A Multi-Vertical SMS Lead-Gen Network Hidden in .co Shortlink Traffic

Since mid-2025, one operator has been using 55 coined .co shortlinks to run SMS lead-gen lures. Most came from a single 2023 registration batch. The texts promise a new tablet, a "BIG check", missing funds or a quick loan of a little under $5,000. Each link leads to a themed website that collects the recipient's personal details for resale. We have tracked the fleet since at least July 2025 across 50 leased five-digit shortcodes and hundreds of thousands of messages. The domains are disposable, but the operation behind them stays consistent: one message grammar, one shortcode per shortlink, and a stockpile of .co names bought on a single day in September 2023.

Key Takeaways

• Every fleet message follows the same grammar: a short brand-style prefix, a windfall or loan teaser, a .co link with a 7-character per-recipient token, and a "Text stop to end" tail.
• 37 of the shortlinks were registered at one registrar on 2023-09-11, and two more were registered the next day. They remained unused for roughly 22 months before we observed them in traffic.
• Each shortcode directs traffic to exactly one shortlink at a time. When that shortlink is retired, the shortcode moves to a re-spelled successor that leads to the same lander.
• The fleet operates in three verticals under 48 distinct prefixes: quick-loan offers, auto-insurance quotes, and a large windfall/giveaway tier. Every loan offer lists an irregular, non-round amount between $4,191 and $4,998.
• On a fleet link we followed, the per-recipient token led to a tracking redirect that already carried the recipient's name, email, street address, date of birth and phone number before any form was filled.
• Many legitimate brands, SMS vendors and notification platforms use the same short-.co-plus-shortcode pattern. Only the grammar reliably separates this operator from them.

Background

We found the network while reviewing short .co call-to-action domains in SMS traffic. The pattern alone was a poor filter. Real companies also use very short .co links as branded shorteners, and document-notification vendors, alert platforms and retailers send them from their own shortcodes every day. The message itself set this operator apart. The same prefix-teaser-token-footer structure appeared across dozens of senders, none of which had a real company behind it.

.co is the country-code domain for Colombia, but its registry has marketed it worldwide since 2010 as a short, open alternative to .com. Most recipients therefore read a four-character .co link as a legitimate brand shortener rather than a disposable domain. The operator depends on that learned trust.

The senders use leased five-digit shortcodes. The US Common Short Code registry and SMS aggregators provision shortcodes for high-volume business messaging, and recipients associate them with banks, pharmacies and retailers. A leased code carries that association over to whatever it sends.

The business model is lead generation. A lead-capture form collects or confirms a name, address, phone number and email, sometimes with eligibility or coverage details. The record is then sold to buyers who pay per lead. The advertised laptop, check or loan never materializes; the personal data is the product. The FTC reported that consumers lost $470 million in 2024 to scams that began with a text message, about five times the 2020 figure.

Discovery and Infrastructure

The fleet has three layers:

1. A leased shortcode. It carries one invented prefix and one vertical throughout its life.
2. A coined .co shortlink. It is tied to that shortcode and contains a per-recipient token.
3. A themed lander site. It stays in place as shortlinks come and go.

We count 55 fleet shortlinks used by 50 shortcodes. Rotation explains the difference: five shortcodes moved to a successor domain during 2026 while keeping the same lander each time.

Prefix	Shortcode	Shortlink	Vertical
CC7:	25177	ccs1[.]co	Giveaway
CCPN:	88142	ccpa1[.]co	Giveaway / product tester
PRO:	28579	prpr1[.]co	Missing funds / windfall
SPN:	50462	spn3[.]co	Giveaway (phone, RV, laptop)
[withheld]	45566	updtr1[.]co	Quick loan ("Up To $48xx")
[withheld]	98442	zwt1[.]co	Quick loan
[withheld]	38586 / 86250	hexe1[.]co / hexw1[.]co then hexw2[.]co	Quick loan
[withheld]	32808 / 63499	pcpe1[.]co then pcpe2[.]co / pcpw1[.]co	Quick loan
[withheld]	62588	insu1[.]co	Auto-insurance quote
[withheld]	59613	ttsn2[.]co then tese3[.]co	Windfall tease
[withheld]	42341	dpp5[.]co then dipe3[.]co	Windfall tease

Prefixes shown as [withheld] are withheld because the same word is also the name of an unrelated real business. The fleet's prefixes resemble brand names but lead only to the operator's own lander sites.

How It Works

A recipient gets a text from a five-digit number. The message begins with the prefix and an urgent claim: a prize "sent straight to your door", a check "ready to ship", funds that "belong to you", or a loan approval "up to $4,839 today". A 7-character token follows the .co link, and the message ends with a STOP instruction that imitates compliant marketing.

The link resolves to the shortcode's lander, a themed site with a name suggesting a community, helper, savings or news site. On the link we followed, the click already resolved to a complete record on the recipient, so the click appears to confirm mainly that the number is live and the person responsive. Where the lander has a form, it may supplement a lead the operator already holds. Nothing advertised arrives. The lead enters an affiliate or data-broker supply chain and is often sold more than once.

The design separates inexpensive components from durable ones. Shortcodes and shortlinks make up the replaceable reach layer. The landers make up the conversion layer, and most were registered years before the fleet appeared. A blocklist confined to the rotating front end never reaches the component that converts.

Sample Lures

All samples are real messages. Per-recipient tokens are replaced with [token], and URLs are defanged. None of these samples contained recipient names.

Giveaway:

CC7: Congratulations! You Have Been Chosen For The Opportunity Of A Lifetime!
You Don't Want To Miss Out: hxxps://ccs1[.]co/[token] Text stop to end

Product-tester giveaway:

CCPN: CONGRATS! You've Been Chosen To Be A New Product Tester. Be The First To
Try The Latest Products. Click Here: hxxps://ccpa1[.]co/[token] Text stop to end

Windfall:

PRO: WOW! You Could Be RICH Starting TODAY! This Surprise Could CHANGE YOUR LIFE!
Your Ticket To Better Life Is Here: hxxps://prpr1[.]co/[token] Text stop2end

Device giveaway:

SPN: Your Phone Is Old! You Could Upgrade & Get a NEW ONE Shipped To YOUR DOOR at
NO COST! Don't Miss This Opportunity: hxxps://spn3[.]co/[token] Text stop2end

Quick loan (prefix withheld):

[withheld]: Monthly Special! You Have A Statement Increase Up To $4817 Available Now.
Apply Today, Get Paid Fast: hxxps://zwt1[.]co/[token] Text stop to end

Technical Analysis

Message Grammar

The grammar is the operator's most reliable fingerprint:

<PREFIX>: <teaser with urgency or windfall claim>
<action phrase>: hxxps://<coined>[.]co/<7-char token> <STOP footer>

Nearly every fleet link has a token of exactly seven base62 characters (mixed case plus digits). Tokens do not repeat across messages, which is consistent with a per-recipient tracking value. The operator uses the token to determine who clicked and completed the form, then enrich or prune the lead record before resale. About three-quarters of messages end with "Text stop to end"; most of the rest use close variants ("Text stop2end", "Reply stop to end", "Txt stop 2 end"). Welcome texts instead use a CTIA-style footer ("Msg&Data rates may apply. Freq varies. Reply Help for Help, Stop to End"). Opt-out confirmations follow a handful of fixed templates, which gives the fleet a recognizable signature outside its lure traffic as well.

The loan vertical has a separate tell. Every quick-loan message gives an irregular, non-round amount between $4,191 and $4,998. The amounts cluster just under $4,900 and are never a round $5,000.

Tracking Redirect and Pre-Loaded Lead Records

The token does more than track the click. On a fleet link we followed, the shortlink returned a 301 to a tracking host on a trk. subdomain of the same shortlink domain. Before anything was typed into a form, the redirect's query string already contained the recipient's record. A 302 then sent the visitor to a clickbait article on the vertical's lander.

hxxps://<coined>[.]co/<token>
  -> 301 hxxps://trk.<coined>[.]co/<uuid>?email=&fname=&lname=&adrs=&ct=&stt=&zp=&dob=&pn=&uuid=
                                          &sd=&source=&creative=&refid=&fid=&fday=
  -> 302 hxxps://<lander>[.]com/<article>

The identity fields include email, first and last name, street address, city, state, ZIP code, date of birth and phone number. The other fields describe the campaign rather than the person: the sending shortlink, the prefix, a named creative for the lure, a referral ID and what appears to be a send-cohort code. We found trk. hosts of the same form on seven fleet shortlinks across the giveaway, missing-funds and insurance verticals.

For the link we followed, the operator held a complete record on the recipient before the click, and trk. hosts of the same form on six more shortlinks suggest the redirect is not a one-off, though we have not seen their query strings. A click confirms that the number reaches a responsive person and ties that response to a specific lure and send. That makes the record worth more at resale. We have not established where the records originate. The fleet's own lander opt-in pages are one possible source, and purchased lists are another. The records also travel in plain text in the redirect URL, where any intermediary that logs full URLs can see them.

Prefix Taxonomy and Verticals

The 50 shortcodes use 48 prefix identities. Two prefixes each span a pair of shortcodes with east/west-style sibling shortlinks. Each prefix stays within one vertical:

Vertical	Prefixes	Shortcodes	Lure shape
Windfall / giveaway / missing funds	35	35	New device, car or RV "at no cost", a "BIG check", gift cards, unclaimed funds
Quick loan	9	11	"Up to $4,xxx", "statement increase", "financial relief"
Auto-insurance quote	4	4	Cheaper coverage, a quote "ready for you"

The mix shifts over time. The windfall tier makes up a third to a half of traffic every month. Loan offers rose sharply in mid-2026 and then fell back. The insurance tier was most active in 2025 and has been nearly silent since June 2026.

Registration Cohorts and Aged-Domain Staging

The shortlinks were bought in bulk and held in reserve. Fleet shortlinks with WHOIS records have the following registration dates:

Registration date	Registrar	Shortlinks
2023-09-11	Namecheap	37
2023-09-12	Namecheap	2
2023-12-04	Above	3
2024-03 to 2024-04	Cloudflare	3
2025-10-19	Cloudflare	1
2026-04-13	Cloudflare	1

Six fleet shortlinks returned no WHOIS record, and the two newest successors (August and September 2026) have no record yet. The 2023-09-11 batch includes the anchors for most verticals (ccs1[.]co, ccpa1[.]co, insu1[.]co, homa1[.]co, prpr1[.]co, trb1[.]co, epro1[.]co, hexe1[.]co, pcpw1[.]co). The batch remained unused for about 22 months before the first fleet message we observed in July 2025.

Many controls score domain age, and a domain registered years before use has a clean history. Palo Alto Networks Unit 42 documented the same tradecraft under the term strategically aged domains: domains registered well in advance and left dormant so that they have a benign reputation when activated.

The landers are older and were registered separately. Most are at GoDaddy, with registration dates from 2018 to 2022, including same-day pairs and triples. In two cases, a newer shortlink was registered on the same day as its lander, directly connecting those shortlinks to the lander set.

Naming Grammar and Rotation

Shortlink labels pair a mnemonic for the prefix or lander with a digit: ccs1 for CC7, ccpa1 for CCPN, spn3 for SPN. The suffix is usually 1; 2, 3 and 5 occur on later or replacement domains. East/west sibling pairs (hexe1/hexw1, pcpe1/pcpw1) and a small reward family (apro1, epro1, epo1, prpr1) suggest a generator using a small vocabulary rather than a person registering unrelated names.

During rotation, the mnemonic remains while the spelling changes. ttsn2[.]co became tese3[.]co and dpp5[.]co became dipe3[.]co in April 2026. hexw1[.]co moved to hexw2[.]co and pcpe1[.]co to pcpe2[.]co in August and September 2026. In every case, the shortcode and lander stayed the same. When a shortlink goes quiet, its re-spelled successor may appear on the same number.

Lander Construction

Two landers we checked live, digitalpennypincher[.]com and thetechsentinel[.]com, use nearly identical WordPress builds. Their taglines are empty, one misspells its own name in the page title, RSS is disabled, and they have ad-network consent scripts but no editorial content. One lander's 404 page links to another fleet lander. Some landers also host a mobile opt-in page for the shortcode programs, so the same sites can double as consent-capture fronts. Several landers load assets from a shared routing and site-hosting platform. That platform also hosts unrelated lead-gen sites, so we treat it as supporting evidence rather than attribution.

Detection Observations

Shape alone is not a verdict. A two-to-six-character .co link sent from a shortcode describes this fleet, but it also fits branded shorteners used by retailers, telecoms, lenders, lotteries, universities, document-notification vendors and emergency-alert platforms. A defender who relies only on that shape will block real traffic.

Several signals separate the fleet when used together:

• A short prefix that does not match the sender's registered brand, followed by a windfall, giveaway or quick-loan claim.
• A .co link with a 7-character base62 token and a footer from the "Text stop to end" family.
• A redirect from the shortlink to a trk. subdomain of the same domain, with a query string carrying identity fields such as email, dob and pn (observed on a followed link).
• A quick-loan amount just under $5,000 that is never a round number.
• A shortcode that has only ever carried one shortlink, or that moved to a re-spelled successor with the same destination.
• A shortlink registered in a same-day batch with dozens of siblings, long before its first use.

Personalized or transactional content points the other way, including a first name, an order, an account or a document notice. So does a link that resolves to the sender's own corporate domain. We have not seen either in this fleet.

The landers are the most stable pivot. Shortlinks and shortcodes rotate, but a lander that continues to appear behind new shortlinks provides a better long-term signal than any single front-end domain.

Indicators of Compromise

All indicators are defanged. Recipient data has been removed. Values are a representative subset of the verified-malicious set. The shortlinks and shortcodes belong to the operator and have no connection to any business with a similar name.

Domains (shortlink layer)

Value	Role	Notes
ccs1[.]co	Shortlink	Giveaway; 2023-09-11 batch
ccpa1[.]co	Shortlink	Giveaway / product tester; 2023-09-11 batch
prpr1[.]co	Shortlink	Missing funds; 2023-09-11 batch
apro1[.]co	Shortlink	Windfall; 2023-09-12
epro1[.]co	Shortlink	Windfall; reward family
spn3[.]co	Shortlink	Device giveaway
homa1[.]co	Shortlink	Homeowner windfall; 2023-09-11 batch
trb1[.]co	Shortlink	Device giveaway; 2023-09-11 batch
updtr1[.]co	Shortlink	Quick loan; 2023-12-04
zwt1[.]co	Shortlink	Quick loan
hexe1[.]co	Shortlink	Quick loan; east/west pair
pcpw1[.]co	Shortlink	Quick loan; east/west pair
insu1[.]co	Shortlink	Auto-insurance quote
tese3[.]co	Shortlink	Windfall; successor registered 2026-04-13
dipe3[.]co	Shortlink	Windfall; successor domain
...		representative subset; 50+ verified-malicious shortlink domains

Domains (lander layer)

Value	Role	Notes
digitalpennypincher[.]com	Lander	Template shell; registered the same day as its first shortlink
thetechsentinel[.]com	Lander	Template shell; loads a per-site routing subdomain

Shortcodes (senders)

Value	Role	Notes
25177	Sender	Paired with ccs1[.]co
88142	Sender	Paired with ccpa1[.]co
28579	Sender	Paired with prpr1[.]co
74473	Sender	Paired with apro1[.]co
50462	Sender	Paired with spn3[.]co
45566	Sender	Paired with updtr1[.]co
98442	Sender	Paired with zwt1[.]co
38586	Sender	Paired with hexe1[.]co
63499	Sender	Paired with pcpw1[.]co
62588	Sender	Paired with insu1[.]co
59613	Sender	ttsn2[.]co then tese3[.]co
42341	Sender	dpp5[.]co then dipe3[.]co
21045	Sender	Windfall / gift card
52281	Sender	Missing funds / giveaway
94718	Sender	Device giveaway
...		representative subset; 45+ verified-malicious shortcodes

MITRE Fight Fraud Framework Mapping

This mapping uses the MITRE Fight Fraud Framework (F3) v1.1, https://ctid.mitre.org/fraud. F3 covers post-access fraud behavior, so its application to this lead-harvesting lure operation is analogous rather than literal. Stages without a mapping are noted rather than forced into the framework.

F3 Tactic	Technique	ID
Resource Development	Acquire Infrastructure: Domains	T1583.001
Resource Development	Create Fake Materials: Fake Website	F1020.002
Initial Access	Phishing	T1660
Reconnaissance	Phishing for Information	T1598
Reconnaissance	Gather Customer Information	F1029
Monetization	Lead / data resale (no discrete F3 technique)

Conclusion

The operator's durable asset is the process: buy short .co names in bulk, hold them until their age appears clean, bind each one to a leased shortcode, and place re-spelled successors in front of long-lived landers. Blocking one shortlink or number costs the operator only a single registration from a stockpile bought in 2023. The grammar, same-day registration cohorts and landers provide the signals to watch. The fleet uses the same link shape as legitimate companies, which makes precision harder. Defenses should focus on the operator's grammar rather than the shape alone.