A Toll-Free SMS Clickbait Ring Funneled Through One Shortener

Since at least November 2025, a coordinated SMS operation has blasted US phones with health and investment clickbait, sending its messages through one shortener. Its lures follow two tracks that use the same infrastructure: conspiratorial health-supplement pitches (an Alzheimer's cure that "won't come from a lab," a "$1 Pink Gelatin Trick" for weight loss) and financial-conspiracy investment teasers ("Trump's new money grid," a "Trill-ELON-naire" window tied to SpaceX). Both pass through slk1[.]io, the shared link domain of the commercial SMS-marketing platform used to send the messages, before reaching a rotating set of supplement stores and newsletter landing pages. The traffic behaves like affiliate blasting: recipients are directed to whichever offer pays that week, while clicks and lead data are collected along the way.

Key Takeaways

• The durable pivot is the link domain considered alongside the toll-free pool and lure pattern. More than 90 toll-free sending numbers rotate in and out, and nearly all of their tracked links pass through the same platform link domain, slk1[.]io.
• The operation relies on toll-free capacity and spreads its traffic thinly across many numbers to stay below per-number spam thresholds.
• Some texts address recipients by first name, and some follow up with past buyers of the advertised products. This indicates that the senders use named contact lists instead of random numbers.
• Each link contains a per-recipient nine-digit tracking ID in the platform's standard link format, so no two message URLs match. The stable clustering key is the link host combined with the sender and lure pattern.
• Some texts include the STOP2End opt-out footer, a widespread bulk-SMS convention used by many unrelated senders and platforms. The footer attributes nothing on its own.

Background

We found the ring during a routine SMS survey after two senders used the same unusual short link. Per-sender volume was deliberately low, so no individual number looked busy. When we re-aggregated on the shared link host and toll-free lure pattern, the rotation came back together. This exposed one coordinated operation, or a small set of cooperating senders, active for nearly eleven months and still sending, responsible for thousands of unsolicited texts.

A link shortener conceals the true destination behind a neutral-looking link. It lets a sender change the landing page for each click without altering the SMS text, and it bypasses simple domain blocklists based on the final page. slk1[.]io is the shared link domain of a commercial SMS-marketing platform. The platform's legitimate customers, including entertainment venues and online retailers, also send their links through it. The operation sends from one or more customer accounts on that platform and uses its link tracking in the same way as other customers.

The operation sends through text-enabled toll-free numbers. These numbers are cheap to lease in bulk from aggregators and support high throughput. Rotation across many numbers ("snowshoeing") distributes the volume thinly enough to evade per-number thresholds and consumer 7726 ("SPAM") reports. Carrier and CTIA messaging rules prohibit snowshoeing, and text-enabled toll-free numbers now have to pass a verification process, showing how established this playbook is. Affiliate and lead-generation networks create the financial incentive by paying a commission for each click, lead, or sale sent through a tracked link carrying the affiliate's sub-ID. An unauthorized affiliate buys a bulk phone list, sends unsolicited lures, and earns money from the redirect whether or not the advertiser at the end approved the traffic.

Neither pretext is new. Health-supplement "miracle cure" direct-response marketing and financial-newsletter investment teasers are long-running forms of clickbait. Both borrow authority from the current news cycle. The health track cites suppressed research and named public figures, while the investment track uses Trump-venture and Musk-wealth angles that have featured prominently in recent coverage of retail-investor losses. Text-message fraud is also growing as a consumer channel overall, with the FTC reporting roughly $470M in text-scam losses in 2024.

Discovery and Infrastructure

The sending pool is almost entirely toll-free. More than 90 distinct US toll-free numbers carry the lures, concentrated in the +1-833 range. +1-844, +1-855, +1-866, +1-877, and +1-888 numbers make up the rest. Not every toll-free number on the platform belongs to the operation. Other customers also send from toll-free lines, and most short codes and local numbers on slk1[.]io belong to those other customers.

One link domain carries the clicks from those numbers. Every tracked link in the operation resolves through slk1[.]io, while the landing pages behind it rotate weekly. The operator-controlled landers follow a recognizable direct-response naming pattern: get<product>.com supplement funnels and occasional shop-style domains registered in cohorts across 2025 and into 2026.

Indicator	Role	Notes
getnervecalm[.]com	Supplement lander	Direct-response nerve-support funnel
getyusleep[.]com	Supplement lander	Direct-response sleep funnel; WHOIS privacy
getfemicore[.]com	Supplement lander	Direct-response women's-health funnel; WHOIS privacy
getneuralrevive[.]com	Supplement lander	Direct-response brain/focus funnel
slimvitashop[.]com	Weight-loss lander	Recently registered store-style funnel; WHOIS privacy
pandastyle[.]life	E-commerce bait lander	Cheap-TLD burner, no WHOIS record

Not every destination behind the link domain belongs to the operator. Some links resolve to offer pages owned by legitimate direct-response advertisers and financial publishers. The traffic monetizes those companies as destinations. Because an unauthorized affiliate can direct traffic to any offer that pays, a legitimate advertiser's landing page can appear in the redirect chain without the advertiser authorizing the SMS blasts. We have deliberately excluded those third-party pages from the indicator set below.

How It Works

A recipient enters one of the operation's lists and receives a short teaser text from a toll-free number. The message uses a suppressed-cure or insider-money cliffhanger and ends with a tracked link and an opt-out footer. When the recipient taps the link, the click passes through slk1[.]io. The platform records the per-recipient tracking ID embedded in the URL, then forwards the click to the lander selected by the sender. The lander either sells a supplement directly or collects lead data (name, contact, sometimes payment) through an affiliate funnel. The SMS text stays the same while the destination rotates, allowing the same lure to point to a new offer with no visible change for the recipient.

Sample Lures

The samples below are verbatim apart from defanging, with the per-recipient tracking ID replaced by [recipient-id].

Health track:

That constant ringing in your ears isn't normal. One hidden cause could
be the key. Discover what helps => slk1[.]io/2vu1/[recipient-id]

Reply STOP to Unsubscribe

This unusual pink gelatin trick is finally making waist shrink when
nothing else worked. See what it is: slk1[.]io/2y6c/[recipient-id]

Reply STOP to opt out

Investment track:

Market Alert: "Trill-ELON-naire" Incoming!

That's $1,000,000,000,000.

I was right about SpaceX.

Here's your final window.

slk1[.]io/3wo4/[recipient-id]

STOP2End

$909 billion a day starts migrating onto Trump's new money grid. Every
transfer consumes "digital oil." Here's how to own it.
hxxps://slk1[.]io/3ikk/[recipient-id]

Technical Analysis

The Link Funnel

The operation's clicks converge on slk1[.]io. Its links use a fixed pattern: a four-character slug followed by a nine-digit number, as in hxxps://slk1[.]io/3xwp/209665866 or hxxps://slk1[.]io/3xvv/243264319. The slug identifies the link carried by a message, including its lure track and offer. The nine-digit suffix is a per-recipient tracking ID. This is the platform's standard format and gives the sender click-level attribution for each person. Because every URL is unique, matching the full URL string produces no clusters.

The domain is shared platform infrastructure, so the host alone is not an attribution key. The same domain carries links for legitimate customers, including short-code senders backed by established businesses. We can distinguish the operation by combining the link domain with the toll-free sending pool, the two lure genres, and the rotating sender-name prefixes (Market Alert: on the investment track, and health-sounding outlet or company names on the health track, some of them borrowed from unrelated real businesses that have no part in the operation). The durable asset is the operation's sending access on the platform, which preserves capacity and link tracking as individual numbers burn.

Sender Rotation and Snowshoeing

The number pool is intended to burn. Individual toll-free numbers appear, send for periods ranging from days to weeks, and disappear when fresh numbers replace them. Reputation accrues per number, so a steady supply of new numbers allows some traffic to continue sending cleanly before any one number attracts enough reports to matter.

Landing-Page Rotation and Registration Cohorts

The operator-controlled landers fall into identifiable registration cohorts, one of the more persistent fingerprints available here. Public WHOIS lists several registrars and creation dates, not one bulk purchase. The pattern is consistent with an operator launching new funnels as older ones burn.

Domain	Registrar	Created	Role
getnervecalm[.]com	GoDaddy	2025-02-18	Supplement lander
getyusleep[.]com	Namecheap (privacy)	2025-04-04	Supplement lander
getfemicore[.]com	Namecheap (privacy)	2025-04-14	Supplement lander
getneuralrevive[.]com	GoDaddy	2025-11-20	Supplement lander
slimvitashop[.]com	Namecheap (privacy)	2026-04-28	Weight-loss lander
pandastyle[.]life	(no WHOIS)	unknown	E-commerce bait

The naming pattern is another signal. The get<product>.com format is standard for direct-response supplement funnels. Here it appears across coined product names that do not map to any established consumer brand. New store-style domains (slimvitashop[.]com, the cheap-TLD pandastyle[.]life) appear when the rotation refreshes.

Affiliate-Blaster Monetization

The combination of operator-built supplement funnels and offer pages owned by legitimate advertisers exposes the business model. This is not a brand-impersonation ring or an operation selling a single product. Most traffic treats the recipient list as inventory and the offer catalog as interchangeable, sending whichever offer pays. That explains why legitimate, unrelated advertisers appear as destinations in the redirect chain. An affiliate earns money from the click or lead, while the advertiser at the end never sees or approves the SMS that generated it. Some of the traffic is not cold outreach. Certain texts follow up with past buyers of the advertised supplements, so part of the traffic appears to run on behalf of the offer owners themselves.

Shared Footers and Link Domains

The STOP2End opt-out footer is a widespread bulk-SMS convention used by many unrelated senders across many platforms. Only a minority of this operation's texts include it; many use a plain "Reply STOP" line, and some have no footer at all. The link domain is similarly shared. The operation's traffic sits within the platform's broader, largely legitimate customer base, making it difficult to separate. The footer and link domain do not support attribution on their own. Each is a lead that requires correlation with the content, sender, and funnel.

Detection Observations

Structural behavior across many messages distinguishes this traffic from legitimate marketing:

• The link domain re-aggregates the rotation when combined with other signals. Sender numbers rotate freely while the link domain persists. Because the same domain also carries links for the platform's legitimate customers, it identifies this operation only when considered with the toll-free sending pool and lure pattern.
• Per-recipient nine-digit path IDs prevent URL-string matching. Any approach based on the full URL sees only singletons.
• Named greetings and buyer follow-ups distributed across unrelated sending numbers point to shared contact lists. They are invisible on one number and become visible only when senders are correlated.
• Opt-out footers, including STOP2End, are conventions shared by many senders, so they cannot support attribution alone.
• In combination, a toll-free sender, a platform short-link CTA, a conspiratorial authority teaser, and a rotating sender-name prefix form a strong composite signal.

MITRE Fight Fraud Framework Mapping

This mapping follows the MITRE Fight Fraud Framework (F3) (https://ctid.mitre.org/fraud). We list only F3 techniques with confirmed identifiers. We omitted mappings for generic mass-SMS solicitation and disposable-infrastructure acquisition and did not assign an unverified or cross-framework identifier.

Tactic	Technique	ID
Reconnaissance	Gather Customer Information (named contact lists, first-name greetings)	F1029
Initial Access	Impersonate Official (authority framing via named experts, agencies, publications)	F1032

Indicators of Compromise

All indicators are defanged. Recipient data has been removed. Third-party advertiser destinations monetized by the operation without authorization are deliberately excluded, as is the shared SMS platform's link domain.

Sending Numbers

Value	Role	Notes
+1-833-445-0414	Sender	Investment track, most active
+1-844-460-8138	Sender	Investment track
+1-833-554-2820	Sender	Investment track
+1-833-545-4277	Sender	Both tracks
+1-833-950-4276	Sender	Investment track
+1-855-774-8143	Sender	Both tracks
+1-888-455-9169	Sender	Health track, weight-loss lures
+1-833-657-4771	Sender	Both tracks
+1-888-286-4604	Sender	Health track
+1-888-514-5170	Sender	Health track
+1-844-871-6598	Sender	Health track
+1-844-963-4681	Sender	Health track
...		(representative subset of the operation's toll-free sending pool)

Domains

Value	Role	Notes
getfemicore[.]com	Landing	Supplement lander
getnervecalm[.]com	Landing	Supplement lander
getneuralrevive[.]com	Landing	Supplement lander
getyusleep[.]com	Landing	Supplement lander
slimvitashop[.]com	Landing	Weight-loss lander
pandastyle[.]life	Landing	E-commerce bait lander

Conclusion

Sender numbers are cheap and disposable. The operation's access to a commercial SMS platform is the scarcer asset. It provides the sending capacity and link tracking that every message needs, and that is where defenders have the most leverage. Cluster on the link domain together with the toll-free pool and lure pattern, then send the evidence through the platform's abuse process. Monitor the landers as the rotation changes, and watch for the operation moving to another platform, because sending capacity is harder to replace than the lure.