5 March 2025
The methods used to get potential victims on the hook might not look very sophisticated but evidence shows that 1 out of 14 people that register for more information about the investments promoted in the advertisements becomes a victim. This report explains how the scam call centers reach potential victims across the world and quickly turns them in to “depositors”. In the leak we found not less than 32,000 victims.
Keywords: Affiliate Marketing, Advertisement Trackers, Social Media, VoIP providers
The ultimate goal of “the Hunt” phase is to find potential victims and lead them to advertisements, that forwards them to a campaign page for Bitcoin or other investments. In the pages the victims provide their contact details including phone number to the scammers.
This is a concrete example of how the Israel-Europe “Sapphire scam network” gets its victims.

Step 1: Building campaign pages
The “Sapphire network” creates campaign web pages to attract new “leads” (victims) to the investment scams. The campaign web page is simple but with a serious layout with names such as Bitcoin 360 AI, Bitcoin Circuit, Bitcoin Banker, or Bitcoin Bank.
These Campaign pages are hosted with bullet proof hosting providers that protects the identities of the scammers.
More on Bullet proof hosting providers (coming soon)
Step 2: Contracting a Tracker
The “Sapphire Network” contracts a “tracker service” known as “GetLinked” run by Gal Friedman which acts as a broker between “Sapphire” and the advertisers (Affiliates). The tracker service provides information about which kind of “offer” needs to be promoted, its geolocation and to which target group (by language). The tracker links these “offers” to brands and also provides the affiliates with the information of much compensation they can claim for each victim (conversion).
The software that is responsible of managing the affiliate market place for Sapphire Empire is GetLinked.io, developed by the Bulgarian company Perspecta LTD run by Rosen Marinchev.
More on GetLinked (coming soon)
The point of contact of GetLinked with the core backoffice of Sapphire Network is “James Collins” the Chief Marketing Officer (CMO). “James Collins” is the stage name of Ronen Nimrod Kapeika that claims to work for Madar (MDR SOLUTIONS LTD). Ronen was also a member of the ROI Collective (2019-2022), an affiliate network.
Step 3: Inviting Affiliates
Affiliates that are invited to register in the “getlinked tracker platform” are responsible of “generating traffic” to the advertisements, which in practice means “bringing victims to fraudsters”.
In the case of “Sapphire Network” we have found hundreds of affiliates (advertisers) promoting the offers. However, the large majority of the promotion is performed by 20-25 affiliates. Among the affiliates that can be found in the leak, we found ROI Collective, Supremedia and Affilomania-TrafficOn, which Qurium has reported on in previous reports.
More on Affiliates
It is important to understand that the affiliates do not promote the “brands” used by fraudsters but rather use generic names a “Bitcoin Billionaire”, “Quantum AI” etc. as the entry advertisement. The reason to use these generic advertisements is to hide to the general public of what “brands” are used by the call centers. In the case of the “Sapphire Network” we have accounted for 40 brands promoted via a more reduced number of generic baits.
- A list of “baits” used by affiliate markers can be found here
- A list of the brands operated by the Israel “Sapphire Network” can be found here.
- A list of the brands operated by the Georgia “AK Group Network” can be found here.
Getlinked acts like a clearing house providing a “transparent” method to all actors involved that the job of bringing victims to the brands run by the call centers has been performed and that the affiliates are accounted for it so they can claim their compensation.
Step 4: Landing pages in social media
The Affiliates use different techniques to promote the investments. The most common method is paid advertisements in Social Media like Meta-Facebook, Instagram, X and Microsoft MSN.
To attract attention and gain credibility they often use names of celebrities, like Elon Musk, to vouch for their services.
It is also not uncommon that they affiliates buy traffic from third party suppliers as “Los Pollos” or “Taco Loco”. We could also find hundreds of articles driving victims to scams in publishing platforms like Medium.
Other methods to drive traffic to the fraud campaigns are to pay influencers for video promotions, run SMS spam campaigns and buy pop-up advertisements in mobile applications.
Step 5: Victim submits contact details
The victim finds the “investment opportunity” in social media and is re-directed to a site to complete an online application form. In this step the victim provides its contact details including the phone number.
The Tracker (Getlinked) keeps track of which landing page the victim came from and which affiliate brought the victim.
Step 6: The enrollment call
An agent from Sapphire Networks contacts the victim by phone and guides him/her to complete the enrollment process. The process is finalized when a financial transaction of 250 EUR (or the equivalent in the victim’s local currency) is made to the “Sapphire Network”.
The “Sapphire Network” uses different VoIP (voice-over-IP) providers for all outgoing calls and SMS to the victims. The telephony providers provide Voice over IP services to the call centers including the ability to spoof numbers, providing numbers for inbound calls (DIDs) and a smooth integration of their voice services with the customer relationship management (CRM) software run by the investment brands.
These telephony providers are fully aware of the locations where the calls are placed (both outbound and inbound). The data leak provided us with evidence that both the “Sapphire Network” and the “Georgian AK Group Call center” make or have made use of five common VoIP providers for their calls.

More on VoIP providers (coming soon)
Step 7: Financial transaction
The “Sapphire Networks” pays the Affiliate 1000 USD for each victim that they have lured to completed the 250 USD deposit. The Tracker also receives periodical payments for its service.
While “getlinked” is responsible of providing the “job offers” to the advertisers, it is worth noticing that the payment to the affiliates is done from the backoffice of the fraud network.
But how come that an Affiliate is paid four times more than the victim’s deposit? Isn’t that a very good compensation for just bringing a potential victim to the scammers? The reason is simple – the average deposit from any given victim is expected to be not less than 14,000 USD, which gives the scammers a good margin.
The Hunt phase is concluded when the victim’s personal data (via getlinked) is entered into a Customer Relationship Management system (CRM) for a brand and the first deposit of 250 EUR is completed. That is when the next phase starts – the Milking.
Affiliates – brokers or accessories?
The Affiliate market is often questioned, but it is not illegal as such. However, as for any service, the provider has the responsibility to know its clients (KYC) to avoid that they promote criminal activities.
Opposite to what the affiliates in this investigation claim, they are aware that they are actors in an investment fraud. According to the Affiliates they are just “generating traffic” to a certain site, but in reality they are delivering victims to scammers using disinformation and pure lies. Facts that support our claims include:
- The Affiliates use disinformation and impersonation of celebrities to gain attention to the “offer”
- The Affiliates use a cloaking service in social media to hide the true content to the general public.
- The Affiliates receives a compensation of 1000 USD per “lead” which is far over market price
- The Compensation is transferred via Crypto-currency to avoid financial connections with the scammers
In Qurium’s recent investigation “Tell of Spring – Exposing crypto scam affiliate networks” (May 2024), three affiliates connected to organized crime (call centers) were exposed. One of them – TrafficOn/Affilomania – requested two of the authors of the investigation to un-publish the report to avoid a lawsuit. Despite pressure from a Swedish legal representative of Affilomania, Qurium decided to stand by the evidence.
Affiliate Marketing companies from the financial sector (fintech), many of them being in operation for a decade, can easily be found in public conferences organized by Affiliate World Conference (AW), Conversion Club, iGB Live (gambling), or the Affiliate Summit. Many of the affiliates discovered in the leak are sponsors of these conferences.