10 March 2025

One of the main findings of the “Scam Empire” investigation is the understanding how affiliate marketing is being used by the call centers to run celeb-bait ads on social media platforms. To achieve their conversion goals — to turn users into victims — the affiliate marketers often impersonate known newspapers, a technique that we have already documented in connection with the Doppelganger Russian disinformation campaigns, and impersonate celebrities to gain trust.

During 12 months, the “Sapphire Network” operating call centers in Israel, Bulgaria, Cyprus and Ukraine, paid affiliates no less than 11 million USD for bringing victims to their scams. Internal so called “Conversion reports” reveal that the success rate is 7% of all users signing up to the scam.

The affiliates are a crucial building block in the “Scam Empire”. Without their services, the scammers would not have any potential clients to scam. The affiliates are well paid off by the call centers, and their revenue is no less than 10% of what the scammer steal.

The “Scam Empire” leak contains affiliate marketing records that date back to January 2021. An analysis of the transactions associated to marketing services reveal that at least 10% of the money scammed is invested in marketing services run by affiliates.

Thanks to the massive leak of internal documents, phone calls and screen recordings from two large scam call centers in Europe, we are able to present unarguable evidence that the affiliate market industry as a whole, is largely invested in the scam industry, not just only fintech investments, but also gambling, “nutra” and online dating.

This article exposes some of the big players within Affiliate marketing which have direct links to the scam call centers that was exposed last week in a collaboration with 32 media organizations in Europe.

The Big Bash – the meeting place for affiliates

Affiliate World Conferences (AWC) organizes three large meetings each year – in Dubai, Europe and Asia. In parallel to those events a more private “Big Bash” party is organized.

In 2022, the “Big Bash” parties took place in Bangkok, Barcelona and Dubai. These parties were sponsored by affiliates that were working for the scam call centers by sending “leads” (victims) to the “Sapphire Network”. The sponsors included ROI Collective, Qlyxr, MGA Team, Weloveadz, Supremedia, 360 Affiliates, Gladio, Clicks Club and Conversion Masters.

These international conferences for “performance marketing” allow the black affiliate marketers to meet in person and network. At the Affiliate World Dubai 2022, the Big Bash party took place on the Lotus Mega Yacht in Dubai Marina, a five floor high and 240 feet long luxury yacht. The invitation-only event was organized by Raj Tiwari (White Tiger Agency) and Andy (Traffic Partner). Participants to the event were required to fill up an application form which included the question “Are you into Black Hat?”. In digital marketing, “Black Hat” refers to unethical or manipulative tactics.

The Sponsors

One major surprise was to discover that the vast majority of the sponsors (10 out of 13 sponsors) of the event provide leads (victims) to the “Sapphire Network” of the “Scam Empire”. It seems as we have found one of the epicenters of the biggest concentration of scam affiliates – the Big Bash!

10 of 13 sponsors of the Big Bash Dubai event (2022) provide
“leads” (victims) to the Sapphire Network.

The Affiliate Big Bash Asia event in 2022 (Bangkok, Thailand) was sponsored
by many affiliated involved in the Sapphire Network.

Andy Wullmer (aka The Traffic Captain) from Creator Traffic and Ray T. from
White Tiger Agency hosting the 2023 Affiliate Big Bash in Barcelona, Spain.

Meet the people behind the affiliates

Despite that many of the affiliates providing leads to the “Sapphire Network” have been operating for more than a decade, it is not easy to figure out who the key people behind these organizations really are. The majority of the payments between the scam call centers and the affiliates are done in cryptocurrency, and when wire transfers and invoices are required, the affiliates use companies registered in Singapore, Hong Kong and Cyprus as intermediaries not to leave any traces.

The people displayed below represent affiliate marketing companies that have been found in the leaked documents and screen-recordings linking them with the scam call centers as service providers.

Linking the Sapphire Network to the affiliates

In the leak we found “Conversion” and “Lead reports”, crypto and wire transactions and hundreds of conversations between the marketing department (“James” and “Jane”) in the Sapphire Network and the affiliates. In some cases, the affiliates used several different company names to hide their traces but despite the use of different names, the payments arrived to the very same crypto wallets.

GetLinked is the software used to provide offers and track the performance of the affiliate marketers in the “Sapphire Network”. Just like the affiliates, they are fully aware of the call centers’ fraudulent activities.

The Chief Marketing Officer of the Sapphire Network calls himself “James Collins“, but his real name is Ronen Kapeika, and is one of the main point of contacts for the affiliates.

Kapeika’s identity could be revealed thanks to spreadsheets with employee data found on the leak, where “James Collins” was listed as “nickname” of a man named “Ronen.” Additionally, a screen-recording of a Telegram conversation shows a marketing employee asking “James Collins” to approve the sending of “10k” to a crypto wallet, as the message “Approved” is sent from a user called Ronen.

Kapeika’s full name appears both on internal spreadsheets and records of employee pensions. Kapeika, based in Israel according to his LinkedIn profile, used to work as Affiliate Manager at the ROI Collective, one of the affiliates that is working for the “Sapphire Network”.

It is not uncommon to find that the same affiliate marketer works under different organization names or is associated with several networks. During our research we found that Ronen Kapeika, associated with ROI Collective, was accredited as Weloveadz and endorsed Yaniv Khalfon’s Leads Club.

Both Kapeika and ROICollective were contacted with a Request for Reply but chose not to respond.

“Jane Finance”, with real name Vita Bernotaite, works in the Finance Department of Sapphire Networks. She reviews the “Conversion” and “Lead” reports generated by GetLinked, approves the “Conversions” that take place when victims make the first deposit (FTD) and organizes payments to affiliates.

The spreadsheet below shows how two of the leads brought by the affiliate “All Star” have been converted in valid “victims” (they made a first deposit of 250 USD). The compensation is roughly 1,000 USD per victim, but differs depending on the country (expected financial capacity). The affiliate receive 1,350 USD for a Canadian victim and 1,250 USD for a Spanish victim.

“Jane Finance” from LionBrands approves kick-back payments to the affiliate All Star.

Invoice from Ukrainian All Star Media to “Vector Financial Services Ltd” in Cape Town, South Africa for “marketing services” for providing leads (victims).

The Affiliates

The following table contains a list of some of the most active affiliates found in the Israel-Europe “Sapphire Network”. Some of these affiliates as OTB ALGO Limited, Oray or Affilomania also provided leads to the “AK Group Network” in Georgia.

The reincidents

Qurium reported already in 2024 that financial scams were taking place using GetLinked tracking software. Three affiliates based in Cyprus and Israel, TrafficOn, SupremeMedia and ROI Collective, were informed of the evidence but choose to ignore or deny our accusations.

Gal Friedman from GetLinked responded that they have no obligations to know how their software is being used, and those responsible should be the social media platforms that allow such scam advertisements.

---

GetLinked.io with headquarters in Cyprus, run by Gal Friedman and Ziv Fradkin. The company provides a CRM system for affiliates. Affiliates of the investments scams learn about the campaigns and offers using their platform and getLinked keeps track of the conversions and pushes victim information to the fraudsters brands dashboards by means of an API.

The platform operated at least the domains kargis-api[.]com and srbmarketingrp-api[.]com in connection with the scams.

---

Perspecta LTD – Software developer of the affiliate marketing platform GetLinked.io, based in Bulgaria (Veliko Tarnovo).

The director is Rosen Marinchev and Quality Assurance software engineer Ivaylo Stefanov provisioned the platform.

---

TrafficOn is an affiliate network that has been active since 2014, specialized in online gambling, betting and trading mainly in the verticals of Casinos, Sportsbook, Forex and Crypto.

---

TrafficOn is associated to Affilomania Ltd and other brands like Proftit. In the past they operated as Boaelite. The company provides leads via the affiliate CRM GetLinked.io

---

Supreme Media (trading as Amashen) is a Cypriot company run by Benjamin (“Ben”) Rose, Guillaume Meex (Lilo Lior) and Louka van der Wolf.

Despina Zenonos is responsible for recruitment including staffing of call centers. Rotem Sivan (Media 500/SupremeCod)

Supreme Media was launched and rebranded from Media500 in 2018 and currently operates in several verticals including Crypto, Casino and Nutra. Supreme Media runs supremecode{.}com. The company provides leads via the affiliate CRM GetLinked.io

---

ROI Collective – an affiliate network that recently rebranded as Organic Media (Tech) Solutions. The company is run by Moshe (Hiko) Rajczyk since 2016. Moshe Rajczyk is the founder of Yomora 4Media, a business based in Cyprus that offers financial and legal services for the affiliate marketing, online gaming and Fintech industries. According to the Cyprus business registry, Moshe Rajczyk is the director of ROI Play LTD, some of the brands used by ROI-Collective includes mr{.}click and roiplay{.}com.

People working for ROI Collective include: Lisa Avsiyan (Summer), Matt Aizen (now at Organic), Itamar Alexander, Yossi Elmliach , Omer Hen, Shai Nehaisi, Eleni Iakovou (Yamora) and Ben Rajcyk. The Chief Manager of the “Sapphire Network” was Ronen Kapeika from ROI Collective. The company provides leads via the affiliate CRM GetLinked.io. Eric Cladel is currently their head of affiliates.