The Loan-Scam Ecosystem: Seven Genres and Seven Operator Archetypes

Over a year of telemetry, the loan-scam ecosystem grew more than fifteenfold and pushed well over a million lending and debt lures through email and SMS. The traffic falls into seven distinct genres, ranging from outright brand-impersonation phishing to affiliate networks that quietly insert loan offers into unrelated newsletters. Behind that range are only seven recurring operator archetypes. They all rely on legitimate infrastructure: mainstream email platforms, real registrars, aged domains, and off-the-shelf lead-tracking pixels, repurposed to harvest a consumer's identity once and resell it many times.

Key Takeaways

• The loan-scam vertical relies on lead generation rather than credential theft. The asset is a consumer's identity and financial-intent data, collected through fake application flows and resold to downstream buyers at roughly $5 to $80 per record.
• Seven operator archetypes account for most attributable volume: an aged-domain-stash lead-gen factory, a two-rail portmanteau churn operator, a base64-body multi-brand hub, a Delaware-shell boiler room, a multi-vertical SMS lead-gen-as-a-service platform, a rogue lender affiliate, and a fabricated-newsletter affiliate injector.
• Nearly every operator authenticates cleanly. Mail passes SPF, DKIM, and DMARC because operators use real platform accounts, while click-through destinations sit behind encrypted CTAs, branded shorteners, and first-party tracker subdomains.
• Registration forensics provide the strongest cross-operator pivot: same-day registration bursts, twin registrations that share one mail-infrastructure fingerprint, and a handful of aged-stash domains at the front of each cluster.
• Facebook is a notable non-vector. Meta bans short-term lending outright and puts financial-services ads behind advertiser verification. That prices these operators out of paid placement and concentrates them in email and SMS.

Background

Consumer lending in the United States is sold through lead generation. A "lead" is a person's contact details together with their stated intent to borrow. It is captured once and sold repeatedly, often through real-time auctions that offer the record to buyers in descending-bid order. Public enforcement describes both the economics and the harm. In the Federal Trade Commission's Blue Global matter, the operator earned as much as $200 per lead. Roughly 84 percent of the loan applications it collected were never sold to a lender at all and instead went to marketers, debt-relief sellers, and data brokers. A separate lead generator paid a $1.5 million civil penalty for sharing sensitive applicant data indiscriminately. Commercial price guides list aged mortgage leads at a few dollars and shared real-time leads in the tens of dollars. As a result, bulk identity harvesting remains profitable even at low conversion.

Government-program impersonation appears repeatedly as a lure. The Consumer Financial Protection Bureau has repeatedly sanctioned mortgage advertisers for falsely implying FHA, HUD, or VA affiliation, and the VA warns that it never solicits refinances by phone, mail, or email. The vertical is concentrated in email and SMS for a structural reason: Meta's ad standards prohibit short-term and payday lending outright and require identity and regulatory-authorization checks for all financial-services ads. That verification wall drives operators to channels where the entry cost is a burner domain and a platform account, rather than an authorized-advertiser attestation.

The same infrastructure providers recur throughout these operations:

• Amazon SES is Amazon's pay-as-you-go bulk email service. A throwaway account can send authenticated mail from reputable AWS address space. Distributing sends across regions also dilutes the per-region volume signals that would otherwise trigger reputation throttles.
• SparkPost is an enterprise delivery platform. Its shared sending domains and per-tenant subaccounts allow one operator to maintain many isolated identities within a single footprint and discard a burned subaccount without losing the rest.
• Iterable supports custom-CNAME link tracking, so click links resolve from the sender's branded subdomain (links[.]sub[.]root). This hides the true destination behind a host that appears to be first party.
• Mailchimp's Mandrill is an API-driven transactional product that allows an operator to set up sending for many brands quickly. That suits an actor cycling through disposable loan-brand identities.
• Klaviyo with MJML templates can send the email body as a base64-encoded MIME part, keeping the pitch text and CTA out of plain text in transit.
• Campaigner's cp20[.]com is a legitimate, high-reputation click-tracker. When CTAs pass through it, the outbound link resolves to a trusted host and the landing page appears only after the redirect.
• Blueshift is a customer-data platform whose links include bsft_ tracking parameters, which an operator can use to grade and re-target responsive victims.
• Jornaya's LeadiD pixel creates a tamper-evident record of a lead's origin and consent. In this economy, operators misuse it to make harvested leads appear consented and increase their resale value.
• Aged-domain reuse involves registering or buying domains that are years old. Those domains inherit registration age and pass newly-registered-domain heuristics more easily.

Discovery and Infrastructure

We divide the ecosystem into seven genres, ordered from clearly criminal to grey-zone predatory:

Genre	Channel	Shape
Brand-impersonation loan phishing	Email	Wide brand fanout, narrow per-domain volume
Deceptive lead-gen / PII harvesting	Email	The largest genre; fabricated lender brands, encrypted CTAs
Cross-channel fake-loan boiler rooms	SMS + Email	Named "rep" personas, deep PII personalization
SMS lead-gen-as-a-service	SMS	Shared shortlink redirect domains across verticals
Debt-relief and settlement-mill funnels	Email + SMS	Opaque CTAs, vague legal or government pretexts
Predatory grey-zone lending	SMS + Email	Real lenders using scam-shaped marketing
Affiliate-injection inside non-loan content	Email	Loan offers slipped into fabricated newsletters

The genres overlap, and several operators work in more than one at the same time. During the observation window, the vertical's volume rose more than fifteenfold over two quarters before settling at a sustained high rate. The increase came from new operators entering the space, not from one actor scaling up.

Dispersion is the defining structural signal in the phishing genre. The FHA and VA impersonation family uses 56 distinct sending domains, each carrying only a handful of messages. A separate Quicken Loans look-alike thread uses 17 distinct domains, each producing a similar trickle. The operator registers a domain, sends for a short time, and burns it. The fingerprint is therefore broad unique-sender fanout against one impersonated brand, not high per-domain volume.

The deceptive lead-gen genre accounts for most of the traffic, with hundreds of thousands of messages. Its largest operator uses one toolkit across four product verticals (personal loans plus three insurance lines) from a single footprint: 96 active sender apexes in a 30-day window and roughly 7,500 unique sender addresses. The senders are Faker-generated firstname.lastname@apex accounts on Amazon SES. Each click passes through a per-apex tr[.]apex or track[.]apex tracker with an AES-CBC encrypted payload, which keeps the final landing URL hidden from a scanner.

How It Works

A representative contact chain in the boiler-room genre begins with SMS. A named "rep" persona sends a personalized opener from a shortcode or toll-free number and directs the target to a trust-prefixed subdomain on an operator-owned brand domain (auth[.], signin[.], login[.], portal[.]). The target then passes through a backend redirector carrying a per-victim tracking token and reaches a fake loan-application form that collects a Social Security number, banking details, and income. A branded follow-up email addressed to the target's own phone number confirms that the operator linked the SMS and email identities to the same person.

The lead-gen genre omits the SMS stage and uses application-lifecycle theatre instead. Subject lines suggest that an application the recipient never started is already underway ("Application status," "We've reviewed your details," "Application successfully accepted"). The click passes through the encrypted tracker and reaches a polished referral site displaying real-carrier partner logos. Its fine print says the record will be "resold to participating lenders, advertisers, networks, and other partners."

Sample Lures

All samples are defanged, and every recipient identifier has been replaced with a placeholder. The samples contain attacker-controlled content only.

Email, deceptive lead-gen (application-lifecycle theatre):

From: "Eino Hayes" <eino.hayes@autoquotebeam[.]com>
Subject: Application status
CTA:    http[:]//tr.autoquotebeam[.]com/cv2/<token>/U2FsdGVkX1+...

Email, portmanteau-churn operator (subprime credit-builder impersonation):

From: "Self Visa Notification" <isla.m@borrowingnexus[.]com>
Subject: [recipient name], your Self Visa card is available.

Email, boiler-room cross-channel follow-up (note the phone-number subject and broken templating):

From: <ben.masters@borrowly[.]io>
Subject: Received for: [recipient phone]
Body:   "Hi [recipient name],"
Footer: [shared Dover, Delaware shell mailing address]

SMS, boiler-room opener (fabricated prior engagement):

Hi [recipient name], our review team just gave your request the green light. [link]

SMS, lead-gen-as-a-service (property-record personalization):

[recipient name], See the March home equity options for [street address].
Get funds and keep your current rate. [shortlink]

SMS, settlement-mill (senior-targeted vagueness):

Hi [recipient name], pardon this interruption today, however, your Senior
Inflation... http[:]//<5char>.eleganix[.]email

SMS, rogue-affiliate predatory lending (Spanish-language, no recipient PII):

Necesitas un prestamo urgente? WastiCredit, pide un prestamo de hasta
$2'000.000. Tu primer prestamo con 50% de dcto.

Technical Analysis

Registration Cohorts and the Aged-Stash Pattern

Registration forensics offer the single most productive pivot across this ecosystem. Roughly eighteen operator domains belong to an aged stash. They were registered a year or more before we first saw them sending, and each cluster usually has one deeply aged anchor at its front: a 2002-registered hub for the base64-body operator, a 2012-registered hub for the churn operator, and a 2017 to 2018 pair of Cloudflare-registered shorteners for the SMS lead-gen platform. The remaining domains appear in coordinated bursts.

Domain(s)	Registrar	Created	Cohort signal
diamondskyinc[.]com	New Frontier	2002	Deep aged-stash front, multi-brand hub
qlloans[.]com	GoDaddy	2012	Aged-stash sending hub, churn rail
80k[.]us, a2e[.]us	Cloudflare	2017-2018	Aged shortener pair
cashluma, lendlyfe, krediblefunds, fundriff, fundyze (all [.]com)	Namecheap	2025-08-19	Same-day five-pack, one operator
easyfundusa[.]com, smartfundsusa[.]com	Amazon Registrar	2024-11-26	Same-day twin, shared SPF
lcbr[.]us, rfup[.]us	GoDaddy	2025-06-29	Same-day .us twin, shared SPF
primelaws, payaofr, paynofr, wekndcrd, savnwoffr (all [.]com)	Namecheap	2026 Mar-Apr	Cheap-TLD burner burst

The same-day five-pack is the strongest individual burst indicator in the corpus: five loan-vertical .com names registered on the same day through the same registrar. Two independent points confirm the .us twin: a shared registration date and an identical <domain>[.]spf[.]auto[.]dnssmarthost mail fingerprint. The payaofr and paynofr pair carries the pattern into the names themselves (pay-a-offer, pay-no-offer). They were registered five days apart and use the same forwarding SPF.

Mail-Infrastructure Fingerprints as Cross-Cluster Glue

These operators authenticate through real platforms, which makes the SPF record a useful fingerprint. Three fingerprints connect domains that otherwise appear unrelated:

• A SparkPost address block layered over Amazon SES appears on six churn-operator hubs and extends into one boiler-room sending domain, connecting the sending rails of the two operations.
• A Namecheap email-forwarding include (spf[.]efwd[.]registrar-servers[.]com) connects eight domains, joining boiler-room infrastructure to the 2026 cheap-TLD burner burst.
• A shared Mailjet-family record appears across four hub-and-landing apexes that also have a single WHOIS registrant. This is the tightest fingerprint for the base64-body operator.

Domain-Generation Grammar

Each operator follows a recognizable naming grammar. The churn operator forms portmanteaus from a fixed template: a verb or adjective, a money noun (fund, loan, pay, budget, capital, debt), and a suffix. The names appear across .com and a later .ai cohort. The base64-body operator places a rotating brand keyword before a ten-digit random string in the local part (brandkeyword0270734846@apex) and cycles through more than 60 brand prefixes covering loans, tax relief, and debt relief. The SMS platform prefers four- and five-character shortener labels on .us, .me, .app, and .co, along with deliberate typosquats of insurance and credit terms.

Subdomain Grammar and CTA Concealment

Two subdomain conventions appear repeatedly. Operators create self-hosted tracker subdomains (tr[.], track[.], go[.], links[.], mail[.]) to keep apex-level URL reputation from intercepting the CTA. Boiler rooms place landing pages behind trust-prefix subdomains (auth[.], signin[.], login[.], portal[.], myaccount[.]). Concealment also occurs at the payload level. The largest lead-gen operator encrypts its click-through URL with AES-CBC through a CryptoJS routine, leaving only the Salted__ marker visible. The base64-body operator sends the entire message as an encoded MIME part. The brand-impersonation genre uses IPv4-mapped IPv6 URL literals, expressing the destination host in bracketed notation. That notation resolves normally in a browser but does not match the dotted-quad or hostname patterns expected by most extractors.

Detection Observations

These behavioral signals distinguish the ecosystem's traffic from legitimate lending mail and describe how the operators work.

• Wide unique-sender fanout against one impersonated brand, with dozens of one-shot sending domains carrying only a trickle of messages each, is the clearest indicator in the phishing genre. It depends on sender dispersion rather than message content.
• A message that authenticates cleanly but sends its only CTA through a first-party tr[.] or track[.] tracker subdomain, or provides no extractable final URL, is a strong structural signal in the lead-gen and debt-relief genres.
• Coordinated registration bursts and twin registrations with a shared mail-infrastructure fingerprint provide the strongest cross-operator pivot available. They are visible in public WHOIS and SPF data without requiring access to message content.
• Shared shortlink redirect domains used across several unrelated verticals are the single strongest cross-cluster indicator for the SMS lead-gen platform. One redirect layer serving loans, insurance, and real-estate lures establishes a shared operator.
• SMS personalization based on public property and voter records, specifically a real first name paired with a street address, is a behavioral marker of the lead-gen-as-a-service genre. It separates this traffic from generic spam blasts.

Mitigation and Guidance

• Pivot on registration forensics rather than content alone. Cluster candidate domains by registration date, registrar, and SPF fingerprint. Same-day multi-domain registrations that share one mail include are high-confidence operator groupings.
• Treat first-party tracker subdomains as first-class indicators. Apex reputation does not cover tr[.], track[.], go[.], and links[.] children, which carry the CTAs.
• Decode before scanning. Base64 MIME bodies and CryptoJS Salted__ CTAs defeat naive keyword and link extraction. Decode the payload first, then evaluate it.
• Monitor shared redirect domains as cross-vertical glue. A shortener used for several unrelated lures indicates a shared platform and is worth blocking at the redirect layer.
• Flag application-lifecycle language ("your request was approved," "verify to release funds") from senders with no prior relationship, particularly when it appears with government-program (FHA, VA, HUD) claims that legitimate agencies do not make by email or SMS.

MITRE Fight Fraud Framework Mapping

The behaviors correspond directly to tactics in MITRE CTID's Fight Fraud Framework. We omit technique identifiers because the published matrix could not be programmatically confirmed at the identifier level. The tactic-to-behavior mapping below is the reliable layer.

Tactic	Observed behavior
Resource Development	Coordinated bulk domain registration, aged-domain stash acquisition, ESP subaccount and multi-account provisioning
Initial Access	Phishing email and SMS smishing delivery of loan offers
Initial Access	Loan-application-lifecycle theatre; FHA, VA, and lender impersonation
Execution	Multi-step PII-harvest application forms with urgency and fabricated deadlines
Monetization	Harvest of identity and financial-intent data (the lead)
Monetization	Lead resale through affiliate and offer networks and ping-tree auctions
Stealth	Encrypted and opaque CTAs, IPv4-mapped IPv6 literals, branded-shortener and ESP redirect layering, compromised-domain relays, cheap-TLD rotation

Indicators of Compromise

All indicators are defanged, and victim data has been removed. This is a representative subset from the campaign's verified-malicious set. Large aggregate totals are floored, while small structural counts (seven genres, seven archetypes) are exact.

Senders

Value	Role	Notes
eino.hayes@autoquotebeam[.]com	Sender	Lead-gen Faker burner
gilda.mraz@fasthelpy[.]com	Sender	Lead-gen Faker burner
jonatan.olson@cashluma[.]com	Sender	Lead-gen loan-vertical burner
isla.m@borrowingnexus[.]com	Sender	Churn rail, credit-builder impersonation
info@qlloans[.]com	Sender	Churn SES rail hub
info@assureatlasloans[.]com	Sender	Churn SES rail hub
lendfly2718130566@diamondskyinc[.]com	Sender	Base64-body throwaway
superloans@lendfinity[.]net	Sender	Base64-body persistent sender
ben.masters@borrowly[.]io	Sender	Boiler-room email follow-up
notice@cheerlend[.]com	Sender	E-sign fake-loan ring
notice@creditloop[.]co	Sender	E-sign fake-loan ring
hi@admoons[.]org	Sender	Multi-account rotation
support@firstadvantageconnect[.]com	Sender	Standalone debt-relief funnel
accountresolution@clearairlending[.]com	Sender	Generic loan-keyword throwaway
hello@togetherloans[.]com	Sender	Generic loan-keyword throwaway
...		(representative subset; 60+ verified-malicious senders)

Domains

Value	Role	Notes
autoquotebeam[.]com	Sender apex	Lead-gen toolkit (2025 cohort)
lendlyfe[.]com	Sender apex	Lead-gen loan sibling (Aug-19 burst)
qlloans[.]com	Sending hub	Churn operator (aged-stash 2012)
zestpayloan[.]com	Sending hub	Churn operator
smartfundsusa[.]com	Sending hub	Churn operator (Amazon-Registrar twin)
diamondskyinc[.]com	Sender hub	Base64-body operator (aged 2002)
foodycreek[.]com	Redirector	Base64-body operator
borrowly[.]io	Operator brand	Boiler-room network
loadingaccount[.]com	Backend redirector	Boiler-room network
simpleverify[.]co	Backend	Boiler-room network
cheerlend[.]com	Operator apex	E-sign fake-loan ring
firstadvantageconnect[.]com	Operator apex	Standalone debt-relief funnel
lcbr[.]us	Redirector	SMS lead-gen (GoDaddy .us twin)
rfup[.]us	Redirector	SMS lead-gen (twin)
primelaws[.]com	Burner apex	Settlement-mill (2026 burst)
...		(representative subset; 250+ verified-malicious domains)

Hosts / IPs

Value	Role	Notes
tr.autoquotebeam[.]com	CTA tracker	AES-CBC encrypted click tracker
links.firstadvantageconnect[.]com	CTA tracker	Own-domain link tracker
start.firstadvantage[.]io	Landing	Debt-relief funnel apex
app.firstadvantage[.]io	Landing	Debt-relief funnel apex
signin.borrowly[.]io	Landing	Boiler-room trust-prefix host
mail.foodycreek[.]com	Redirector	Base64-body CTA redirector
login.creditcape[.]org	Landing	Credential-harvest backend
links.fhaexpertsnexus[.]com	CTA tracker	Multi-brand ESP link tracker
hello.capitalsyield[.]com	Relay	Rotation sending subdomain
go.auralend[.]com	CTA tracker	Loan-funnel host
trk.alldayfunds[.]com	CTA tracker	Loan-funnel host
secure.blueorbitfinance[.]com	Landing	Loan-funnel host
trk.trustpathlending[.]com	CTA tracker	Loan-funnel host
gjqvt.spelum[.]rest	Burner CTA	Settlement-mill burner host
107.155.77[.]44	Landing IP	IPv6-CTA brand-pretext VPS
107.155.77[.]45	Landing IP	IPv6-CTA brand-pretext VPS
...		(representative subset; 50+ verified-malicious hosts)

URLs

Value	Role	Notes
http[:]//[0000:0000:0000:0000:0000:ffff:6b9b:4d2c]/r/ua/op	Landing	IPv4-mapped IPv6 CTA, FHA rate-lock pretext

Phone Numbers / Shortcodes

Only sender-attributed numbers are included; recipient numbers have been removed.

Value	Role	Notes
+1-833-618-0386	Sender	SMS fake-loan lead-gen
+1-844-432-0678	Sender	SMS fake-loan lead-gen
+1-866-885-1965	Sender	SMS fake-loan lead-gen
+1-833-572-2186	Sender	SMS fake-loan lead-gen
+1-833-700-6170	Sender	Auto-refund-bait
+1-833-701-2255	Sender	Real-estate buyer-lead bait
+1-833-670-3546	Sender	Tax-pivot payday lender
+1-888-708-7159	Sender	Debt-relief callback funnel
+777203825016	Sender	Malformed sender ID
59392	Shortcode	Boiler-room network
84689	Shortcode	Boiler-room PIN pretext
51821	Shortcode	Boiler-room network
63426	Shortcode	Boiler-room network
35187	Shortcode	SMS lead-gen home-equity
87912	Shortcode	SMS lead-gen FHA
20600	Shortcode	Fake-loan mini-brand
28776	Shortcode	Fake-loan mini-brand
85820	Shortcode	Rogue-affiliate lending (LATAM)
891150	Shortcode	Rogue-affiliate lending (LATAM)
91505	Shortcode	Tax-pivot payday lender
87130	Shortcode	LATAM lending cluster
897077	Shortcode	LATAM lending cluster
Sunshine16	Sender ID	Fake-loan mini-brand
...		(representative subset; 30+ verified-malicious shortcodes)

Conclusion

The loan-scam ecosystem persists because it uses legitimate delivery infrastructure. Operators pass mail authentication through real platform accounts, conceal destinations behind encrypted CTAs and first-party trackers, and rotate cheap domains faster than any individual content signal can track. The most useful evidence lies in the seams they cannot conceal: coordinated registration bursts, shared redirect layers used across unrelated verticals, and application-lifecycle language from senders with no prior relationship. The economics favor volume and reuse, so the next cohort will resemble the last one but will be registered on a different day.