Fabricated Authority: A Self-Hosted Fake-Cure Supplement Email Cluster

Since January 2026, a single operator has sent fake-cure supplement email to US consumers using invented doctors and fabricated studies. The operator runs fourteen coined health and finance sender domains, each with its own self-hosted links.<domain> click-tracking host. Every message uses the same social-engineering shell: a named "doctor" persona, a made-up Harvard or other university study, and a one-scoop miracle for diabetes, nerve pain, failing eyesight, or stubborn weight. The infrastructure is deliberately ordinary. Real product apexes, full email authentication, and a mainstream marketing platform give the messages a legitimate surface, while all of the deception remains in the content.

Key Takeaways

• One operator runs fourteen coined health and finance sender apexes, and every apex self-hosts its own links.<apex> click-tracking host. That self-resolving send-host convention, rather than the shared marketing platform, is the durable operator fingerprint.
• Sending uses two rails: a shared marketing-platform return-path pool and per-domain cloud-mail return-paths that follow a fixed short-label subdomain grammar (default., crp., e., rp., return.). Twelve of fourteen apexes authorize the same platform in SPF.
• Domain registration divides into an aged and corporate-held cohort (2002 to 2018) and a purpose-built 2022 to 2024 cohort, including an adjacent-day registration pair and a privacy-redacted .org pair from the same registrar.
• Each message combines fabricated authority (named doctor personas, invented university studies, religious "God's Painkiller" framing) with a coffee, powder, or salt-water "fix." It then monetizes through a CPA affiliate redirect whose sub-ID is keyed to the sending list.
• Members are linked by verbatim subject reuse across sibling domains and a shared persona spanning two apexes. A 2026 wave of newly active senders uses content indistinguishable from that of the established members.

Background

Deceptive supplement marketing is one of the most durable pretexts in consumer email, and the products in this cluster have already been documented. Independent consumer and security reporting on names such as Gluco6, Prostadine, and Curafen describes the same playbook used by this operator: aggressive spam distribution, fake news articles, invented clinical studies, and AI-generated celebrity endorsements attributed to public figures who never made them. The US Food and Drug Administration maintains a standing health-fraud product database because this category recycles the same fabricated-authority tactics across thousands of products. The lures target fear and aging: diabetes, neuropathy, vision loss, joint pain, cancer, and the current wave of GLP-1 weight-loss interest.

The products come and go. The sending machine behind them is what makes this cluster worth mapping. Two legitimate services carry most of the traffic. The high-volume rail uses a mainstream marketing-automation platform, a Toronto-based email service used by many real retail brands, and shares its multi-tenant return-path pool with unrelated legitimate senders. The low-volume rail uses commodity cloud email (Amazon's Simple Email Service) with per-domain return-paths. Neither service is complicit. The operator abuses both because a trusted sending reputation and clean authentication help deceptive mail reach the inbox. The operator supplies the layer on top: the coined apexes, self-hosted trackers, and content. Bulk messages include a physical-address footer that points to a shared Wyoming registered-agent mail-drop, the kind of anonymized business address commonly used to satisfy anti-spam law without exposing an operator.

Discovery and Infrastructure

Across a five-month window beginning in mid-January 2026, the cluster sent tens of thousands of messages. We first identified a single high-volume sender, then expanded outward using two signals: the shared marketing-platform return-path pool and a repeated content fingerprint. A sweep of the platform's return-path pool exposed the obvious trap. The pool is multi-tenant and carries health senders, finance senders, and unrelated lifestyle brands, so platform membership alone does not bind them. The useful link is structural and content-based: every operator apex uses a links.<apex> host that resolves to the apex itself instead of the platform's shared tracking domain, while the messages reuse fabricated-study language and even entire subject lines across supposedly independent brands.

Together, those signals separated the operator's infrastructure from the platform's other tenants. Fourteen apexes matched, each with its own self-resolving send host. Thirteen operate in health verticals. One, pertxpert[.]com, applies the same build to an alt-investment "earning opportunity" vertical, identifying finance as the operator's non-health line rather than the work of a separate actor. One member, northstarvitamins[.]com, is somewhat distinct: it is an aged corporate-registered domain that relays through a different shared provider and authorizes a shared email-fulfillment company in SPF. We therefore treat it as infrastructure-adjacent rather than proof of a wider corporate tie.

Indicator	Role	Notes
links.getlymphsavior[.]com	Send / CTA host	Self-resolving click-tracker on the apex; "Dr. John Jairo" persona
links.getnervesavior[.]com	Send / CTA host	Sibling of the lymph host, same persona and template
links.meridianhealthprotocol[.]org	Send / CTA host	"God's Painkiller" religious-cure arm
mb.northstarvitamins[.]com	Send host	Relays via a separate shared provider; SPF authorizes a mail-fulfillment company
pxp.pertxpert[.]com	Send host	Finance / alt-invest sibling arm

How It Works

A representative message begins with a subscription-claim footer ("You have been subscribed because you previously ordered or showed interest"). This invents a prior relationship that most recipients never had. The body presents a short narrative in the voice of an authority figure: a retired surgeon, a named doctor, or an unnamed "Harvard researcher." The pitch always asks for one trivial action, such as adding a scoop of powder to morning coffee or following a salt-water routine before bed. It describes the action as a suppressed discovery that doctors or "Big Pharma" do not want people to know. Sensational numbers follow ("11 lbs gone in 14 days," "study run three times to be sure").

The call to action is an italicized inline link to the apex's own links.<apex>/a/<id>/click/... tracker. This operator-controlled first hop records the click, then redirects to a third-party cost-per-action affiliate network. Its tracking template includes the offer, affiliate ID, and a sub-ID keyed to the sending list. The visitor then reaches the supplement's own order page. The recipient sees a health tip from a doctor, while the operator sees a monetized click attributed to the exact list that produced it.

Sample Lures

All samples are defanged. We have redacted every recipient identifier and per-recipient tracking token; only attacker-side content remains.

Fake retired-surgeon eyesight pretext, religious-cure arm:

From: "Bad Eyesight" <george@meridianhealthprotocol[.]org>
Subject: Losing your night driving? [warning emoji]
Return-Path: <[list-token]@default.meridianhealthprotocol[.]org>

Hi [recipient],

Before you let anyone near your eyes with a scalpel:

A retired eye surgeon just went public with the reason most of his
cataract patients, he says, never needed to be on the surgery list.

Thirty years in the operating room taught him something strange.
Patients at 82 reading fine print without glasses. Others at 63
already prepped for surgery. Same age, opposite outcomes.

It was a 2-minute daily habit, one no eye doctor had ever mentioned.
[ CTA -> http[:]//links.meridianhealthprotocol[.]org/a/<id>/click/... ]

Fabricated "Harvard" weight-loss pretext, "Brown Compound" persona:

From: "Brown Compound" <samuel@curafen[.]org>
Subject: [coffee emoji] + 1 tbsp = 11lbs gone in 14 days
Return-Path: <[list-token]@default.curafen[.]org>

Hi [recipient],

Harvard researchers just uncovered a strange "brown powder."

The instruction is simple: stir 1 scoop into your morning coffee or tea.
That's it. No diet. No exercise.

Within 24 hours it flips a hidden switch inside your fat cells, putting
your body into round-the-clock "fat-burning" mode.

The researchers ran the study 3 times before publishing because the
numbers looked too good:
  - Up to 11 lbs of fat gone in the first 14 days
  - 4.5 inches off the average waist in 6 weeks
[ CTA -> http[:]//links.curafen[.]org/a/<id>/click/... ]

Named-doctor persona, self-hosted tracker on the shared marketing-platform rail:

From: "Dr. John Jairo" <support@getlymphsavior[.]com>
Subject: Is Your "Eye Drain" Blocked? Do This Before Bed
Return-Path: <[list-token]@be2.maropost[.]com>
List-Unsubscribe: <http[:]//links.getlymphsavior[.]com/a/<id>/one_click_unsubscribe/...>

[ image-based lure body; CTA resolves to
  http[:]//links.getlymphsavior[.]com/a/<id>/click/... ]

Technical Analysis

Two-Tier Send Architecture

The operator uses two sending rails in parallel. The high-volume rail rotates return-paths through a shared marketing-platform pool (be1[.]maropost[.]com through be6[.]maropost[.]com). Members using this rail include getlymphsavior[.]com, getnervesavior[.]com, and naturalmentor[.]com. The low-volume rail uses per-domain cloud-mail return-paths that follow a fixed short-label subdomain grammar on the operator's own apex:

Return-path label	Example	Rail
default.<apex>	default.meridianhealthprotocol[.]org, default.curafen[.]org	Cloud mail
crp.<apex>	crp.supplementcafe[.]com, crp.barbannews[.]com	Cloud mail
e.<apex>	e.gluco6[.]com, e.prostadine101[.]com	Cloud mail
rp.<apex>	rp.metaboflexmail[.]com	Cloud mail
return.<apex>	return.mybacktolifesystem[.]com	Cloud mail
be<n>.maropost[.]com	be2.maropost[.]com	Shared platform pool

Twelve of the fourteen apexes authorize the same marketing platform in their SPF records, even when the visible return-path uses per-domain cloud mail. This is another cross-member tell: independent supplement brands do not converge on one platform authorization by chance. Authentication is clean throughout the cluster. SPF, DKIM, and DMARC pass on the operator-owned domains, and northstarvitamins[.]com even publishes a strict DMARC reject policy. Clean authentication on a coined health apex does not establish legitimacy here. It is a basic requirement for reaching the inbox.

Registration Cohorts and Aged-Domain Staging

Public WHOIS divides the apexes into two distinct cohorts. An aged group (registered 2002 to 2018) blunts reputation scoring by presenting long-lived domains. A purpose-built group (2022 to 2024) records the operator's more recent expansion. The registrar split is narrow: seven on GoDaddy, six on Namecheap, and one on GoDaddy's corporate-registration service.

Apex	Vertical	Send-host / return-path	Registrar	Created	Cohort
northstarvitamins[.]com	cancer / GLP-1	mb.<apex> (separate provider)	GoDaddy Corporate	2002-01-22	Aged / corporate
supplementcafe[.]com	diabetes / bladder	crp.<apex>	GoDaddy	2009-01-12	Aged
transformationinsider[.]com	food-fear + finance	shared platform pool	GoDaddy	2010-04-18	Aged
naturalmentor[.]com	weight / gut	shared platform pool	Namecheap	2013-02-11	Aged
curafen[.]org	cancer / cholesterol	default.<apex>	Namecheap	2017-08-23	Aged; .org pair
meridianhealthprotocol[.]org	joint / religious	default.<apex>	Namecheap	2017-09-18	Aged; .org pair
mybacktolifesystem[.]com	back pain	return.<apex>	GoDaddy	2018-06-26	Aged
prostadine101[.]com	prostate	e.<apex>	Namecheap	2022-05-24	Purpose-built
getnervesavior[.]com	nerve	shared platform pool	GoDaddy	2022-12-07	Purpose-built; adjacent-day pair
metaboflexmail[.]com	weight-loss	rp.<apex>	GoDaddy	2022-12-08	Purpose-built; adjacent-day pair
gluco6[.]com	diabetes / glucose	e.<apex>	Namecheap	2023-05-11	Purpose-built
barbannews[.]com	multi-vertical news	crp.<apex>	GoDaddy	2023-07-10	Purpose-built
pertxpert[.]com	finance / alt-invest	pxp.<apex>	Namecheap	2024-05-13	Purpose-built; finance sibling
getlymphsavior[.]com	lymph / edema	shared platform pool	GoDaddy	2024-08-02	Purpose-built; savior pair

Two batch signals are especially visible. getnervesavior[.]com and metaboflexmail[.]com were registered on consecutive days through the same registrar. curafen[.]org and meridianhealthprotocol[.]org form a same-registrar .org pair; both are privacy-redacted and were registered about a month apart. These batches expose the provisioning seams of a single operator across domains that otherwise appear to be unrelated brands.

Registration date does not equal activation date. Several purpose-built apexes (gluco6[.]com, curafen[.]org, metaboflexmail[.]com, northstarvitamins[.]com) remained quiet until a 2026 wave brought them into active sending. They used the same fabricated-authority content as members that had been live since the beginning of the year. The operator staged the registrations in advance and sent the messages later.

Domain and Persona Generation

Apex names draw from a small template vocabulary: get<organ>savior (nerve, lymph), <product>101 (prostadine), <product>mail (metaboflex), <product>6 (gluco), and pseudo-editorial coinages (barbannews, supplementcafe, naturalmentor, transformationinsider, meridianhealthprotocol). The finance arm uses the pertxpert / pxp short form.

The personas are the operator's real product. A single sending address rotates through dozens of display names, combining a stable persona with topic-token variants:

Sender	Persona and display-name rotation
support@getlymphsavior[.]com, support@getnervesavior[.]com	"Dr. John Jairo," "Dr. J," "Dr. Jairo," "Dr. Tom Jennings," plus topic forms ("SWOLLEN ANKLES & FEET," "memory loss?") and order-update aliases
george@meridianhealthprotocol[.]org	"God's Painkiller," "Hidden Bible Cure," "Jesus's Disciples," "Vaccine from God," "OZEMPIC EXPOSED," "Big Pharma Secret"
samuel@curafen[.]org	"Brown Compound," "TRUTH:," "LDL warning," "Curafen Team"
reply@prostadine101[.]com	"Jeremy," "Jeremy Moore," "Jeremy Moore at Prostadine," "Prostadine Refill"
info@gluco6[.]com, mail@metaboflexmail[.]com	"Tony Bailey," "Paul @ Metabo Flex"
support@transformationinsider[.]com	pure topic tokens, no personal name ("Avoid Eggs," "BAKING SODA," "48 Hour Warning (SpaceX IPO)")

The named-doctor personas provide the trust pretext. The topic-token names frustrate naive subject-keyword grouping by changing on nearly every send.

Self-Resolving Send Hosts and CPA Monetization

The strongest operator-owned signal is the links.<apex> host. Legitimate retail mail sent through an ESP routes clicks through the ESP's shared tracking domain. In this cluster, each apex hosts its own tracker on itself, producing URLs in the form http[:]//links.<apex>/a/<numeric-id>/click/<hash>. The first hop belongs to the operator. It redirects to a third-party CPA affiliate network using a template with this structure:

http[:]//tracking.<cpa-network>[.]com/aff_c?offer_id=<n>&aff_id=<n>&aff_sub2=mp_<list-id>

The aff_sub2=mp_<list-id> value attributes each monetized click to the exact sending list, connecting the operator's tracker layer to its campaign management. The same links.<apex> host serves the one-click unsubscribe and creative images, making the self-hosted tracker essential to the whole send rather than an added component. Every one of these hosts is classified in our reputation data as health-scam infrastructure, or as investment-scam infrastructure for the finance arm.

Cross-Cluster Pivots

Four signals connect the members beyond their use of the shared platform. First is verbatim subject reuse: the line "The Simple Salt Water Fix To Transform Your Blood Sugar" appears on getlymphsavior, getnervesavior, and prostadine101; "Doctors Beg: Rub This on Your Hip for Sciatic Nerve Pain" appears on barbannews, getlymphsavior, and getnervesavior. Second is a shared persona: "Dr. John Jairo" appears on both savior apexes. Third, the get<organ>savior sibling pair (nerve registered 2022, lymph 2024) shares a registrar, template, persona, and rail. Fourth, the pertxpert finance arm applies the identical build (self-resolving links.<apex>, cloud-mail return-paths, CPA redirect) to a different vertical. This identifies it as the same operator's alt-investment line rather than the work of a separate actor.

Detection Observations

These behavioral signals describe the operator rather than auditing any detection stack.

• The self-resolving links.<apex> host is the highest-value pivot. A click tracker whose hostname equals the sending apex is normal for a first-party sender, but unusual for high-volume promotional mail, which generally routes clicks through a shared ESP tracking domain. Combined with fabricated-authority content on the same apex, it is a strong signal.
• The content combines three elements that rarely appear together in legitimate retail mail: an invented institutional study ("Harvard researchers," "ran the study 3 times"), a named medical-authority persona, and one trivial "fix" (coffee, powder, salt water) that promises specific large outcomes in days.
• Verbatim subject reuse across otherwise independent sender domains is an ecosystem-level tell. A single message resembles ordinary supplement spam. The operator becomes visible when sibling domains are correlated through shared subject strings and the shared persona.
• The affiliate redirect template with a list-keyed sub-ID (aff_sub2=mp_<list-id>) is a durable monetization fingerprint that remains useful after apex rotation.
• Clean SPF, DKIM, and DMARC on a coined single-product health apex should increase rather than reduce scrutiny. Full authentication on operator-owned infrastructure is exactly what this cluster uses to appear legitimate.

Mitigation and Guidance

• Correlate senders using the self-resolving links.<apex> pattern and shared subject strings, rather than the shared marketing platform, which is multi-tenant and proves nothing by itself.
• Treat a first-party click tracker whose hostname matches a coined single-product supplement apex as a clustering seed. Pivot from it to sibling apexes that share the same registrar and registration batch.
• Flag the CPA redirect template with a list-keyed sub-ID as a monetization fingerprint, and use it to connect apexes without obvious naming overlap.
• Do not consider clean authentication or an aged registration date exculpatory for a single-product health apex. Both are staging choices in this playbook.
• Monitor registration seams, including adjacent-day and same-registrar privacy-redacted batches, as a provisioning tell that connects domains presented as unrelated brands.

MITRE Fight Fraud Framework Mapping

This mapping uses the MITRE Fight Fraud Framework (F3) v1.1, https://ctid.mitre.org/fraud, which extends ATT&CK-style structure with fraud-native Positioning and Monetization tactics. We state the rows below as observed behavior rather than named F3 techniques because this cluster is a pre-access lure operation, while F3 covers post-access fraud behavior.

Tactic	Observed behavior	How this campaign expresses it
Resource Development	Acquire Infrastructure	Aged and purpose-built coined apexes, each with a self-hosted links.<apex> tracker; two send rails
Initial Access	Unsolicited Message	Bulk email under a fabricated prior-relationship subscription claim
Initial Access	Impersonation of Authority	Named "doctor" personas, invented Harvard and other university studies, religious "God's Painkiller" framing
Execution	Persuasive Urgency and False Claims	Specific miracle outcomes in days, anti-pharma framing, single trivial "fix"
Monetization	Affiliate Redirect / Direct Sales	Operator tracker to CPA affiliate network keyed to the sending list, then supplement order page
Stealth	Anonymized Registration and Address	Privacy-redacted WHOIS and a shared registered-agent mail-drop footer

Indicators of Compromise

All indicators are defanged. We have removed recipient data. This is a representative, export-safe subset of the operator's confirmed infrastructure.

Senders

Value	Role	Notes
support@transformationinsider[.]com	Sender	Highest-volume member; topic-token display names
george@meridianhealthprotocol[.]org	Sender	Religious "God's Painkiller" arm
support@getnervesavior[.]com	Sender	"Dr. John Jairo" nerve persona
support@getlymphsavior[.]com	Sender	"Dr. John Jairo" lymph persona
crew@pxp.pertxpert[.]com	Sender	Finance / alt-invest arm
mail@barbannews[.]com	Sender	Fake-news health framing
reply@prostadine101[.]com	Sender	"Jeremy Moore" prostate persona
info@naturalmentor[.]com	Sender	Weight / gut newsletter persona
help@supplementcafe[.]com	Sender	Diabetes / bladder persona
nsncs@mb.northstarvitamins[.]com	Sender	Cancer / GLP-1 arm; separate relay; infrastructure-adjacent, lower confidence
info@gluco6[.]com	Sender	"Tony Bailey" glucose persona
samuel@curafen[.]org	Sender	"Brown Compound" persona
mail@metaboflexmail[.]com	Sender	"Paul @ Metabo Flex" persona
newsletter@mybacktolifesystem[.]com	Sender	Back-pain newsletter

Domains

Value	Role	Notes
transformationinsider[.]com	Sender apex	GoDaddy, 2010; flagship
getnervesavior[.]com	Sender apex	GoDaddy, 2022; adjacent-day pair
getlymphsavior[.]com	Sender apex	GoDaddy, 2024; savior pair
meridianhealthprotocol[.]org	Sender apex	Namecheap, 2017; .org pair
gluco6[.]com	Sender apex	Namecheap, 2023
curafen[.]org	Sender apex	Namecheap, 2017; .org pair
metaboflexmail[.]com	Sender apex	GoDaddy, 2022; adjacent-day pair
northstarvitamins[.]com	Sender apex	GoDaddy Corporate, 2002; aged; infrastructure-adjacent, lower confidence
barbannews[.]com	Sender apex	GoDaddy, 2023
supplementcafe[.]com	Sender apex	GoDaddy, 2009; aged
naturalmentor[.]com	Sender apex	Namecheap, 2013; aged
mybacktolifesystem[.]com	Sender apex	GoDaddy, 2018
prostadine101[.]com	Sender apex	Namecheap, 2022
pertxpert[.]com	Sender apex	Namecheap, 2024; finance sibling

Hosts

Value	Role	Notes
links.getnervesavior[.]com	Send / CTA host	Self-resolving click tracker
links.getlymphsavior[.]com	Send / CTA host	Self-resolving click tracker
links.prostadine101[.]com	Send / CTA host	Self-resolving click tracker
links.meridianhealthprotocol[.]org	Send / CTA host	Self-resolving click tracker
links.mybacktolifesystem[.]com	Send / CTA host	Self-resolving click tracker
links.barbannews[.]com	Send / CTA host	Self-resolving click tracker
links.supplementcafe[.]com	Send / CTA host	Self-resolving click tracker
mb.northstarvitamins[.]com	Send host	Relays via a separate shared provider
pxp.pertxpert[.]com	Send host	Finance arm
links.pxp.pertxpert[.]com	Send / CTA host	Finance arm click tracker

Conclusion

The products in this cluster are disposable, but the sending machine is not. The operator surrounds fabricated medical authority with a surface borrowed from legitimate services: clean authentication, aged domains, and a mainstream marketing platform. Beneath that surface is a self-hosted tracking layer that can outlast the takedown of any single brand. Defenders should expect the apexes to rotate while the structural tells remain: the self-resolving links.<domain> convention, the list-keyed affiliate redirect, and the reused personas and subject lines. Those seams will remain relevant as the next cohort of coined supplement domains comes online.