The Privacy Empire

I. The Crossrider Origins

In 2011, two Israelis founded Crossrider — Smueli Achdut and Koby Menachemi, the latter an alumnus of Unit 8200, Israel's signals intelligence directorate. The company built an SDK for browser extension deployment. The pitch: easy monetization for developers through advertising integration.

The reality was different. Wikipedia documents it directly: Crossrider's services "became increasingly utilized by malware and adware developers." The SDK enabled man-in-the-browser attacks — code that intercepted web traffic, injected advertisements, replaced existing ads with its own, and modified browser behavior. This wasn't a side effect. This was the business model. The SDK was specifically designed to sit between the user and the internet and modify what the user saw.

This is the technology: traffic interception at the browser level.

By 2014, security researchers were documenting Crossrider-powered adware campaigns across millions of devices. Browser extensions built on the Crossrider SDK were flagged by antivirus vendors worldwide. The company that exists today as the world's largest VPN conglomerate started by building the exact thing VPNs are supposed to protect against.

Remember these capabilities. Every one of them requires the same technical skill that makes a VPN work: the ability to position code between the user and the internet. The difference between adware and a VPN is intent, not capability. And intent is invisible.

II. The Billionaire

In 2012, Teddy Sagi acquired Crossrider for $37 million.

Sagi is an Israeli billionaire whose biography reads like a character study in regulatory arbitrage. Born 1971 in Tel Aviv. Convicted of fraud and bribery in 1996 — sentenced to nine months in prison, served five. This is the foundational fact. The man who now controls what millions of VPN users consider "private" is a convicted criminal.

The biography accelerates from there. Sagi founded Playtech in 1999 — online gambling software, IPO on the London Stock Exchange in 2006 at a valuation of approximately £550 million. Then SafeCharge International — payment processing, primarily for the online gambling industry. Sold to Nuvei Corporation for $889 million in 2019.

Notice the pattern: gambling software, payment processing for gambling, then adware. Three industries that share a common requirement — the ability to operate across jurisdictions while minimizing regulatory scrutiny.

In 2009, Sagi obtained Cypriot citizenship through the country's "golden visa" scheme, acquiring an EU passport. Based between London and Dubai — two jurisdictions chosen for their specific regulatory characteristics. He owns Camden Market in London (acquired for £490 million in 2014), the most expensive home in Israel in Herzliya Pituah (purchased from former Prime Minister Ehud Barak), two penthouses, an apartment in Tel Aviv's Tzameret Towers, and properties in Knightsbridge and Dubai.

In March 2021, Sagi survived an assassination attempt in Cyprus, after being warned by local authorities. He immediately fled the country.

This is the person who controls four of the world's most popular VPN services. A convicted fraudster with gambling, payment processing, and adware in his portfolio, who holds citizenship in Israel and Cyprus, resides between London and Dubai, survived an assassination attempt, and is worth $7.1 billion.

His latest venture: Winvia Entertainment PLC, a lottery and gaming operator, floated on London's AIM in November 2025 at a £205 million valuation.

III. The Metamorphosis

In 2018, Crossrider renamed itself Kape Technologies. The rebranding was total — new name, new website, new mission statement. The man-in-the-browser adware company became a "digital privacy and security" company. The SDK that intercepted traffic to inject ads was replaced by VPN technology that intercepted traffic to encrypt it.

The technical capability is identical. The marketing is opposite.

The metamorphosis is not a redemption story. It's a capability pivot. An adware company that masters traffic interception discovers that the same technology can be marketed as privacy protection — if you change the name and buy enough VPN brands. The technical DNA doesn't change. The PR does.

The development center remained at Azrieli Sarona Tower, Tel Aviv. The same engineers. The same office. Different product label.

IV. Project Raven's CIO

In September 2021 — the same month Kape announced its $936 million acquisition of ExpressVPN — a separate news story broke. Daniel Gericke, ExpressVPN's Chief Information Officer, paid a $335,000 fine to the United States Department of Justice.

The charge: conducting hacking operations on behalf of the United Arab Emirates government without a valid US export license.

This was not a peripheral involvement. Gericke was part of Project Raven — a clandestine UAE government operation that used former US intelligence operatives to hack into the accounts and devices of journalists, activists, dissidents, and foreign government officials. The operation targeted individuals that the UAE government considered threats. The tools used were offensive cyber weapons. The targets were people who had done nothing wrong except express opinions that a monarchy didn't want expressed.

Read that timeline again. Kape announced its acquisition of ExpressVPN one day before the DOJ announced Gericke's fine. ExpressVPN knew. Kape knew. The acquisition proceeded. The CIO — the person responsible for information security architecture — was a man who had been hacking activists and journalists for an authoritarian government.

ExpressVPN's response was remarkable: they said they were aware of Gericke's past and that "his experience... has been invaluable." The company that promises to protect your privacy from surveillance hired, and retained, a man who conducted surveillance for a dictatorship.

This is not hypocrisy. This is architecture. The person who knows how surveillance works is exactly the person you want building your "privacy" product — if your actual goal is to know what's technically possible while appearing to prevent it.

V. The Acquisition Machine

Between 2017 and 2021, Kape Technologies executed one of the most aggressive acquisition campaigns in cybersecurity history. The spending trajectory reveals the strategy:

The total spending: approximately $1.05 billion on VPN acquisitions alone. The exit valuation: $1.6 billion. The return: every VPN user who trusts these four brands is now trusting a single entity — one with adware origins, a convicted founder, and a government-hacker CIO.

The market context: the global VPN market was valued at $44.6 billion in 2024 and is projected to reach $134.35 billion by 2032 (Fortune Business Insights). Approximately 1.75 billion users worldwide use VPN services. Kape's four brands collectively represent a significant portion of the premium consumer VPN market.

VI. Capturing the Reviews

This is the part of the Kape story that transforms a corporate acquisition spree into a structural integrity problem for the entire VPN industry.

In 2021, Kape acquired Webselenese Ltd, an Israeli company that operates two of the internet's most visited VPN review websites: vpnMentor and Wizcase. These are not small blogs. They are primary information sources that millions of consumers consult before choosing a VPN provider.

Before the Webselenese acquisition, a consumer researching VPNs might visit vpnMentor, see ExpressVPN ranked #1, visit Wizcase for a second opinion, see CyberGhost in the top 3, and conclude that independent reviewers agreed. After the acquisition, both review sites and all four reviewed products are owned by the same entity.

Both vpnMentor and Wizcase now include disclosure notices about Kape ownership. But disclosures are buried in footers, and most users don't scroll to the bottom of a recommendation before clicking "Buy Now." The structural problem isn't solvable by disclosure — the conflict is architectural.

In a $134 billion market, controlling both the product and the recommendation engine is worth more than the products alone. It's the difference between selling cars and owning both the car dealership and Consumer Reports.

VII. Going Dark

In May 2023, Kape Technologies was delisted from the London Stock Exchange. The delisting was executed by Unikmind Holdings Limited, a company owned by Teddy Sagi, in a transaction valuing Kape at approximately $1.6 billion.

This is the privacy equivalent of a surveillance company going dark.

When Kape was publicly listed on the LSE, it was subject to:

• Annual reports — detailed financial disclosures
• Shareholder scrutiny — public investors asking questions
• Regulatory filings — material event disclosures
• Executive compensation transparency
• Audit requirements — independent verification
• Market analyst coverage — external oversight

After going private: none of that.

A company that controls four major VPN services — tools that millions of people use specifically to protect their privacy — now has zero obligation to publicly disclose how it handles user data, what changes it makes to its infrastructure, who has access to its systems, or how it complies with law enforcement requests.

The irony is structural: users choose VPNs to be private from surveillance. The company providing that privacy has made itself private from oversight. Both use opacity as a feature. The question is whose opacity serves whom.

VIII. The Infrastructure Trail

Where does Kape's VPN traffic actually flow? Our honeypot database reveals two key infrastructure providers that serve as the physical backbone of the "privacy empire."

Datacamp Limited (AS212238 / CDNEXT)

Datacamp Limited, registered in the United Kingdom, operates AS212238 under the name CDNEXT. This is the primary infrastructure for Kape's CyberGhost VPN. Our honeypot tracks 20+ IPs on Datacamp infrastructure, with the highest threat score reaching 86.

Datacamp operates under at least five different RDAP identities: Datacamp Limited, LogicWeb Inc, Internet Utilities NA LLC, Netprotect, and mnt-ro-digital-june-1. This name-layering mirrors the Kamatera pattern documented in 034B: one company, multiple registry names, different jurisdictions.

M247 Europe SRL (AS9009)

M247, a Romanian hosting company, provides backbone infrastructure for VPN providers including Kape brands. Our honeypot data on M247 is extensive and damning:

All twenty M247 IPs are at abuse_score=100. The 185.255.100.x subnet alone shows 11 IPs with 109 total honeypot hits. Every single one is registered as "US" in RDAP records — but M247 is a Romanian company. This is the same virtual-location fraud documented extensively in our investigation TI-2026-023D: The Trust Chain.

Critically: the NordVPN breach of 2018 also occurred on M247 infrastructure — an undisclosed iLO/IPMI remote management system that the hosting provider left exposed. VPN providers rent infrastructure from M247. M247 maintains physical access and management interfaces. The VPN "no-logs" promise covers only the VPN application — not the underlying hosting infrastructure.

This is the fundamental infrastructure problem of commercial VPNs: you can delete your logs, but your hosting provider has physical access to the hardware your traffic flows through.

IX. The No-Logs Paradox

The VPN industry's central promise — "we don't keep logs" — has been tested multiple times. The results are illuminating:

ExpressVPN and PIA — both now Kape subsidiaries — have the strongest no-logs track records in the industry. This is genuine. The Turkish authorities actually could not find logs on the ExpressVPN server seized during the investigation of the Russian ambassador's assassination. PIA actually could not produce logs in two federal cases.

But here's the paradox:

1. These verifications occurred when the companies were independently operated — before Kape acquisition
2. ExpressVPN had a DNS leak bug for nearly two years (May 2022 – February 2024) that exposed visited domains
3. After going private in 2023, there is no mechanism for independent verification
4. The company's CIO was fined for government hacking
5. The company's owner was convicted of fraud

No-logs claims are not like mathematical proofs. They cannot be verified from outside. They depend entirely on trust in the entity making the claim. And the entity making these claims is:

• An adware company that intercepted browser traffic (Crossrider)
• Owned by a convicted fraudster (Sagi)
• Co-founded by military intelligence (Menachemi/Unit 8200)
• Led by a government hacker (Gericke/Project Raven)
• Now privately held with zero transparency obligations

This is not an accusation that Kape keeps logs. This is the observation that there is no way to know, and every institutional indicator suggests "trust but verify" has been reduced to "trust."

X. The Invisible Pattern

Kape Technologies completes the pattern documented across this 034 series. In 034A, we measured Israel's statistical absence from global threat intelligence databases — 7 IPs, 0 honeypot hits from a nation of 10 million with the world's highest per-capita cyber capability. In 034B, we traced how Israeli-founded and Israeli-operated infrastructure registers everywhere except Israel — Kamatera (US/NL/FR), Pfcloud/Mishayev (DE/SC/LU/TR), never Israel.

Kape is the consumer-facing version of this same invisibility:

When we add Kape's infrastructure to the invisibility ledger from 034B:

Israel's cyber footprint isn't small. It's invisible by design. The infrastructure is registered in other countries. The products carry other countries' brands. The companies are held by other countries' exchanges. And now, with Kape taken private, even the ownership structures are opaque.

This is not the Chinese model (state cloud tolerates abuse, IPs visible in honeypots) or the Russian model (state actors operate from identifiable infrastructure). This is the Israeli model: build the tools, sell the access, own the trust layer, be invisible in the data.

XI. Investigative Q&A

XII. Reading Between the Lines