AN investigation has revealed that infrastructure once used for Russian disinformation campaigns is now being repurposed to promote large-scale dating and cryptocurrency scams through a network of obscure advertising systems and offshore companies.
The investigation, published by Qurium and titled “Catfish Incorporated: How the Dating Scam Industry Works,” revealed that servers linked to the bulletproof hosting provider Aeza, also known as Evilempire or Lethost, were used to host domains tied to both Russia’s Doppelganger disinformation network and fraudulent dating sites.
The traffic from these sites is distributed using a traffic distribution system (TDS) known as Los Pollos, which redirects users through smart links to pre-landing pages that promote various scams.
According to the findings, Los Pollos was also connected to Vextrio, a large ad-tech network used for distributing malicious traffic, scams, and unwanted applications. The overlap suggests that the same infrastructure supporting disinformation campaigns also fuels global online fraud, revealing how digital advertising systems can be manipulated for exploitation.
The research also identified a complex web of intermediaries, including affiliates, black advertisers, and concealed operators who profit from these scams while hiding behind shell companies registered in jurisdictions such as Cyprus, Malta, Hong Kong, and the Marshall Islands. Victims are typically lured through online ads or spam messages to pages branded as Loveme, OnlyOne, or FlirtUp, before being redirected to fraudulent dating services.
“One we had discovered that Los Pollos was a core player in dating scams – distributing traffic between publishers and advertisers – we decided to explore who the Concealed Advertisers were – hiding their legal names behind obscure off-short companies in Hong Kong, Cyprus, Malta, and the Marshall Islands, ” the report stated in part.
Over the past year, researchers identified at least four major organisations using Los Pollos’s infrastructure for dating scams: Meet Us Media (Nexxie Group), Traffic Partner (Digital Performance), Adsempire (Detailed Graphics Kft/Howlogic Kft), and Mirelia (Alziator Commercial/MediaScythe).
At the centre of the operation is the Nexxie Group, a Cyprus-based conglomerate running companies like Meet Us Media Ltd, Redwalking Ltd, Merchsuite Ltd, and Elevven 11 Ltd. One of its branches, VDesk, recruits freelancers to pose as romantic interests and keep victims engaged through fake profiles.
“A fascinating discovery was to see the recent inclusion in the Terms and Conditions of the websites operated by Meet Us Media (Nexxie Group) stating that the company operates fake profiles (flirt bots) designed to enhance the user experience. This disclaimer seems to contradict how these websites are promoted and advertised. A sample list of over 100 domains leading to sites operated by the Nexxie Group is available here” the investigation noted.
Since the initial exposé by Qurium in November 2024 with its “Doppelganger” investigation, Los Pollos has continued operating, moving its infrastructure and rebranding its hosting network under new names, including the Swiss Innovative Arts and Technologies Institute (SIATI).
Investigators say the changes reflect a pattern among cybercriminals who adapt quickly to evade detection while maintaining the same fraudulent activities
Another company identified as part of this ecosystem was Traffic Partner BV / Digital Performance GmbH, operating from the Netherlands and Germany. Researchers linked hundreds of dating and subscription websites associated with Ultimate Enterprises Ltd, a Hong Kong-registered shell company, to Traffic Partner’s infrastructure.
The investigation revealed that the company’s websites share common technical footprints, including hosting within CQ International BV (AS25418), the use of Cloudflare DNS, and registration through InterNetX GmbH, suggesting a unified backend system.
The investigation also identified Adsempire, operated by Hungary’s Detailed Graphics Kft (formerly Howlogic Kft), as a major player in the scam ecosystem. The company, owned by Ukrainians Anastasiia Bilotserkovets and Liudmyla Kachalovska, promotes “subscription trap” dating sites associated with Together Networks, a Malta-based company accused of misleading users with fake profiles and hidden charges.
The infrastructure behind Together Networks traces its roots to Cupid Plc, a former UK-listed dating company that collapsed in 2013 after journalists exposed its use of fake profiles to trick users into paid subscriptions. Though Cupid Plc sold its assets, investigators found continuity between its old infrastructure (codenamed “Phoenix Platform”) and today’s Antheia Services Ltd in Cyprus, which now hosts hundreds of dating domains.
The investigation uncovered 470 active domains connected to Antheia, all running similar designs and backend systems. Many of the payment processors linked to these sites operate under fake identities or use Cyrillic characters to mask their true corporate names.
The final network identified involves Mirelia, an advertising company linked to MediaScythe Ltd, registered in the Marshall Islands. The company is connected to Alziator Commercial Ltd, a Cyprus-based entity associated with Andreas Soteriou and Roman Khmelnytskyy. Mirelia promotes dating sites through Los Pollos and operates a network of shell “web development” firms, such as Ornelio and Braelynn Holdings Ltd, to conceal its ownership.
Despite multiple exposures, Los Pollos and its affiliates continue to operate under new brand names and hosting providers. The company’s infrastructure has migrated from C41.ch (AS6898) to the Swiss Innovative Arts and Technologies Institute (SIATI), reflecting efforts to stay ahead of detection.
The investigation concludes that these entities rely on proxy legal structures to conceal their operators and maintain plausible deniability while profiting from large-scale digital exploitation.
