Persona Factory: Fabricated Health Blogs Fueling Affiliate Supplement Bait

Since March 2026, one operator has run seventeen fabricated health-blog brands through authenticated Amazon SES and Iterable to push affiliate supplement bait. None of the brands is real. Renew Health Ways, Your Longevity Box, The American Health Advisor, Life Essence Nutrition, and a dozen more are invented personas, each with its own domain, its own sending subdomain, and its own display name, all built from the same template and all pointing at the same affiliate supplement funnels. The mail leans on borrowed medical authority: a Harvard study that fights dementia, a Stanford finding, a named doctor who does not exist, a celebrity who supposedly canceled eye surgery. Tens of thousands of these messages were sent to US recipients, weighted toward older targets through themes like dementia, neuropathy, vision loss, and bladder control. What ties the whole fleet to one hand is not any single domain, because the operator rotates a fresh persona every few weeks. It is the build: a uniform 3-level subdomain grammar, a rigid click-tracking URL that carries the recipient's own address in the path, and an affiliate-attribution line the operator leaves in every message.

Key Takeaways

• The operator's footprint is a factory of invented brands: seventeen fabricated health-blog persona domains plus six sibling domains, each registered fresh and rotated on a two-to-four-week cadence so domain reputation never catches up.
• Every persona sends from a 3-level subdomain of the shape <dictionary-word>.<made-up-brand>.com (for example pure.renewhealthways[.]com, voice.wellfortheworld[.]com). That short-verb second level is rare outside this operator and is a strong clustering signal.
• Mail runs on legitimate Amazon SES and Iterable tenancy and passes SPF, DKIM, and DMARC across the entire fleet, so authentication is not a differentiator here. A passing auth result states that the operator controls the sending domain, not that the sender is honest.
• The click destination is a rigid tracking URL, tracking.<root>/<code>promo/<recipient-email>/..., that embeds the recipient's own email address in the path. Every recipient gets a distinct URL string, which defeats exact-URL caching while leaking the operator's affiliate-code scheme.
• Public registration data exposes the assembly line directly: ten of the persona roots were registered on a single day, 2025-07-21, through Namecheap under WHOIS privacy, alongside an older cohort of aged .co drop domains reused as redirect hosts.

Background

Email authentication answers one question: is this mail authorized by the domain it claims to come from. It does not say whether the domain owner is honest. This operator runs its own Amazon SES and Iterable stack, so it publishes valid SPF, DKIM, and DMARC for every persona domain it owns and every message arrives fully authenticated. Amazon SES is Amazon's bulk-mail relay and Iterable is a marketing-automation platform; both are legitimate services that any business can onboard, and both give an operator clean sending IPs and a trusted delivery path. The abuse here is not a hijacked account. It is a paying tenant using real infrastructure to send deceptive mail, which is why IP-level or ASN-level blocking does not work against it.

The money sits in affiliate marketing. ClickBank, BuyGoods, and Digistore24 are established affiliate marketplaces, and vendors like Primal Health and TrueGenics run supplement offers through that model. An affiliate earns a commission for every sale or qualified click it drives to those offers, so a rogue affiliate has a direct incentive to manufacture traffic at volume through whatever pretext converts. The supplement niche pays well and polices its inbound traffic loosely, which is what draws deceptive lead-generation into it. The marketplaces and vendors named in this mail are the monetization destination the operator exploits, not participants in the scheme. The operator even leaves the attribution line in place: every message carries a parenthetical like "( Ads by PrimalHealth )" or "Ads by ClickBank", a token gesture at disclosure wrapped inside body copy written to read as organic medical advice.

One infrastructure tell is worth calling out early. Every persona reuses Iterable's out-of-the-box mailing-address footer, "515 University Ave, Madison, WI 53703", which is Iterable's own headquarters address. A real Iterable customer edits that footer to its own business address during onboarding. Leaving the platform default in place across seventeen brands is the signature of an operator spinning up tenancy at speed and never customizing it.

Discovery and Infrastructure

The cluster surfaced from a false-positive review, where a set of senders kept scoring as deceptive while sharing a body marker and an infrastructure shape no legitimate newsletter would have in common. Expanding on that shared signature (Amazon SES return-path, a 3-level subdomain sender, and an affiliate-attribution line in the body) returned a coherent operation running seventeen health personas at once, with more clusters in adjacent verticals left for separate work.

The build has three layers. The sending layer is the seventeen persona domains, each fronting a single fabricated health brand and each exposing two operational hosts: a tracking.<root> or track.<root> redirector and a links.<sub>.<root> Iterable endpoint. The redirect layer routes clicks through Iterable's link-resolution service before the real offer page loads, so the user-facing URL is an opaque token and the true destination only appears after Iterable resolves it. The offer layer, the affiliate supplement page where the click is monetized, sits behind that hop and never appears in the mail.

Six sibling domains carry the same infrastructure signature and cluster with the primary set through a shared Iterable account fingerprint. They read as the same operator working a slightly older cohort of domains, which the registration data below supports.

How It Works

A recipient receives an authenticated email from a health brand they have never heard of, carrying a display name like "Renew Health Ways | RHW" or "The American Health Advisor" and a subject built on borrowed authority: "Harvard Study... This food fights dementia", "Activate Your Brain in Just 8 Seconds", "Weird nerve pain hack discovered". The body reads as an organic health tip, name-drops a university or a doctor, and buries a required affiliate-attribution line near the offer. The call to action points at the persona's own tracking.<root> host, and the click carries the recipient's email address inside the URL path before bouncing through Iterable to the supplement offer. Because the sending domain is authenticated and self-owned, the mail arrives with the credibility of a legitimate newsletter. Because the persona is discarded within a few weeks, there is little for a per-domain reputation system to hold onto once the operator rotates to the next fabricated brand.

Sample Lures

All samples below are attacker-authored email content, defanged, with every recipient identifier replaced by a placeholder. No recipient addresses or per-recipient tracking tokens survive. Each shows a different affiliate destination.

Renew Health Ways, routing to a Primal Health supplement offer:

From: "Renew Health Ways | RHW" <stepinto@pure.renewhealthways[.]com>
Subject: 9 "lean" bacteria strains combined with morning water...
Return-Path: <bounce@amazonses[.]com>

Body:  gut-health pitch framed as an organic tip; attribution line "( Ads by PrimalHealth )"
CTA:   hxxps://tracking[.]renewhealthways[.]com/plbppromo/[recipient email]/850RHW/SA/PLBP8400/PLBP/

Your Longevity Box, leaning on a Harvard name-drop and routing to a BuyGoods offer:

From: "Your Longevity Box" <discoversmthmorein@rejuvenative.yourlongevitybox[.]com>
Subject: Activate Your Brain in Just 8 Seconds
Return-Path: <bounce@amazonses[.]com>

Body:  "Medical shocker" framing with a Harvard reference; attribution "HEALTH - ads by Buy Goods"
CTA:   hxxps://track[.]yourlongevitybox[.]com/blfspromo/[recipient email]/859YLB/SA/BLFS403/BLFS/

Well For The World, a first-person testimonial routing to a ClickBank offer:

From: "Well For The World" <heart@voice.wellfortheworld[.]com>
Subject: This missing protein helped me walk without pain again..
Return-Path: <bounce@amazonses[.]com>

Body:  testimonial-style pain-relief pitch; attribution "Ads by ClickBank"
CTA:   hxxps://tracking[.]wellfortheworld[.]com/cdafpromo/[recipient email]/850WFW/SA/CDAF2740/CDAF/

Technical Analysis

No single persona domain is worth tracking on its own, because the operator throws each one away within weeks. What holds up across the rotation is the tooling, and four fingerprints tie the fleet to one hand.

Bulk Registration Cohorts

Public WHOIS exposes the assembly line. The persona roots are not registered one at a time as the operator needs them; they arrive in batches. Ten of the seventeen roots were created on a single day, 2025-07-21, all through Namecheap under WHOIS privacy, then held and rolled out one brand at a time over the following months. An older cohort of aged .co and .com domains, registered through GoDaddy in 2019 and 2020, serves the sibling cluster and its redirectors.

Domain	Role	Registrar	Created
diabetesrecovery[.]co	Sibling / redirect	GoDaddy	2019-04-17
myhealthrestoredblog[.]com	Sibling / redirect	GoDaddy	2020-11-09
yourhealthrestored[.]co	Sibling / redirect	GoDaddy	2020-12-15
theamericanhealthadvisor[.]com	Persona root	Namecheap	2023-09-06
renewhealthways[.]com	Persona root	Namecheap	2025-07-21
wellfortheworld[.]com	Persona root	Namecheap	2025-07-21
fitjourneyhealth[.]com	Persona root	Namecheap	2025-07-21
healthshifttime[.]com	Persona root	Namecheap	2025-07-21
organicvitalhub[.]com	Persona root	Namecheap	2025-07-21
nurseblogwellness[.]com	Persona root	Namecheap	2025-11-26

The single-day batch of ten is the strongest registration signal in the set. Legitimate publishers do not stand up ten unrelated health brands in one Namecheap session and then release them on a drip. The privacy masking is uniform, and no registrant identity in the set points back at a real business or brand.

The 3-Level Subdomain Grammar

Every persona sends from a subdomain of the shape <dictionary-word>.<made-up-brand>.com, where the second level is a short verb or noun drawn from a small vocabulary: pure, fresh, deep, notes, voice, viva, flow, smart, forge, inner, elevate, your, mailing, personal, rejuvenative, with. That padding level has no delivery function; it is a template field. Combined with the Amazon SES return-path and the affiliate-attribution body line, it is a three-part signature that isolates this operator cleanly from ordinary marketing mail.

Persona brand	Sending subdomain
Renew Health Ways	pure.renewhealthways[.]com
Your Longevity Box	rejuvenative.yourlongevitybox[.]com
Well For The World	voice.wellfortheworld[.]com
The American Health Advisor	personal.theamericanhealthadvisor[.]com
Fit Journey Health	forge.fitjourneyhealth[.]com
Nurse Blog Wellness	notes.nurseblogwellness[.]com

The Tracking-URL Template and Affiliate Codes

The click-through URL is rigid enough to write as a single pattern:

tracking.<root>/<code>promo/<recipient-email>/<3-digit><3-alpha>/(SA|B|OF|S)/<affiliate-code>/<network-tag>/

The recipient's own email address sits in the path, which gives every recipient a unique URL and quietly defeats exact-URL matching. The trailing segments carry the operator's affiliate bookkeeping, and those codes map each persona to the network it monetizes through. That mapping is a durable operator fingerprint because it survives the domain rotation: the persona of the week changes, the affiliate account behind it does not.

Persona root	Affiliate destination	Codes observed
renewhealthways[.]com	Primal Health	PLBP8400, BDLB8500, 850RHW
yourlongevitybox[.]com	BuyGoods	BLFS403, CAMW1880_6590, 859YLB
wellfortheworld[.]com	ClickBank	CDAF2740, ZDCS, 850WFW
fitjourneyhealth[.]com	TrueGenics	THCC8401, BVSV8592_8590, 850FJH
theamericanhealthadvisor[.]com	(multi-offer)	CDAL2080, BANS1_1842, CANA1602

Iterable Account Fingerprinting

The redirector path format exposes how many Iterable accounts the operator runs. Four distinct formats appear across the fleet, and two carry explicit numeric account identifiers. The primary personas split between a /s/c/<base64> format and a /u/click?_t= format, while the sibling cohort routes through numbered accounts /a/2253/click/ and /a/2087/click/. That numeric account fragment is stable across months and across brand rotations, which makes it a better continuity marker than any domain registration or ESP header. Domains and display names are disposable by design; the account behind the redirector is not.

Detection Observations

The traffic separates from legitimate marketing mail on structure, and the useful signals are the ones that survive the persona rotation. The 3-level <word>.<brand>.com sending subdomain, paired with an Amazon SES return-path and an affiliate-attribution line in the body, is a combination a real newsletter has no reason to produce. The tracking-URL template is nearly as strong: a click destination that embeds the recipient's email address in a <code>promo/ path, then trails an affiliate code and a network tag, is effectively never legitimate marketing behavior. At the infrastructure level, the numbered Iterable account fragment is the single best cross-persona pivot, because every fabricated brand eventually routes clicks through the same small set of accounts. The platform-default Madison, WI footer is a weaker but corroborating tell: any real Iterable customer edits it, so its presence across an entire brand fleet is an anomaly. Individually these signals are modest; together they isolate the operator, and keying on the account fingerprint and the URL grammar rather than the domain of the week is what recognizes the next persona before it has any history.

Indicators of Compromise

All indicators are defanged. Recipient data has been removed. The tables are a representative subset of the durable, verified-malicious infrastructure.

Sender Addresses

Value	Role	Notes
stepinto@pure.renewhealthways[.]com	Sender	Primal Health funnel
discoversmthmorein@rejuvenative.yourlongevitybox[.]com	Sender	BuyGoods funnel
stayfit@with.superfoodrush[.]com	Sender	Health-bait persona
start@smart.healthshifttime[.]com	Sender	Health-bait persona
hear@deep.tonicwords[.]com	Sender	Health-bait persona
guide@inner.naturalhealingfacts[.]com	Sender	Health-bait persona
daily@pure.lifeessencenutrition[.]com	Sender	Health-bait persona
ignite@forge.fitjourneyhealth[.]com	Sender	TrueGenics funnel
updates@notes.nurseblogwellness[.]com	Sender	Health-bait persona
hellofromyour@personal.theamericanhealthadvisor[.]com	Sender	Multi-offer persona
nature@fresh.organicvitalhub[.]com	Sender	Health-bait persona
heart@voice.wellfortheworld[.]com	Sender	ClickBank funnel
... (representative subset; one sending identity per fabricated persona across the seventeen-brand fleet)

Persona and Sibling Domains

Value	Role	Notes
renewhealthways[.]com	Persona root	Namecheap 2025-07-21 batch
yourlongevitybox[.]com	Persona root	Namecheap 2025
superfoodrush[.]com	Persona root	Namecheap 2025
healthshifttime[.]com	Persona root	Namecheap 2025-07-21 batch
tonicwords[.]com	Persona root	Namecheap 2025
lifeessencenutrition[.]com	Persona root	Namecheap 2025
fitjourneyhealth[.]com	Persona root	Namecheap 2025-07-21 batch
nurseblogwellness[.]com	Persona root	Namecheap 2025-11
theamericanhealthadvisor[.]com	Persona root	Namecheap 2023, oldest root
organicvitalhub[.]com	Persona root	Namecheap 2025-07-21 batch
wellfortheworld[.]com	Persona root	Namecheap 2025-07-21 batch
yourhealthrestored[.]co	Sibling	GoDaddy 2020, Iterable /a/2253/
treatingfungusblog[.]com	Sibling	GoDaddy 2020, Iterable /a/2253/
... (representative subset of the 23 verified-malicious operator domains: 17 fabricated-persona roots plus 6 sibling domains)

Tracking and Redirect Hosts

Value	Role	Notes
tracking.renewhealthways[.]com	Redirector	Click-tracking host
tracking.theamericanhealthadvisor[.]com	Redirector	Click-tracking host
tracking.wellfortheworld[.]com	Redirector	Click-tracking host
tracking.fitjourneyhealth[.]com	Redirector	Click-tracking host
tracking.nurseblogwellness[.]com	Redirector	Click-tracking host
track.yourlongevitybox[.]com	Redirector	Click-tracking host
links.pure.renewhealthways[.]com	Iterable endpoint	Link-resolution hop
links.pure.lifeessencenutrition[.]com	Iterable endpoint	Link-resolution hop
links.notes.nurseblogwellness[.]com	Iterable endpoint	Link-resolution hop
links.fresh.organicvitalhub[.]com	Iterable endpoint	Link-resolution hop
links.with.superfoodrush[.]com	Iterable endpoint	Link-resolution hop
click.lifeessencenutrition[.]com	Redirector	Click-tracking host
... (representative subset; dozens of verified-malicious tracking and redirect hosts, roughly two operational hosts per persona root)

MITRE Fight Fraud Framework Mapping

The mapping aligns to the MITRE Center for Threat-Informed Defense Fight Fraud Framework (F3), which reuses ATT&CK T#### technique IDs where applicable and adds fraud-specific techniques and a Monetization tactic. The IDs below are best-fit candidates against the published matrix.

Tactic	Technique	ID
Resource Development	Acquire Infrastructure: Domains (bulk Namecheap persona registration)	T1583.001
Resource Development	Establish Accounts (self-owned SES + Iterable sending tenancy)	T1585
Initial Access	Phishing: Spearphishing Link (affiliate-bait email carrying the tracking CTA)	T1566.002
Initial Access	Impersonate Official (fabricated medical authority: university and named-doctor name-drops)	F1032
Stealth	Obfuscated Files or Information (opaque Iterable link resolution, per-recipient URL)	T1027
Monetization	Affiliate resale of clicks and contact data	T1657

Conclusion

The front of this operation is disposable on purpose. Personas last a few weeks, subject lines shift with whatever draws clicks, and the health brand of the month is invented in a Namecheap batch and discarded once its domain reputation sours. What does not change is the method: bulk-register fabricated brands, send from a padded 3-level subdomain on self-owned SES and Iterable tenancy, embed the recipient's own address in a rigid tracking URL, and monetize the click through a stable affiliate account. Defenders who key on the account fingerprint and the URL grammar, rather than the persona of the week, will still recognize this operator after the next brand rotation, and probably under the next invented name.