Case 020 — Mounja Gummies: Deepfake Celebrity Supplement Scam
AI Voice Clone · False Mounjaro Association · Lovable Funnel · Converteai VSL

Three distinct operator identifiers were extracted from publicly served assets without any authentication or active probing. Together they uniquely link the funnel to its operator and their active Meta ad account.

The Lovable AI "Edit with Lovable" badge embedded in mounja-gummies.lovable.app exposes the operator's project URL: lovable.dev/projects/lovp_2j44kyt4cg9vptd6790j0ayj8p. This is the operator's Lovable account project ID — unique, permanent, and maps to the account that created and manages this funnel. The Cloudflare R2 bucket UUID d4d62d81-e69f-4cd8-8526-8627955b5637 was also exposed in the OG image URL, identifying the operator's cloud asset storage.

The sole affiliate redirect in the React bundle is theleanjoy.com/?aff_id=647&subid=Ashu. The subid=Ashu parameter is the operator's self-assigned tracking label — "Ashu" is a South Asian given name (common in India, Pakistan, Bangladesh), providing operator origin intelligence. The affiliate ID 647 is registered with theleanjoy.com's affiliate program.

The VSL page at theleanjoy.com/vsl contains a live Facebook Pixel tag: id=536467182607917. This pixel is active on the page running the deepfake Jillian Michaels VSL. It is the operator's Meta advertising account pixel — the same pixel receives conversion events from everyone who watches the VSL and clicks to order, directly linking the fake ad campaigns to this Meta account ID.

The product name "Mounja Gummies" is a deliberate phonetic near-match for Mounjaro (tirzepatide), a prescription GLP-1/GIP receptor agonist approved by the FDA in 2022 and the EMA in 2023 for type 2 diabetes and obesity. Mounjaro is manufactured by Eli Lilly and is one of the most-searched weight-loss drugs in 2025–2026. "Mounja" + "Gummies" implies the product is an oral supplement form of the drug — a medically impossible association, as tirzepatide requires subcutaneous injection and cannot survive oral digestion.

This is a form of pharmaceutical impersonation — using a name that triggers drug-seeking intent in the target audience (people looking for GLP-1 weight loss solutions) while selling an unrelated BHB ketone gummy with no clinical evidence. The Instagram ads and deepfake VSL reinforce this association with language like "GLP-1 without the injection" and images of syringes or prescription pads, confirmed by third-party investigative reports.

The actual ingredient list on theleanjoy.com consists of standard keto supplement components: BHB (Beta-Hydroxybutyrate) ketones, and generic "natural" fillers (tapioca, beet, apple, corn, citric). No tirzepatide. No semaglutide. No GLP-1 agonist of any kind. The "Mounja" branding is pure pharmaceutical brand impersonation with no factual basis.

The VSL served on theleanjoy.com/vsl (Converteai player, account bdedfaa4) uses real archival footage of fitness celebrity Jillian Michaels with her original audio stripped and replaced by an AI-cloned voice promoting the "gelatin trick" weight-loss narrative. Multiple independent investigators (streetsofkante.com, jordanliles.com, myantispyware.com) documented the manipulation: the AI voice mispronounces phrases such as "post-40 biology" — a consistent AI TTS artifact — and the lip-sync is visibly off from the original video.

The fabricated Jillian Michaels speech follows a scripted template: she "admits" to having lied about workouts for years, reveals a secret "gelatin trick" the fitness industry tried to suppress, and pivots to the supplement. The opener line "Stop everything you're doing. This will be censored in 48 hours. The pharmaceutical industry has filed a lawsuit" is a known dark-pattern hook — creating false urgency and persecution framing to bypass critical thinking.

In addition to the Michaels deepfake audio, the VSL also features AI-generated still images falsely depicting Serena Williams, Katy Perry, and Dr. Oz endorsing the "gelatin trick" — shown in kitchen settings holding gelatin mixtures. None of these individuals have endorsed the product. All images are AI-fabricated composites confirmed to not match any real photograph of these celebrities.

The VSL is hosted on Converteai (branded as VTurb — the same Brazilian platform used in Case 019's Third Eye Activator scam). The stream endpoint cdn.converteai.net/bdedfaa4-3c50-4f69-88f9-3aba88eeaed2/67c272fb5c0ec5383526342d/main.m3u8 returns HTTP 403 (access denied) — this account has enabled S3 signed URL protection, unlike Case 019 which served segments publicly. The stream requires a time-limited signed URL generated by the smartplayer JavaScript at runtime.

The thumbnail image at images.converteai.net/bdedfaa4.../players/67c2739982576bea6bc24c99/thumbnail.jpg is publicly accessible (HTTP 200). Its S3 Last-Modified header reads 2025-03-05 02:34:27 UTC — this is when the VSL was uploaded to Converteai's S3 bucket. The thumbnail shows the VTurb standard countdown ("05") pre-roll screen, the platform's signature loading state before the VSL begins. The domain mounja-gummy.us was registered 2026-03-05 — exactly one year after the VSL was created, confirming the video predates at least some of the domain infrastructure by a year.

The VSL page at theleanjoy.com/vsl (WordPress + Elementor, Hostinger hcdn, PHP/8.2.31) also exposes the WordPress admin-ajax endpoint, xmlrpc.php, and the full Elementor plugin version (4.1.1) — all of which constitute attack surface for anyone targeting this server.

The product page and VSL contain multiple health claims that violate EU and US advertising law. The BHB ketone "boost ketosis" claim is not authorized under EU Regulation 1924/2006 — the EFSA-authorized health claims register contains no approved claim for BHB ketones or exogenous ketosis induction. The fat-burning claims ("burn fat for fuel", "faster and more visible results") and the metabolic claims ("reduce cravings", "boost energy") each constitute independent violations under Article 3 of Regulation 1924/2006.

The FDA disclaimer "These statements have not been evaluated by the Food and Drug Administration. This product is not intended to diagnose, treat, cure, or prevent any disease." IS present on theleanjoy.com — however, this disclaimer does not legitimize the claims. It only applies to structure/function claims under 21 CFR §101.93, and the Mounjaro association and GLP-1 framing in the ads constitute disease claims (obesity treatment), which require FDA pre-market approval that does not exist for this product.

The funnel uses a three-layer architecture: a React SPA landing page (Lovable AI), a WordPress checkout site (theleanjoy.com on Hostinger), and a Converteai VSL. All three are distinct hosting providers across two continents, creating jurisdictional fragmentation that complicates enforcement.

The Lovable.app SPA is served via Cloudflare (CF-RAY FRA — Frankfurt edge), meaning EU consumers hit EU infrastructure. The checkout domain theleanjoy.com is on Hostinger's CDN (hcdn), registered through PDR Ltd (PublicDomainRegistry.com) — a registrar with no EU presence. The VSL CDN is AWS CloudFront Amsterdam (AMS58-P5) — EU-served. All three layers serve EU consumers from EU edge nodes, so EU consumer protection regulations apply regardless of operator origin.

The domain mounja-gummy.us (Namecheap, created 2026-03-05) returns 404 — it was either a test domain or was used in an earlier campaign phase and is now redirecting traffic to the Lovable SPA. The mounjaburn.com domain is completely offline (connection refused).