Celebrity-Impersonation Romance Ads and the Telegram Pivot

Since mid-May 2026, disposable Facebook profiles impersonating celebrities and lonely singles have been running romance ads that steer targets to Telegram. The ads are the visible front end of a romance and pig-butchering funnel. The Facebook creative supplies the bait, while the grooming takes place later in an encrypted chat that the ad platform never sees. We tracked a cluster of more than 30 numeric-ID burner profiles across three persona tiers: impersonations of country artist Riley Green, impersonations of actress Emma Watson, and generic lonely-single personas that openly solicit men aged 30 to 70. Every profile leads to the same handful of off-platform destinations. One aged operator-owned domain also runs an affiliate love-spell quiz as a parallel source of revenue.

Key Takeaways

• Celebrity impersonations and generic romance personas use the same infrastructure pattern: numeric-ID burner profiles, single-ad burn economics, and an immediate move to Telegram, WhatsApp, or Zangi.
• The move is the point. Once a target enters an encrypted messenger, the conversation leaves every observing platform, and the crypto-investment or gift-card request happens out of view.
• Telegram handles encode the impersonated persona as the celebrity name plus a suffix or number, making the handle-naming template a stronger correlator than any single profile ID.
• One operator-owned domain hosts an astrology love-spell quiz that ends in a ClickBank affiliate hoplink. This durable monetization layer predates the celebrity-romance burst by months.
• Handle obfuscation uses character homoglyphs, including a capital letter O in place of a zero, to frustrate exact-string matching.

Background

Romance fraud and its investment-fraud successor, commonly called pig-butchering, begin the same way: a stranger forms an emotional relationship and then turns that trust into money. These operations are now industrialized. Meta reported removing more than 2 million accounts in 2024 tied to organized scam centers across Southeast Asia and the Gulf that operate at scale. In its 2024 annual report, the FBI Internet Crime Complaint Center attributed 672 million dollars in reported losses to confidence and romance fraud, as well as a further 5.8 billion dollars to crypto-investment fraud of the pig-butchering type. The US Federal Trade Commission's 2024 data reported hundreds of millions of dollars in romance-scam losses, on top of nearly 3 billion dollars in imposter-scam losses overall. These figures come from separate datasets and years. They should be read separately rather than summed, but together they describe a growing category.

This cluster uses Facebook ads as its on-ramp. Instead of cold-messaging targets, the operator buys sponsored reach and relies on the platform's own ad delivery to find receptive audiences, then moves each conversation off-platform as quickly as possible. State consumer advisories through 2025 flagged a parallel rise in celebrity-impersonation romance scams specifically. Fake profiles use a public figure's name and images to attract that person's fans before professing love and asking for money. This cluster uses exactly that method alongside generic lonely-single personas.

Several parts of the funnel use legitimate services that the operator abuses but does not own:

• Telegram provides public t[.]me/<handle> deep-links that open a chat with a username without requiring either party to exchange a phone number. It is the main off-platform destination because the conversation is outside ad review and content moderation, with no history available to the originating platform.
• WhatsApp click-to-chat links (wa[.]me and api.whatsapp[.]com/send) open a pre-addressed conversation with one tap. Scammers place them on link-in-bio pages so the transition passes through a neutral intermediary rather than displaying a raw number in the ad creative.
• Zangi is a privacy-focused messenger that works without a SIM card and has little independent abuse-reporting infrastructure. Operators use it as a fallback when mainstream apps begin banning their accounts. A request to "move to Zangi" is also a documented impersonation-scam signal.
• URL shorteners cutt[.]ly and shorter[.]me conceal the destination behind an opaque slug, insert a redirect hop that hides the endpoint from static ad review, and allow the operator to change the target after approval.
• bybio[.]co is a link-in-bio service that hosts a single hub page containing multiple outbound links behind a neutral-looking domain. It can route users from one profile to several messengers at once.
• ClickBank affiliate hoplinks, carried in a hopId parameter, credit a sale to an affiliate for commission. An astrology or love-spell quiz page acts as the lead-gen on-ramp: it primes an emotionally receptive audience and sends it through the hoplink to a paid offer. This monetization layer can operate alongside the romance funnel.

Discovery and Infrastructure

We found the cluster through AI romance and imposter scoring on Facebook sponsored ads. Volume-based hunting misses this class because each burner profile runs a single creative before going dormant, leaving no per-profile volume on which to set a threshold. Filtering by the romance and imposter content family, with no volume floor, isolated the group cleanly.

The profiles fall into three persona tiers. The celebrity tiers impersonate country artist Riley Green and actress Emma Watson, relying on the parasocial trust that fans already place in a public figure. The third tier poses as a generic lonely single woman and openly identifies its target demographic: men aged 30 to 70. All three tiers use the same off-platform stack. Continued hunting since the initial discovery has raised the verified-malicious set past 50 profiles as the operator creates new burners, while the three persona tiers and the pivot stack have remained constant.

Indicator	Role	Notes
zodiaclovespell[.]com	Operator lead-gen domain	Squarespace registration, created August 2024, aged love-spell quiz on-ramp
t[.]me handles	Off-platform pivot	Persona-keyed families, celebrity name plus suffix or number
cutt[.]ly, shorter[.]me	Redirect shorteners	Obscure the pivot destination from inspection
bybio[.]co	Link-in-bio hub	Fans a single profile out to WhatsApp and Telegram
wa[.]me, api.whatsapp[.]com	WhatsApp pivot	Official click-to-chat deep links
Zangi	Encrypted-messenger pivot	SIM-less fallback messenger advertised alongside Telegram

Only one domain in the funnel was built by the operator rather than supplied by an abused platform. zodiaclovespell[.]com is registered through Squarespace to a non-brand shell entity and hosts a ClickBank affiliate quiz instead of a real astrology brand. It is the cluster's only operator-owned infrastructure.

How It Works

A representative contact chain consists of four moves. First, a numeric-ID burner profile places a sponsored ad in users' feeds. Second, the creative begins with an affectionate script, either a celebrity confessing love to a fan or a lonely single reaching out. Third, the ad directs the target to a pivot link, usually a Telegram handle, though sometimes to a WhatsApp or Zangi endpoint reached through a bio-link page or shortener hop. Fourth, after the target enters the encrypted chat, relationship grooming begins. The eventual financial request, typically a crypto-investment pitch, occurs entirely outside the view of any observing platform.

The celebrity tier adds a defensive tactic. The opener anticipates the target's suspicion by claiming that other accounts with the same name are the imposters and that this account belongs to the real person. This inoculation script redirects the victim's natural skepticism toward competing scam accounts rather than the scam itself.

A second, older route operates in parallel. The same operator advertises an astrology love-spell quiz on zodiaclovespell[.]com. Its copy targets women who are anxious about a man who has pulled away and promises a spell that will make him "start texting you out of the blue." The quiz has been advertised since at least January 2026, months before the celebrity-romance burst, and sends visitors through a ClickBank affiliate hoplink. The romance-persona ads and the quiz use the same disposable-profile delivery model but generate money differently: one grooms targets toward a direct financial request, while the other collects emotionally primed leads for an affiliate commission.

Sample Lures

All samples below are attacker-side ad copy captured from the cluster. Recipient and operator contact identifiers have been redacted, emoji are described in brackets, and destinations are defanged.

This celebrity impersonation includes an inoculation script that instructs the target to block "the imposters":

[Facebook sponsored ad, impersonating a country music artist]
My love... if you see this, please stop and listen to me. I didn't
walk away from you. I didn't leave you. I lost you, to people
pretending to be me. I've been trying so hard to reach you, but they
got in between us. Imposters. Lies. Confusion. And it's tearing me
apart. [row of pointing-down emojis]
https[:]//t[.]me/Riley_Green552
Please baby, if someone is chatting with you right now saying they're
me, block them. It's not me. I'm here... this is me. The real me.
Broken. Crying. Praying you see this.

This celebrity impersonation assumes a prior relationship and uses a handle that replaces a zero with a capital letter O:

[Facebook sponsored ad, impersonating a film actress]
Hey love [heart emoji] I've been thinking about us nonstop, and I have
to admit, I'm really hurt and confused about why you blocked me. I know
we haven't been perfect, but I thought our connection was strong enough
to overcome any bumps. I've been feeling lost without you, and I really
need your presence in my life.
Click on the telegram link below to chat me on telegram
[row of pointing-down emojis]
https[:]//t[.]me/emmawatsonofficialO1

This generic lonely-single persona advertises two encrypted messengers in one creative:

[Facebook sponsored ad, generic lonely-single persona]
CLICK HERE ON MY TELEGRAM OR ZANGI [row of pointing-down emojis]
Telegram here
[operator Telegram handle redacted]
Zangi [operator ID redacted]
Hi, my love. [heart emoji] Not just a casual hello, but the kind that
carries all the weight of how much I've been thinking about you,
missing you, and wanting you right here next to me...

The parallel affiliate on-ramp is an astrology love-spell quiz that sends users to the operator-owned domain:

[Facebook sponsored ad, astrology love-spell affiliate quiz]
When a man pulls away... don't send him those "magic texts"...
cast this love spell instead...
It's not about what you did wrong... it's about what he feels he's
missing... That's where this love spell comes in...
He'll start texting you out of the blue... apologizing for pulling
away...
https[:]//zodiaclovespell[.]com/zlsvr-quiz-man-sign-cb

A sibling creative for the same quiz used the headline "Forbidden spell triggers his obsession after he ghosts you."

Technical Analysis

Numeric-ID Burner Profiles and Single-Ad Burn Economics

Every profile in the cluster uses a bare numeric ID rather than a vanity name and has neither an established page history nor an organic posting cadence. Each profile runs one creative, or very few, before going dormant or being removed. This produces a high ratio of profiles to ads, the opposite of a legitimate advertiser that maintains spending through a small number of managed pages. The cluster also contains two account-ID generations: long legacy numeric IDs and the newer, shorter 61...-prefixed account format. This mix suggests that the operator obtains burner accounts from more than one creation batch or supplier rather than creating them all at once.

Persona-Keyed Handle Families and Homoglyph Evasion

The Telegram handles provide the durable fingerprint. Each handle encodes the impersonated persona and changes only by suffix, so the naming template persists after individual profiles rotate out. Grouping by the template instead of any single handle connects burner profiles that would otherwise appear unrelated.

Persona tier	Representative pivot endpoints (defanged)
Riley Green impersonation	t[.]me/Riley_Green552, t[.]me/Rileygreen499, t[.]me/rileygreenofficial_886, t[.]me/RileyGreenRealAccountTG
Emma Watson impersonation	t[.]me/emmawatsonofficialO1 (capital O for zero), t[.]me/Emma_watson2199, t[.]me/officialemmawatson_926
Generic lonely-single	t[.]me/privatechat74784, cutt[.]ly and shorter[.]me hops, bybio[.]co/Whatsappdatingchatmee

The emmawatsonofficialO1 handle uses an uppercase letter O instead of the digit zero. This type of character homoglyph, combined with inconsistent casing, underscores, and appended numbers, defeats naive exact-match blocklists and requires defenders to use normalized or fuzzy handle matching.

The Off-Platform Pivot Stack

The cluster uses more than one messenger. Telegram is the main destination, but individual creatives also advertise WhatsApp through bybio[.]co bio-link pages and Zangi as an encrypted fallback. Some pass through cutt[.]ly or shorter[.]me before reaching the destination. Advertising two messengers in one ad, as the generic-persona sample does, gives the operator redundancy if one platform bans its accounts. Speed is the shared feature: the first creative and first message contain the pivot link, while legitimate advertising keeps conversion on-platform or on an owned domain.

Registration and Staging Cohorts

The cluster has two staging cohorts, with sharply different aging patterns.

Layer	Indicator	Registration / creation	Role
Aged affiliate on-ramp	zodiaclovespell[.]com	Squarespace Domains, created 2024-08-18	ClickBank love-spell quiz lead-gen, advertised since at least January 2026
Disposable romance burst	30-plus numeric-ID profiles	Platform-hosted, no domain footprint	Single-ad burn, active from mid-May 2026 onward

The affiliate quiz domain is the patient, reusable asset. It was aged well before use, WHOIS-registered to a non-brand shell, and advertised quietly for months. The romance-persona profiles are disposable, created in bulk and burned for individual campaigns. A defender watching only the rapidly rotating profiles will overlook the stable domain that funds part of the operation. Watching only the domain creates the reverse problem.

The Affiliate-Quiz On-Ramp

The live quiz page includes a ClickBank hoplink structure in its query string, along with affiliate tracking parameters and a generic disclaimer that any brand names shown are "for identification purposes only." This structure indicates a reusable affiliate funnel rather than a genuine astrology product. Its use across otherwise unrelated profiles points to a shared monetization kit. The quiz targets the same emotional state as the romance ads: anxiety about a partner who has withdrawn. This allows one audience to supply both revenue paths.

Detection Observations

The traffic differs from legitimate advertising through a combination of behavioral signals rather than one attribute. A numeric-ID advertiser with no page tenure, one creative per profile, and heart-and-rose emoji density well above normal ad copy provides individually weak but jointly distinctive signals. The strongest signal is the off-platform pivot: a first-contact creative that directs users to a t[.]me, wa[.]me, or Zangi endpoint, often through a bio-link hub or shortener hop, behaves unlike most legitimate advertising. The persona-keyed handle template is the most useful cross-profile correlator because it remains stable as profile IDs rotate and persists through homoglyph substitution after handle normalization. The affiliate quiz funnel, identified by its ClickBank hoplink structure, connects the revenue layer to the same operator. The difficult part is looking beyond the ad. The actual harm takes place in an encrypted conversation that no platform observes, making the ad stage the practical point for intervention.

Indicators of Compromise

All indicators are defanged. Victim data has been removed. The lists contain a representative subset of the verified-malicious set.

Facebook Profiles (numeric-ID burners)

Value	Persona tier	Notes
61590445505557	Riley Green	Numeric-ID burner
1295898402250618	Riley Green	Numeric-ID burner
1513648460255445	Riley Green	Numeric-ID burner
991587220292427	Riley Green	Numeric-ID burner
1034353518921690	Emma Watson	Numeric-ID burner
1525462705649059	Emma Watson	Numeric-ID burner
963942089607873	Emma Watson	Numeric-ID burner
2120106351890355	Emma Watson	Numeric-ID burner
61589973567889	Generic single	Numeric-ID burner
1000047185848486	Generic single	Numeric-ID burner
27849166774690693	Generic single	Telegram and Zangi
61552642935652	Generic single	Zodiac love-spell quiz
representative subset		50+ verified-malicious Facebook profiles

Domains

Value	Role	Notes
zodiaclovespell[.]com	Operator lead-gen	Squarespace, created August 2024, ClickBank affiliate quiz

URLs and Pivot Resources

Value	Role	Notes
https[:]//t[.]me/Riley_Green552	Telegram pivot	Riley Green persona
https[:]//t[.]me/Rileygreen499	Telegram pivot	Riley Green persona
https[:]//t[.]me/rileygreenofficial_886	Telegram pivot	Riley Green persona
https[:]//t[.]me/RileyGreenRealAccountTG	Telegram pivot	Riley Green persona
https[:]//t[.]me/RileyGreenRealTGA	Telegram pivot	Riley Green persona
https[:]//t[.]me/emmawatsonofficialO1	Telegram pivot	Emma Watson persona, capital O for zero
https[:]//t[.]me/Emma_watson2199	Telegram pivot	Emma Watson persona
https[:]//t[.]me/officialemmawatson_926	Telegram pivot	Emma Watson persona
https[:]//t[.]me/EmmaWatso578	Telegram pivot	Emma Watson persona
https[:]//t[.]me/privatechat74784	Telegram pivot	Generic persona
https[:]//cutt[.]ly/ut2mh1td	Shortener pivot	Redirect to messenger
https[:]//shorter[.]me/FOrrR	Shortener pivot	Redirect to messenger
https[:]//bybio[.]co/Whatsappdatingchatmee	Bio-link hub	WhatsApp pivot
https[:]//zodiaclovespell[.]com/zlsvr-quiz-man-sign-cb	Quiz on-ramp	Affiliate lead-gen lander
representative subset		dozens of verified-malicious pivot resources

MITRE Fight Fraud Framework Mapping

The mapping below aligns with the MITRE Fight Fraud Framework (F3) v1.1, https://ctid.mitre.org/fraud. F3 focuses on account-takeover and payment fraud, so several social-engineering behaviors in this campaign lack a dedicated F3 technique. They are cross-mapped to the nearest enterprise ATT&CK technique and marked as best-fit. Two behaviors have no reasonable mapping and appear as framework gaps.

Behavior	Tactic	Technique (best-fit)	ID
Establish persona and advertiser accounts	Resource Development	Establish Accounts	T1585
Stage impersonation pages and quiz landers	Resource Development	Stage Capabilities	T1608
Celebrity and persona impersonation	Initial Access	Impersonation (best-fit)	T1656
Affectionate romance opener	Initial Access	Phishing lure, multi-channel social engineering	T1660
Off-platform migration to Telegram, WhatsApp, Zangi	Execution	No dedicated F3 technique	framework gap
Shortener and bio-link redirect obfuscation	Stealth	Stage Capabilities, redirect infrastructure (best-fit)	T1608
"Block the imposters, this is the real me" inoculation	Defense Impairment	No dedicated F3 technique	framework gap

Conclusion

The profiles are disposable by design. The persistent infrastructure consists of two elements: a handle-naming template that encodes the impersonated persona and an aged affiliate-quiz domain that supports a second revenue path. Defenders can follow those durable signals as burner profiles rotate and treat a first-contact move to an encrypted messenger as the relevant behavior. The economics encourage the operator to buy ads in bulk, but that stage is also the last point at which a platform can observe the scam before it moves into a private chat.