whose website asserts the company is situated in Los Angeles. Nonetheless, according to the California Secretary of State, there’s no registered entity by that name. In fact, the address claimed by talentedghostwriter[.]com is a vacant office building featuring a “space available” sign in the window.

California resident Walter Horsting encountered a similar situation when he sued 360 Digital Marketing in small claims court last year, after hiring a firm named Vox Ghostwriting for assistance in writing, editing, and promoting a spy novel he had been developing. Horsting mentioned he paid Vox $3,300 to ghostwrite a 280-page book and was upsold an Amazon marketing and publishing package for $7,500.

In an interview, Horsting stated that the writing produced by Vox Ghostwriting was “subpar at best,” compelling him to rewrite and edit the material himself, and collaborate with a graphic artist to create illustrations. Horsting indicated that when the time came to commence marketing the novel, Vox Ghostwriting attempted to further…

“““html

upsell him on promotional packages, while evading scheduled meetings with no follow-through.

“They offer a money-back promise, and when they refused to refund my cash I stated I’m taking you to court,” Horsting recounted. “I attempted to serve them in Los Angeles but discovered no such office exists. I conversed with a salon next door, and they said someone else had recently arrived desperately seeking the whereabouts of the ghostwriting firm, and it seems there are numerous victims involved in this. I eventually tracked down their location in Texas.”

It was the same office that Ms. Riley filed her lawsuit against. Horsting mentioned he has a court appearance set for later this month, but he’s under no misconceptions that prevailing in the case means he’ll be able to recover anything.

“At this stage, I’m doing it out of dignity more than genuinely anticipating any positive outcome for me,” he remarked.

The following mind map was instrumental in piecing together significant events, individuals, and connections discussed above. It’s crucial to highlight that this graphic only provides a glimpse into the operations associated with this group. For instance, in Case 2, we can see reference to academic dishonesty services, where individuals can be hired to take online proctored exams on one’s behalf. Those who engage these services soon find themselves at risk of impersonation and extortion attempts for increasing sums of money, with the threat of publicly disclosing their unethical academic cheating activities.

GOOGLE’S RESPONSE

KrebsOnSecurity examined the Google Ad Transparency links for nearly 500 different websites associated with this network of ghostwriting, logo, app, and web development enterprises. Those website names were then analyzed through spyfu.com, a competitive intelligence firm that monitors the reach and performance of advertising keywords. Spyfu estimates that between April 2023 and April 2025, those websites disbursed over $10 million on Google ads.

In response to inquiries, Google indicated in a written statement that it is continuously supervising its ad network for unscrupulous actors, referencing an ads safety report (PDF) showing that Google blocked or removed 5.1 billion fraudulent ads last year — including more than 500 million ads concerning trademarks.

“Our policy against Promoting Dishonest Conduct forbids products or services that assist users in misleading others, including advertisements for paper-writing or exam-taking services,” the statement reads. “When we discover ads or advertisers that breach our policies, we take measures, including suspending advertiser accounts, disapproving ads, and limiting ads to specific domains when deemed necessary.”

Google did not address specific inquiries about the advertising entities mentioned in this account, noting only that “we are actively probing this matter and resolving any policy breaches, including the suspension of advertiser accounts when warranted.”

Upon reviewing the ad accounts that have been promoting these fraudulent websites, it appears Google has taken recent action to eliminate a substantial number of the offending ads. Prior to my alerting Google about the extent of this ad network on April 28, the Google Ad Transparency network listed over 500 ads for 360 Digital Marketing; as of this report, that figure had dwindled to 10.

On April 30, Google declared that starting this month its ads transparency page will display the payment profile name as the payer identity for verified advertisers if that name differs from their verified advertiser name. Searchengineland.com reports that the adjustments are intended to enhance accountability in digital advertising.

This spreadsheet compiles the domain names, advertiser identities, and Google Ad Transparency links for over 350 entities offering ghostwriting, publishing, web design, and academic dishonesty services.

KrebsOnSecurity would like to express gratitude to the anonymous security researcher NatInfoSec for their assistance in this investigation.

For further exploration on Abtach and its numerous companies within all of the mentioned sectors (ghostwriting, logo creation, etc.), see this Wikiwand article.

“`