Mystery box subscription-trap network (Limassol/Cyprus cluster)

This network runs 200+ near-identical, Facebook-advertised storefronts dangling a "mystery box" of premium or sold-out goods for as little as $2-3, allegedly worth $500-$1,000. At checkout a tiny-font clause silently enrolls the buyer in a recurring subscription -- for example a 2-euro three-day trial that flips to about 67 euro a month, or an account top-up of 44 euro every 14 days -- while nothing of value ever ships. Bitdefender traced the shared design, AI chat agents and registration data to a single Limassol, Cyprus address that also surfaces in the ICIJ Offshore Leaks database (linked to the Paradise Papers leak), suggesting a shared operation behind the storefronts (Bitdefender cautions a direct link to each shop is hard to prove). Its Meta ads reached roughly 1.5 million people in Romania alone, with further campaigns across Australia, France, Switzerland, Canada, Sweden and Germany, and the real objective is harvesting shoppers' credit-card data.

Subscription trap

“A cheap "mystery box" is the bait -- the fine print signs you up for a recurring charge and hands your card details to a Cyprus-linked fraud ring, while nothing worth having ever arrives.”

Our opinion, based on the public evidence below, as of 20 Jul 2026. How we work & right of reply →

The evidence — every signal, shown

Identity & legitimacy

200+ sites, one Cyprus address
Bitdefender linked more than 200 near-identical storefronts to a single contact address, Andrea Kalvou 13, 3085 Limassol, which also appears in a Cypriot record in the ICIJ Offshore Leaks database associated with the Paradise Papers leak, suggesting a shared operation rather than isolated shops.
Named brands are victims, not sellers
Amazon, Apple, Sephora, Samsung, Dyson and JBL (plus regional retailers such as Emag, Altex and Kaufland) are impersonated as bait; they are victims of the impersonation and have no connection to the scam network.

Payment

Hidden fine-print subscription trap
A tiny-font clause added just before payment silently converts the cheap purchase into a recurring charge, such as a 2-euro three-day trial that becomes about 67 euro per month, or an account top-up of 44 euro every 14 days.
Real goal: stealing card data
Infosecurity Magazine, citing Bitdefender, reports the campaign is designed to trick people into monthly subscriptions and to harvest their credit-card data, with forms collecting personal and financial information before any payment is taken.

Dropship & impersonation

Nothing of value ships
Boxes are advertised as holding $500-$1,000 of Apple, Samsung, Dyson and JBL goods for roughly $2-3 with a 'guaranteed 30-day return policy,' but nothing of value ever arrives.

Ad behavior

Pushed via Facebook/Meta paid ads
The stores are promoted through Meta sponsored ads and fake or repurposed Facebook Pages active since November 2023, with campaigns reaching about 1.5 million people in Romania and 500,000+ more across Australia, France, Switzerland, Canada, Sweden and Germany.
Built to dodge ad review
The sites use user-agent checks to display only on Android or iPhone devices and rotate multiple ad versions (including cropped images and off-platform image hosting) so automated moderation misses the malicious version.

Sources

Reader reports — verified purchases only

Every report below came with an order confirmation or receipt we checked by hand. This is separate from our editorial verdict above — testimony from real buyers, not a star-rating that anyone can botch or buy.

Been burned by Mystery box subscription-trap network (Limassol/Cyprus cluster)?

File a report with proof of purchase. We verify it, then it stands here as evidence for the next person who checks this ad.

This verdict is our opinion, based on the public evidence shown above, as of the date published. If you represent this company and believe something here is wrong, we want to hear it — request a correction.