**Scam Campaign Report: Multi-Domain Infrastructure Network Targeting Consumers**
Our analysis has identified a sophisticated scam campaign utilizing a network of 8 interconnected domains sharing the same infrastructure and registration patterns. All domains were registered through TUCOWS.COM, CO. between September 3-11, 2025, indicating coordinated campaign timing. The network includes theunitedgentlemen.com, www.theunitedgentlemen.com, orthoeva.com, kokowest.com, veyorahealth.com, louisesboutique-savannah.com, heysnug.com, and atsreadyresumes.com. These domains are connected through 18 documented same-infrastructure relationships, with atsreadyresumes.com serving as a central hub connected to 6 other domains in the network.
The campaign has generated significant consumer complaints, with particular focus on theunitedgentlemen.com and its www subdomain. Community reports reveal a consistent pattern of fraudulent e-commerce activity, where consumers are deceived by professional-looking websites displaying quality products but receiving inferior goods after extended shipping delays. One victim reported ordering what was advertised as a knit cashmere sweater but receiving a product that clearly did not match the website description. Another complaint documented the same pattern of long delivery times accompanied by misleading status emails from the company. The domain orthoeva.com has been reported together with Credit Corp Solutions Inc., a debt collection company with 2,743 CFPB complaints, suggesting potential cross-industry fraud connections.
The campaign's infrastructure design indicates sophisticated threat actors using shared hosting to rapidly deploy multiple fraudulent storefronts across different market segments, from men's clothing (theunitedgentlemen.com) to health products (veyorahealth.com, orthoeva.com) and resume services (atsreadyresumes.com). The nearly simultaneous domain registrations and identical infrastructure fingerprints demonstrate coordinated campaign management designed to maximize reach while potentially evading detection through domain diversification.
**Consumer Protection Advice:** If contacted by any entity associated with these domains, do not click links, provide personal information, or make purchases. Hang up immediately on unsolicited calls and delete suspicious emails. To verify legitimacy, consumers should independently research companies through official business registries and check domain registration dates - newly registered domains offering deals are often fraudulent. Before engaging with unfamiliar websites, check the Federal Trade Commission's fraud database and consumer review sites. Report suspected fraud to the FTC at reportfraud.ftc.gov or file telecommunications fraud reports with the FCC. Consumers can verify the safety of phone numbers and domains using official FTC and FCC complaint databases before engaging with suspicious contacts.
This campaign represents a high threat level due to its sophisticated multi-domain infrastructure, documented consumer financial losses, and connection to entities with extensive complaint histories totaling 2,818 CFPB reports. Immediate action is recommended: consumers should avoid all identified domains, financial institutions should monitor for transactions involving these entities, and regulatory agencies should investigate the shared infrastructure for additional fraudulent domains. The coordinated registration timing and infrastructure sharing indicate an active, well-resourced threat actor likely to expand operations.