A note first: we are a law firm and we handle online fraud cases only. If you want our help, fill in the form at the bottom of this article.
We have already handled this case and we can help people who have fallen into the same trap. horstman-group.com is a scam, and from the domain registry we drew two pieces of data worth reading carefully: the time in which it was built, and the suppliers that were chosen.
A name that sounds like an industrial group
The name of horstman-group.com is built to suggest solidity: a German-sounding surname and the word group. It is a classic move, because a family surname suggests a history and a group suggests size.
On the pages of horstman-group.com, of course, there was none of that: no full corporate name, no VAT number, no registered office, no licence number, no supervisory authority named. Offering investment services to people in Italy without authorisation is the offence of unauthorised financial activity under article 166 of the Consolidated Law on Finance, which is added to the fraud and is autonomous from it.
Two seconds
We checked the registration data of horstman-group.com in November 2026. The domain was registered on 4 March 2026 at 13:05:05. The nameserver configuration was carried out at 13:05:07: two seconds later.
Two seconds is not the time a person takes to buy a domain, open a control panel, paste some data and save. It is the time of an automated procedure, written in advance, fired at a freshly bought name. It means horstman-group.com was not born of a project: it was printed.
It is a detail of horstman-group.com that is worth more than many pages in a complaint, because it proves organisation: someone with an automated system for standing a site up in two seconds does not stand up one site. They stand up many.
The site is dead, the domain is alive: that is the right moment
Today horstman-group.com no longer answers: the nameservers it is delegated to do not respond for that domain, so the site is unreachable. But the registration is still valid, until March 2027.
This difference, which looks merely technical, is perhaps the most useful information in this whole article. A domain can be in three different states:
- live: the site opens, and screenshots can be saved;
- dark but registered: the site does not open, but the name is still held by somebody, who paid for it and who is on file with the registrar;
- deleted: the name no longer exists in any registry, and after a while anyone can take it.
horstman-group.com is in the second state, and the second state is the good window. As long as the registration is alive, the registrar holds the data of whoever registered the domain, the email address used, the login addresses and the payment method it was paid with. That is data the judicial authority can request, and that becomes far harder to recover after deletion.
In plain terms: if the site where you lost money no longer opens, it is not too late. It is the moment when asking for the registrant's data is worth most.
The two suppliers, and another case file
On horstman-group.com there is a second finding, and we report it with the caution it deserves.
horstman-group.com was registered through a registrar based in the Bahamas, and its nameservers belong to an Icelandic provider that makes customer anonymity its commercial selling point.
They are the same two suppliers — the same Bahamas registrar and the same Icelandic host — that we found on eccfinvestigators.com, the fake fund-recovery investigators' site we dealt with in a completely different file, with another injured party. And in both cases the configuration was done seconds after registration.
Here, though, a clarification is needed that we do not make elsewhere, and it is the difference between an indicator and an illusion. That Icelandic provider's nameservers are shared among all its customers: they are not assigned to a single account, as happens with the pair of names other providers assign to each user. Finding the same servers, in this case, does not prove it is the same account.
What does it prove, then? It proves a common supply chain: the same registrar chosen for the jurisdiction, the same host chosen for anonymity, the same automation. It is an indicator of environment, not of identity. It is worth writing in both files — because if the judicial authority requests data from those two suppliers in one proceeding, what comes back may light up the other as well — but it must not be presented as proof of a link. We would rather say so ourselves than hear it from a defence lawyer.
AnyDesk on the phone
There is an element in the horstman-group.com file that has to be isolated, because it is the gravest and the most underestimated: the injured party was made to install AnyDesk on his phone.
It is an entirely legitimate remote-assistance program, used every day by technicians and companies. The problem is not the program: it is who you hand control to. When remote access is on a phone, the person on the other side does not only see the screen. They see the banking app, they see the SMS messages with the authorisation codes, they see the photo gallery — where almost everyone keeps an image of their identity card — and they see the email.
At that moment credentials count for nothing, because the operation is authorised from your own device. And that is why, in these cases, changing the password is not enough: the device must be changed, or at least reset, and the number must be changed too. The injured party in this file did exactly that — he changed phone and number — and he did the right thing.
In criminal-law terms, two autonomous offences are added to the fraud: unlawful access to a computer system under article 615-ter and computer fraud under article 640-ter of the Italian criminal code. They must be named expressly in the complaint, because they are the basis on which access logs and telephone records are requested.
The file
The payments to horstman-group.com began in December 2025 and the last one dates to June 2026, for a total of about 6,600 euro. The injured party filed a criminal complaint in January 2026, while the story was still running: it is the best thing that can be done, and it is not common.
What happened afterwards deserves an article of its own, and we wrote it: after the platform came a chain of fake lawyers and a fake bank, with a domain built to have no website at all, only email. You will find it below, among the similar cases.
What to do now
If horstman-group.com no longer opens, do not stop. Ask in the complaint for the registrant's data to be obtained from the registrar while the registration is still alive: account holder, email, login addresses, payment method.
If you installed a remote-assistance program, do not stop at the password: change or reset the device, change the number, and declare what happened in the complaint, citing articles 615-ter and 640-ter.
Ask your bank for the full trail of the transfers: destination IBAN and account holder, receiving bank, country, date and time. For euro transfers after 9 October 2025, the outcome of the verification of payee too.
Declare the documents you handed over: identity card, tax code, utility bill, IBAN, bank statement. A bank statement, in their hands, tells them how much you have.
Pay for no fake recovery connected to horstman-group.com and do not answer anyone presenting themselves as a lawyer after the fraud: a lawyer's name can be verified in thirty seconds in the public roll of the national bar council.
Similar cases we have handled
The horstman-group.com pattern repeats under different names:
- eccfinvestigators.com: the fake fund-recovery investigators
- evolutiongruop.co: the misspelled name and the remote access
- megachaint.com: 110,000 euro and three waves
- coinupy.com: the domain that expires on 30 November 2026
- sharecreditsecuritieslimited.com: the clone of an authorised firm
- mh6215.it: three domains, two case files, one account
A warning that concerns us directly
We are aware that someone is telephoning defrauded people using our firm's name. We never call on our own initiative, we do not telephone in the evening or at night, we do not use foreign numbers and we never ask for money by telephone. If you receive a call like that, hang up and write to us through the form on this site.
If this happened to you, write to us
If you invested on horstman-group.com, fill in the form at the bottom of this page. Give the transfer dates, the amounts, whether you installed a remote-assistance program and which documents you handed over.
And if the site no longer opens: that is exactly the moment to move, not the reason to give up. We read every request and we answer.
Do you need legal assistance?
Tell us about your case: free assessment, no obligation.
