27 October 2025

A year ago, during our investigation into the Russian disinformation operations known as “Doppelganger”, we uncovered that the same bulletproof hosting provider associated with the notorious Aeza (also known as Evilempire or Lethost) was being used to promote both Doppelganger’s front domains and various dating scams.

We discovered that the infrastructure associated to disinformation hosted with Aeza was not just using “Kehr” as traffic distribution system (TDS) but that some of its traffic was landing in pages of a second TDS known as “Los Pollos“.

It did not take much time to discover that “Los Pollos” was also widely used to drive traffic to all types of fraudulent activities including dating and crypto scams. Our research into disinformation lead us to what is known as “Vextrio”, a large-scale ad-tech network that is used for distributing malicious traffic, scams, malware and unwanted applications.

The reader may wonder why investigating dating scams is important. Like other forms of fraud, victims of dating scams rarely speak openly about their financial losses. These scams often share many traits with cryptocurrency fraud and other “pig butchering” schemes. In cases such as Los Pollos, the same infrastructure used to promote these scams is also repurposed for disinformation campaigns and targeted attacks, including malware distribution. By examining the affiliate marketing ecosystem during the past three years and identifying its beneficiaries, we have gained insight into how the ad-tech industry can be systematically weaponized against society.

Conferences in the affiliate marketing industry often serve as more than just professional gatherings, they are lavish celebrations of the business success built upon these ecosystems. Behind the glossy branding, open bars, and networking parties lies an uncomfortable reality: many of the attendees profit from the very infrastructures that enable large-scale scams, disinformation, and all sorts of exploitation. These events function as public showcases of growth and innovation, yet they also reveal how normalized and celebrated the monetization of deceptive and harmful practices has become within the industry.

In this forensic investigation, we want to bring more light of how this affiliate ecosystem operates and the role of “Los Pollos” TDS connecting victims to the “dating scams and subscriptions traps”.

They like to move it, move it!

One year after our initial publication (Nov 2024) about the “Dating Vertical” promoted by Los Pollos, we are revisiting the scene again. Did they stop after our publication? Our experience is that cyber-criminals very seldom do, they rebrand, move to another friendly infrastructure, or change tactics just enough to stay under the radar.

During our research in late 2024, the primary landing pages of Los Pollos were hosted on 185.155.184[.]33. The landing pages were hosted in AS6898 in the name of C41.ch (former InternetOne). Since then, the ASN has been renamed again to “Swiss Innovative Arts and Technologies Institute” (SIATI).

In November 2024 we concluded that the “dating vertical” run by Los Pollos was mostly using a pre-landing page with the name “Loveme“. Since then Los Pollos and one of its legal entities (Teknology SA, Manno, Switzerland) is frequently using a new set of pre-landing pages: “OnlyOne” and “FlirtUp“.

The Dating Scam Ecosystem

The ecosystem of dating scams works based on a basic principle — bad guys are hiding behind untraceable companies to avoid linkage to the actual scam. Let’s have a walk through the actors involved.

The Concealed Advertisers – who are they?

One we had discovered that Los Pollos was a core player in dating scams – distributing traffic between publishers and advertisers – we decided to explore who the Concealed Advertisers were – hiding their legal names behind obscure off-short companies in Hong Kong, Cyprus, Malta and the Marshall Islands.

1. Nexxie Group (Cyprus)

Meet Us Media Ltd was one of the first networks of romance scams we found promoted by “Los Pollos”. Meet Us Media is a Cyprus registered proxy company run by the Nexxie Group. Traffic redirections originating in the Aeza bullet proof hosting provider “Lethost – Evilempire” are terminated in a “loveme” landing page run by Los Pollos TDS.

The Nexxie Group operates Redwalking Ltd (Digital Marketing), Merchsuite Ltd (Payments Solutions), Elevven 11 Ltd (Affiliate Marketing) and VDesk – offering global Customer Support and Recruiting Solutions.

VDesk and Ziimaxx

VDesk is responsible for hiring freelancers as “customer service representatives” who are tasked with luring victims to engage with them via the dating platform and continue paying for exchanging messages. These freelancers are known in the business space as “chatters”.

Qurium has not been the first looking into Nexxie’s “customer service” operations. Domain Tools did a podcast back in 2023 explaining in detail the practices of Nexxie, and the very same year, Laura Cole wrote the article “This Is Catfishing on an Industrial Scale” (behind paywall) about dating catfishing. Just recently, German media Simplicissimus released one year ago Die riesigen Netzwerke hinter Flirt-Bots a documentary explaining how Flirt-bots (fake profiles run by humans) work.

The freelancers hired by VDesk get access to a software known as Ziimaxx that operates as part of the hosting infrastructure of the Nexxie Group. The software is used to cleverly run fake profiles and interact with the victims under the supervision of a team of managers. The screenshot below shows what type of work these “Customer Service Representatives” are tasked to do.

A fascinating discovery was to see the recent inclusion in the Terms and Conditions of the websites operated by Meet Us Media (Nexxie Group) stating that the company operates fake profiles (flirt bots) designed to enhance the user experience. This disclaimer seems to contradict how these websites are promoted and advertised. A sample list of over 100 domains leading to sites operated by the Nexxie Group is available here.

The Nexxie Team

Nexxie Group is run by Norwegian Jan Morten Skaar with a track record of associations to the adult entertainment industry. In the past Skaar run similar activities with his business partner Frode Dale using the UK registered company Polarboot Limited in Cyprus.

In Norway, Dale runs the six companies Don Invest AS, Norvege AS, Nautnes Panorama AS, Briskebyen AS, Fix Eiendom AS and Nexxtq Holding AS. Jan Morten Skaar left Norway three decades ago.

Charis Demetriou is the visible and leading figure in the Nexxie ecosystem in Cyprus. He is also serving as CEO and co-owner of Hazeteam and playing a key role in organizing i-Con (Island Conference).

Hazeteam functions as the event management and lifestyle arm, responsible for exclusive parties, networking events, and PR, while i-Con is an international business and industry conference for affiliate marketing.

In 2024, Qurium made several attempts to contact Jan Morten Skaar and Frode “Billy” Dale to offer them an opportunity to clarify the nature of their business activities. At that time, our focus was solely on the intersection between affiliate marketing and Russian disinformation. No response was ever received.

Nexxie’s Affiliates

According to internal code of the websites of the “Nexxie Group”, they receive traffic (scam leads) from several affiliates. Among them we found “Algo Affiliates” an affiliate network that we exposed in joint investigation The Scam Empire.

IMonetize = BA            ExxoClick = BB           RedsharkReviews = DB
Redwalking = DC           Streamate = CC           LiveJasmin = CB
CamsPower = CF            Flirt4Free = CD          StripCash = CG
Bongacams = CA            xLovecams = CE           imLive = CH
CloudTraff = DA           Insparx = BC             TrafficHunt = BD
Adnium = BE               Cummission = DD          LoveCash = DE
Madmoney = DF             BucksMedia = DG          Advidi = DH
CandyOffers = DI          FlirtOffers = DJ         Adromeda = DK
Nova = DL                 Dummy = Dummy            Chaturbate = CI
DatingTap = DST           Letsdoeit = TA           FRSTMedia = SA
Proleagion = SB           BigBangAds = SD          VipResponse = SE
Clixscale = PA            SexGuide = SXG           BMV = SJ
Mobidea = SM              Clickloop = GA           Everflow = EVL
DaoOfLeads = DOL          AlgoAffiliates = AA      Teremarkets = DG
Qpid = QP                 Fluent = SI              TogetherNetworks = TGN
LeadLegends = SK          DatingLeads = DH         FellasAds = SN
Scribba = SCR             Leakem = LKM

2. Traffic Partner / Digital Performance (NL/DE)

The “Nexxie Group” is not the only business connected to “Los Pollos”. We have identified hundreds of domain names associated to 1) ‘monthly-subscription’ and 2) ‘pay as you go/drive by coins’ dating services.

A large cluster of these websites are reachable via yet another landing page in the name of Ultimate Enterprises Ltd. In another words, the dating traffic the pre-lands in “Los Pollos” TDS (FlirtUp) is later on redirected to a yet another TDS in the name of “Ultimate Enterprises”.

Ultimate Enterprises Ltd

Our investigation revealed that the final destination of the TDS was websites hosted at CQ International BV (AS25418). We also found that old copies of some of these websites included references to: Maikel (Gerardus Maria) Maessen (former Traffic Partner CEO) and Karl Schnurch.

This infrastructure is tightly connected to Traffic Partner BV, Digital Performance GmbH and the iVenture Group GmbH.

In the same infrastructure we found:

abacus online global k.f.t. | info-extremechat[.]com
AppCreators B.V. | chatplace[.]com
Appogee B.V. | mdate-s[.]com
Appogee B.V. | mdates[.]com
AppsPartner B.V. | appspartner[.]com
AppsPartner B.V. | flirtme[.]com
AppsPartner B.V. | iflirts[.]com
Apptex Performance B.V. | flirto[.]com
Boranu Online B.V. | idates[.]com
Boranu Online B.V. | mydates[.]com
Casual Networks B.V. | abenteuerx[.]com (Casual Networks BV Petronella Gerritsen)
Casual Networks B.V. | badults[.]com
Casual Networks B.V. | casualnetworksbv[.]com
Casual Networks B.V. | cheating69[.]com
Casual Networks B.V. | dates18[.]com
Casual Networks B.V. | deinseitensprung[.]com
Casual Networks B.V. | eroverein[.]com
Casual Networks B.V. | flirtfair[.]com
Casual Networks B.V. | fremdgehen69[.]tv
Casual Networks B.V. | jungekontakte[.]com
Casual Networks B.V. | kurvigefrauen[.]com
Casual Networks B.V. | reif6[.]com
Community Planet B.V. | amateurfans[.]com
Community Planet B.V. | amateurx[.]com
Community Planet B.V. | sexdatesonly[.]com
Creative Network Alliance SP.Z.O.O. | milfplace[.]com
Creative Network Alliance SP.Z.O.O. | trannybook[.]com
digital innovation network sp.z.o.o. | bbwbook[.]com
digital innovation network sp.z.o.o. | transzone[.]com
digital innovation network sp.z.o.o. | xtremechat[.]com
Entertainment Media Solutions SP.Z.O.O | nextflirt[.]com
Grandview AppCommunity GmbH | eastflirts[.]com
Hit Performance B.V. | asianflirts[.]com
Hit Performance B.V. | whatsflirt[.]com
HQ Entertainment Network GmbH & Co. KG | datingpartner[.]com
Intercon Media GmbH & Co. KG | whatschat[.]com
IP Broadcasting B.V. | acgo2[.]com
IP Broadcasting B.V. | amateurcommunity[.]com
IP Broadcasting B.V. | campartner[.]com
IP Broadcasting B.V. | live6[.]com
Media Websolutions B.V. | affaire[.]com
Media Websolutions B.V | lustparkplatz[.]com
Media Websolutions B.V | schnelledates[.]com
Media Websolutions B.V | seitensprungarea[.]com
Media Websolutions B.V | vorstadttreff69[.]com
Media Websolutions B.V | whatssexy[.]com
Media Websolutions B.V | willigedamen[.]com
Mojito B.V. | virtualgf[.]com
MP Mobile Performance Ltd. | dateyou[.]com
NAT Worldwide B.V. | nat-worldwide[.]com
Social Interactive Group SP.z.O.O | chatdome[.]com
Social Interactive Group SP.z.O.O | info-extremesite[.]com
Social Interactive Group SP.z.O.O | tranny1[.]com
Trafficpartner B.V. | info-chatzone[.]com
Trafficpartner B.V. | news-reifefrauen[.]com

We also found that all the websites are:

• Hosted inside CQ International BV: AS25418
• Run a common development framework
• Run behind Cloudflare using the same DNS servers
• Registered with InterNetX GmbH
• Several companies registered with the same postal address Frans Erensstraat 14 A 5921VG Venlo

The evidence strongly suggest that Ultimate Enterprises Ltd, a Hong Kong company with register Number: 2110588 is operated by Traffic Partner BV / Digital Performance GmbH. Our research also indicates that Traffic Partner is a client of Los Pollos.

The 2022 “Big Bash”

During the Scam Empire investigation, we discovered that representatives from Traffic Partner – including Andy Wullmer, Michael Reul, and Moritz von Arnim – were present at the 2022 “Big Bash” yacht party in Dubai, alongside Polina Belova, the representative from Los Pollos-Adtrafico. The event, hosted by Traffic Partner’s Andy Wullmer (aka “Traffic Captain”) took place aboard the Lotus Mega Yacht and was organized and sponsored by several affiliate networks later linked to the so-called “Sapphire Network,” a large-scale crypto scam-lead operation.

The participation of these key Traffic Partner executives, together with Adtrafico’s presence, highlights a personal and professional connection between the two companies and situates them within the same affiliate-marketing circles associated with questionable and potentially fraudulent investment campaigns.

We have reached out to Traffic Partner for clarifications regarding their connection to “Los Pollos” and “Ultimate Entreprises Ltd”. Until the time of publishing this article, we have not received a response.

3. AdsEmpire – Detailed Graphics Kft (HU) – Together Networks (MLT)

A large cluster of domains and websites associated to Hungarian Howlogic Kft was also found in the research. Howlogic Kft is notoriously known to operate “subscription traps” in association with “debt collectors” such as Novalnet AG and eCollect AG. We found dozens of public reports where subscribers to their dating websites had difficulties to cancel unexpected bank charges associated to services they were not aware of.

A full list of domains associated to Howlogic Kft is included here. The domains run by Howlogic Kft are promoted by another Hungarian company, namely Detailed Graphics Kft, also known as Adsempire.

According to company registration information, Detailed Graphics Kft is registered in the name of Anastasiia Bilotserkovets (an: Kachalovska Liudmyla) with address in Ukraine (Yuvileinyi Avenue 43a, apartment 71, 9076 Zaporizhzhia).

Adsempire is operated by Ukranians operating dozens of legal entities registered in Hungary. Adsempire is closely linked with Together Networks, a Maltese registered organization accused of operating online dating platforms through which users claim they were misled with fake profiles, unexpected subscription charges, and difficulties obtaining refunds.

Apart from the connection with Howlogic Kft and Together Networks, Adsempire also promotes websites associated to Flashlight Solutions LTD SRL, Izeo Dating Ltd, Idalia Ltd, Apricot Digitals LLC, Ravex Web s. r. o., Neosolut Ltd or Cyberence Kft. All the Hungarian companies are registered at 11 Verebeshegy Street, 2161 Csomád.

Together Networks

Adsempire – Together Networks operate their infrastructure inside of AS196962 in the name of Together Networks Holding Limited, a BVI entity. The infrastructure hosts the backend of hundreds of domain names operating inside of their development platform: Platform Phoenix.

The ASN has been registered in the name of: Easy Date Holdings Ltd, Cupid Plc. EasyDate PLC and now NSI (Holdings) Limited.

NSI Holdings represents the entity that continued the “dating site” portion of the business after Cupid Plc stepped away.

From Cupid to Antheia

Cupid plc was a UK-based online dating company founded in Edinburgh that operated large dating brands such as Cupid.com, BeNaughty, and Flirt.com. It was publicly traded on the London Stock Exchange’s AIM market and claimed tens of millions of users worldwide. However, in 2013, the company became the center of a major scandal when journalists and former staff revealed that Cupid’s dating platforms were populated with fake or staff-managed “engagement” profiles, designed to entice users into paid messaging subscriptions. The backlash led to the resignation of its founder, Max Polyakov, a Ukrainian tech entrepreneur, and forced Cupid to divest its dating businesses in 2014.

Following the scandal, Cupid plc sold all its dating assets Tradax IP Licensing Limited and started to operate the sites with NSI Holdings Ltd, a UK-registered company that later transferred operational control to the Together Networks group. Although the sale appeared to mark a clean break, corporate records and digital forensics suggest that NSI Holdings may have been controlled or influenced by individuals linked to Polyakov’s former business and legal associates, effectively preserving continuity under a new structure.

The current international infrastructure involves NSI Holdings in the UK (now dissolved) and Antheia Services Limited in Cyprus, the latter likely acting as an offshore administrative and financial hub. Meanwhile, Adsempire, an affiliate marketing network, promotes Together Networks’ websites globally. Despite the new branding and ownership layers, we found that the same deceptive practices, including fake profiles and automated user engagement persist within this post-Cupid ecosystem, indicating that the business model and operators behind Cupid never truly disappeared, only rebranded and relocated.

What runs now in Antheia (Cupid 2.0)?

We decided to look into what domain names are associated to Antheia, the infrastructure once run by Cupid Plc and we managed to trace 470 active domain names. Out of the 470 domain names, 184 included a reference to a legal entity operating the dating service. All the sites run the same platform and have been developed using Cupid’s Phoenix infrastructure.

The full list of domain names can be found here. A list of domains with their associated legal entities can be downloaded here.

What did we find?

We did not only find hundreds of websites running the same technology, we also found more than twenty legal entities that run as payment processors for the sites. The vast majority of these payment processors will have a simple webpage developed with Wix pretending to be a web development company. The setup is not very different to the different payment processors that we found when we investigated the “Scam Empire” a cyber-criminal network with focus on investments fraud.

The developers of the portals implemented some creative techniques to make the “Payment processors” less searchable, for example they use “Cyrillic” characters that look visually identical to Latin to write the names of the companies in their website.

4. Mirelia – MediaScythe Ltd (CY)

Finally, we discovered that Los Pollos was promoting yet another cluster of “dating” domain names, this time associated with MediaScythe Ltd, a company registered in the Republic of the Marshall Islands. We were able to link all of these domains to the advertising company Mirelia. A full list of the domains are listed here.

Mirelia advertisement company is associated to Alziator Commercial, a company registered under Cyprus law, registration number HE 385093. We also found links of Mirelia with “shell web development companies” Ornelio and Braelynn Holdings Limited.

The most visible figures of these companies are Andreas Soteriou and Roman Khmelnytskyy.

Conclusion

Since our release, one year ago, about the use of Los Pollos TDS to promote fraudulent “dating services”, we have managed to re-trace back this activity. Despite the renaming of hosting provider, the change of the format of their smartlinks or the new promotion of new pre-landing pages, Los Pollos remains actively engaged with affiliates promoting “dating scams” or “subscriptions traps”.

During this year, we have managed to identify at least four organizations making use of their TDS: Meet Us Media (Nexxie Group), Traffic Partner (Digital Performance), Adsempire (Detailed Graphis Kft/Howlogic Kft) and Mirelia (Alziator Commercial/MediaSchythe).

Our work shows that Adsempire is the front company promoting dating scams associated to Together Networks and NSI Holdings Ltd/Antheia and they are using the very same infrastructure that Cupid Plc run in 2013.

All these entities make extensive use of proxy legal entities to hide who really runs or promote the “scams”. All the affiliate marketers of “dating scams” we have identified are closely connected to the services they promote. Similarly, Los Pollos/Adtrafico TDS is in direct contact with all these affiliates.

A full list of 1000+ domains reviewed during this investigation is available here.

Appendix

The following table summarizes the entities associated to the four cluster of “dating advertisers” making use of Los Pollos TDS.

Further reading

• [Oct 2025], The National, “How pivotal rocket firm Skyrora is linked to tax havens“
• [Sept 2024] Simplicissimus, “Die riesigen Netzwerke hinter Flirt-Bots” — a documentary explaining how Flirt-bots (fake profiles run by humans) work.
• [Jul 2023], Domain Tools, “156. Romancing the Scam” — A podcast explaining in detail the practices of Nexxie.
• [May 2023], Wired, Laura Cole, “This Is Catfishing on an Industrial Scale” (behind paywall) — about Catfishing
• [Oct 2022], Snopes, Alex Kasprak, “The Grift Empire Investigation” — a five parts series with focus on Cupid, Ads Empire and Polyakov