Documented alert
apexpumpengineering.com
Evidencedapexpumpengineering.com — bait supplier behind a fake Unilever RFQ for part AP45-CIE91
Published
A request for quotation sent to a European trading company on 24 June 2026 asked for 50 units of manufacturer part number AP45-CIE91. The message was signed “Unilever Procurement Team” and asked for the quotation to be sent to purchasing@unileverrotterdam.nl — a domain Unilever does not operate.
Searching that part number returns a single supplier: apexpumpengineering.com, trading as “Apex Engineering”. The same site lists two further codes, AP18-MDS81 and AP88-HPH34.
The part numbers were introduced in 2026
This domain has a history. Archived copies from 2021 to late 2024 show a pump supplier with a large, specific catalogue — borehole ranges, solar pumping systems, sewage pumps — reachable on a London landline, +44 (0)203 769 2324, at an address in NW10. None of the three codes above appear anywhere in it.
By January 2025 the domain was a parking page: “apexpumpengineering.com was recently registered at XtraOrbit.Com and is currently parked here for free.” The registry dates the current registration to 6 April 2026. The site that stands there now reuses the old branding and the “since 2004” line, but the landline has been replaced by a mobile number, the address has changed to a serviced-office building on Aldersgate Street, and the three part numbers have appeared.
Buying a lapsed domain is a recognised way to inherit its age and search reputation. That is what appears to have happened here.
Why this shape of enquiry is dangerous
The trader in the middle is the target. They do not stock the part, so they search for it, find one supplier, and pay that supplier up front in order to fulfil an order that does not exist. Both the buyer and the supplier are the same operation. Nothing ships, and the trader carries the entire loss.
Proofpoint documents this family as “NET RFQ” fraud; the US General Services Administration and Department of Commerce Inspectors General publish comparable alerts about fake procurement schemes.
What to do if you received this
- Do not send a quotation, and do not pay any supplier found only via the requested part number.
- Verify the enquiring company through contact details you obtain independently — never those in the e-mail.
- Check when the supplier’s domain was registered, and whether it changed hands. It takes a minute and settles most cases.
- Report the message to your national cybercrime reporting service.
Verified facts
Each entry below comes from a public record that you can check yourself. Nothing here is our opinion.
Domain first registered
apexpumpengineering.com
2026-04-06
The domain is 4 months old.
Source: RDAP registry record (rdap.verisign.com)
Domain re-registered after previous ownership lapsed
apexpumpengineering.com
Archived since 2021-11-26, current registration 2026-04-06
Public archives hold copies of this domain from 2021-11-26 onward, but the registry dates the current registration to 2026-04-06. The domain therefore lapsed and was registered again by someone else. Buying an expired domain to inherit its history is a recognised way to make a new operation look established.
Source: Internet Archive CDX index and RDAP registry record
Claimed trading history is not supported by the record
apexpumpengineering.com
Claims 2004, current registration 2026-04-06
The site presents itself as trading since 2004. Whoever operates it today registered the domain on 2026-04-06, and the earliest archived copy of any site at this address dates from 2021-11-26. Neither record supports a continuous business under the present operator.
Source: RDAP registry record (rdap.verisign.com)
Registered for the minimum term only
apexpumpengineering.com
2026-04-06 to 2027-04-06
A single year was paid for. Businesses expecting to trade long term generally register for longer; disposable infrastructure does not.
Source: RDAP registry record (rdap.verisign.com)
Registrar
apexpumpengineering.com
Hosting Concepts B.V. d/b/a Registrar.eu
Source: RDAP registry record (rdap.verisign.com)
Name servers
apexpumpengineering.com
sg1.ownmyserver.com, sg2.ownmyserver.com
Source: RDAP registry record (rdap.verisign.com)
Domain first registered
unileverrotterdam.nl
2026-03-03
The domain is 5 months old.
Source: RDAP registry record (rdap.org)
Registrar
unileverrotterdam.nl
Dynadot LLC
Source: RDAP registry record (rdap.org)
Name servers
unileverrotterdam.nl
odin.ns.cloudflare.com, gwen.ns.cloudflare.com
Source: RDAP registry record (rdap.org)
Sent from a free consumer mailbox
v*****@gmail.com
The message originates from gmail.com. Corporate procurement departments send requests for quotation from their own domain.
Source: Message headers
No sender display name
v*****@gmail.com
The From header carries a bare address with no name. Any company identity in the message exists only in the signature text, where nothing verifies it.
Source: Message headers
Authentication checks pass — and prove nothing here
v*****@gmail.com
This message passes SPF, DKIM, DMARC because it genuinely was sent from the mailbox it claims. SPF, DKIM and DMARC verify the transport, never the honesty of the sender. Spam filters pass messages like this for exactly that reason.
Source: Message headers
Records last re-checked on 2026-07-27.
Part numbers used in this campaign
Our assessment
This section is opinion, not established fact. It is our reading of the records above.
The records above do not prove criminal intent on their own, and this page asserts no court finding. Read together, they are hard to explain innocently.
Our assessment is that apexpumpengineering.com, in its present form, is not a continuation of whatever pump business previously used this domain. The current operator registered it in April 2026, restored the earlier branding, and added three part numbers that appear in no manufacturer catalogue and in no archived copy of the site. One of those codes was then used in an e-mail impersonating Unilever, sent from a Gmail account, directing replies to a domain Unilever does not own.
We regard apexpumpengineering.com and unileverrotterdam.nl as two halves of one operation: one invents a scarce part, the other creates demand for it, and the trader in between is asked to pay in advance. We publish the underlying records so readers can check that reasoning rather than take it on trust.
We make no claim about the earlier occupant of this domain, which may have been an unrelated and legitimate business. If you were connected with it, or with any domain named here, and believe a statement is inaccurate, use the correction link below.
How to recognise this before you pay
The part number returns exactly one supplier
Genuine industrial parts are stocked by distributors, listed in catalogues and discussed in forums. A code that exists on one website and nowhere else was invented to send you there.
A large company enquires from a free mailbox
Procurement departments write from their own domain. Gmail, Outlook and similar addresses do not become legitimate because the signature says otherwise.
Replies are directed to a slightly different domain
Check the reply address character by character against the company's real website. A city name or extra word appended to a famous brand is the whole trick.
The supplier wants payment before shipping
Advance payment to a supplier you found only through the buyer's enquiry is how the money leaves. Established suppliers offer terms or escrow.
The supplier's domain is young, or recently changed hands
A registry lookup takes thirty seconds. A "manufacturer since 2004" operating from a domain registered last spring is telling you something.
No company registration number
Registered companies in most of Europe must publish their registration number. Check it against the national register rather than trusting the footer.
Think something here is wrong?
If you are connected to any domain or address named on this page and believe a statement is inaccurate, tell us and point at the record that shows it. We will correct or remove it promptly where the evidence supports that, and we will say that we did.