ABUSE NOTICE · 7D+ OPEN
Outgoing abuse reports are recorded; the latest stored availability evidence still shows the domain reachable.
Notification and current-status evidence
The sent-report ledger records the first outgoing report at .
The recorded recipient is abuse@namecheap.com.
The latest stored availability evidence still shows the domain reachable; 1 month has elapsed since the first outgoing report.
ICANN RAA §3.18 describes registrar abuse-contact and handling obligations.
This section records outgoing timestamps, listed recipients, case identifiers, and later availability. It does not by itself prove receipt, acknowledgement, investigation, remediation, or contractual non-compliance.
nawazassociates.com is an impersonation phishing page that presents itself as "NexaConsult România - Soluții Strategice pentru Afaceri", a Romanian strategic business consultancy. Its likely audience is Romanian-speaking business owners and anyone seeking consulting services. PhishDestroy first flagged it on 2026-09-15. As of 2026-10-19 the domain still resolves, but its page content no longer loads. The domain name suggests a firm called Nawaz Associates, while the page title shows NexaConsult România. That mismatch is part of why we classify the site as impersonation.
How the scam works
Fake consultancy sites copy the branding and polished tone of a real advisory firm to look trustworthy. A visitor who reaches out is then pressed to hand over company and personal details, log in to a supposed client portal, or pay upfront fees for strategy, investment or financing services that never arrive. In crypto-adjacent cases, the same front often steers clients toward fraudulent investment platforms or transfers to wallets controlled by the operators. The victim loses money, identity data and sometimes account credentials that can be reused against them.
Evidence
On 2026-09-25, 13 of 91 VirusTotal engines flagged the domain, including ESET, Kaspersky, Fortinet, Forcepoint ThreatSeeker, alphaMountain.ai, CyRadar, Gridinsoft and Lionic. That is a meaningful minority, and several of these are major commercial vendors that work independently of each other. The domain also appears in 4 AlienVault OTX threat pulses, so other researchers have tied it to malicious activity. Among blocklists, it is currently listed by PhishDestroy.
Infrastructure
The domain was registered through Namecheap on 2026-04-20, nearly five months before it was detected. Domains are often held that long so they look established when a campaign starts. The site sits behind Cloudflare, with the address geolocated to Canada, which hides the real origin server. Its free Let's Encrypt certificate means the browser padlock says nothing about whether the business is legitimate.
What to do
If you paid this "consultancy" anything, contact your bank or payment provider right away and ask about a chargeback or recall. Keep all invoices, emails and chat logs. If you entered a password on the site, change it everywhere you reuse it and turn on two-factor authentication. Treat any follow-up offers of investment returns or "fund recovery" as part of the same fraud, and report the incident to Romanian police or your national cybercrime authority. Defenders should block the domain at DNS and proxy level and search mail logs for messages pointing to it.
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(US)
