Five Landers, One Template: An SMS PII-Harvest Operator

Between July 2025 and July 2026, one SMS lead-generation operator ran a paid-clinical-trial pretext across five landing pages built from a single template. Texts offering $3,000 to $4,000 for a "study slot" arrived from numbers rented on a shared SMS aggregator and pushed recipients into intake funnels whose own published privacy disclosures claim to collect and sell Social Security numbers, driver's license numbers, and bank and card numbers. Real clinical trials pay participants and do not ask for any of that at recruitment. What makes this operator worth writing up is not the lure, which is ordinary, but how sloppily it linked its own infrastructure together: a copyright string it forgot to change is the cleanest attribution artifact we have seen in this vertical.

Key Takeaways

• Five landing-page domains across two unrelated pretexts, clinical-trial recruitment and government benefits, resolve to one operator through shared build conventions rather than shared hosting.
• The strongest single artifact is an un-rebranded Terms of Use footer reading © 2023 Paid Clinical, Inc. on a domain marketed under a completely different brand name.
• An rd. click-tracking subdomain appears on every operator domain that has any subdomain at all, making it the most durable cross-vertical pivot in the set.
• One lander sat registered and unused for roughly five and a half years before its first observed campaign use, which defeats domain-age heuristics outright.
• The relay layer generates pronounceable, low-entropy pseudo-brand hostnames, so entropy-based domain-generation filters under-score it by design.
• A legitimate, disclosed lead-generation broker runs the same site template and the same consent-capture vendors, so template similarity alone cannot separate lawful operators from this one.

Background

Clinical-trial recruitment is an unusually good pretext because the legitimate version of it really does involve strangers contacting consumers about paid medical studies. That makes the lawful and unlawful versions hard to separate on tone alone, which is exactly why this operator chose it.

The legitimate process has structure. Recruitment materials, including web ads and text messages, go to an Institutional Review Board for approval before any screening call happens. The sponsor registers the study on ClinicalTrials.gov, which produces a public NCT number anyone can look up. Pre-screening collects health-eligibility information tied to the study's inclusion and exclusion criteria. Participant payment compensates time and travel, is written into the informed consent document, and is reviewed in advance precisely so it cannot function as an inducement to enroll.

None of the five landers in this cluster names a sponsor, cites an NCT number, references an IRB, or claims FDA registration. One of them states outright that it is not a medical or healthcare provider and does not conduct clinical trials.

The other half of the context is where the data goes. The US Federal Trade Commission has been explicit that a legitimate clinical trial should not ask for a Social Security number during recruitment or screening, and that a trial demanding identifiers or financial details up front is a fraud indicator. Leads gathered under health pretexts are generally not used by a single named buyer; they are auctioned to downstream lead generators and telemarketers. In August 2025 the FTC settled with lead generator MediaAlpha and its subsidiary QuoteLab for $45 million, part of a $145 million action alongside Assurance IQ, over collecting sensitive information from consumers under misleading health-insurance framing and channeling it into abusive telemarketing. The FTC noted MediaAlpha sold roughly 119 million consumer leads in 2024, and that it drew traffic using domains implying government affiliation. The operator described here uses the same two moves at smaller scale.

Delivery runs over a shared number-pool aggregator. Aggregators handle carrier provisioning so a single short code or long code can reach every wireless network without per-carrier agreements, and those numbers are leased assets routinely shared or sub-leased across unrelated tenants. This matters for attribution: a rented number can carry one operator's traffic this month and someone else's next month, so the sending number is among the weakest signals available. We saw that directly in this data set, where one of the operator's own shortcodes also carried unrelated final-expense and disability-screening content in the same window.

Discovery and Infrastructure

The cluster came into view from two seed landers, paid-clinicals[.]com and triallooks[.]com, and expanded through build conventions rather than through hosting overlap. Sweeping for the rd. click-tracking subdomain pattern across SMS traffic surfaced three further operator domains, two of which run an entirely different pretext. Across the twelve months, the cluster pushed thousands of messages through seven rented sending identities.

Indicator	Role	Notes
paid-clinicals[.]com	Primary lander	Amazon Registrar, created 2023-03-30. Subdomains rd. web. web3. go.
medtrial-usa[.]com	Lander	Amazon Registrar, created 2025-07-28. Footer names a different brand entirely
triallooks[.]com	Lander	GoDaddy, created 2025-07-25. Bare-apex path tokens, no rd. host
fiscal-friend[.]com	Lander, benefits pretext	Amazon Registrar, created 2024-02-06
claim-your-benefits[.]com	Lander, benefits pretext	Amazon Registrar, created 2020-07-16. Subdomains rd. ssdi.
lsm.<word>.it[.]com	Redirect relay	11 rotating hosts on a legitimate parking provider

Two name collisions need stating plainly, so that research does not turn into collateral blocking. medtrial-usa[.]com has nothing to do with MedTrials, Inc., the contract research organization that has operated out of Dallas for roughly three decades at medtrials.com. The names are adjacent and that is all. Similarly, the hyphenated fiscal-friend[.]com is unrelated to the legitimate products trading as "Fiscal Friend" without the hyphen, among them a personal-finance app and a Facebook page of that name. Neither real business is connected to this operator, and neither should be blocked on the strength of this write-up.

The two pretexts are worth separating. The clinical vertical promises payment for study participation. The benefits vertical, carried under the FF: and CYB: prefixes, promises help tracking an unclaimed stimulus payment, screening for disability benefits, county benefit programs, or final-expense coverage. Several of those lures target older recipients explicitly, including disability screening pitched at adults over 50 and final-expense plans pitched at people born before 1974.

Three named entities appear in the operator's own page furniture: "Paid Clinical, Inc." in a copyright footer, "48395 Marketing LLC" as a registrant, and "Fiscal Friend, Inc." in another footer. We could not find an independent operating company behind any of the three. They are registrant and template artifacts rather than real businesses, and we treat them as such.

How It Works

A recipient gets a text carrying a short branded prefix, a first name pulled from a purchased list, a compensation figure, and a scarcity claim. The link goes to an rd. subdomain, which redirects to the lander proper. From June 2026 the clinical vertical added a second hop through a relay host on a shared parking provider, so the URL a recipient sees no longer contains the operator's own domain name.

The lander asks for very little. The intake form on medtrial-usa[.]com is a single step collecting an age band, gender, a yes/no/unsure answer about medical issues, first and last name, email, and a phone number, plus SMS consent checkboxes. There is no Social Security field on that form.

The disclosed scope is another matter. The compliance page on paid-clinicals[.]com carries a CCPA category table with an explicit collected column, and marks as collected the statutory category defined to include a Social Security number, driver's license or state identification number, insurance policy number, bank account number, credit card number, debit card number, and medical or health-insurance information. The same page states that in the preceding twelve months it sold that category to third parties.

Two caveats belong with that, because a public claim deserves them. Every row in that table is marked collected, which is a known artifact of CCPA policy generators that pre-populate all categories regardless of actual practice. The recipient category the page names is "third parties who provide the legal-related products and/or services featured on the Site," which is leftover boilerplate from a legal-services template sitting on a clinical-trials site. So what we can show is the disclosure, not the collection. The gap between a six-field form and a published claim to sell government identifiers is itself the finding, and it reads either as a longer downstream funnel or as an operator publishing a policy it does not follow.

Sample Lures

All recipient identifiers are replaced with placeholders. URLs and path tokens are defanged and redacted.

Clinical vertical, urgency and deadline framing:

PCT: Last call for [recipient name]. Your slot on our paid research trial
expire on [date]. $3k for each participant
rd[.]paid-clinicals[.]com/<token> to stop rply Stop

Clinical vertical, fabricated match claim sent to recipients who never signed up:

TrialLooks: Youre matched! (2) new clinical trials pay up to 3,500 each!
Join now triallooks[.]com/<token> reply stop to opt out

Clinical vertical, the newest lander:

MDTU: [recipient name], volunteers for our next clinical study can earn
up to $3k - claim your spot here: rd[.]medtrial-usa[.]com/<token>

Relay-routed variant, carrying a precise payout figure and a capital-I homoglyph substitution in "slots left":

Get paid $3,175.67 for a clinical-trial near you. Just a few sIots Ieft -
Signup by today http[:]//lsm[.]keldravo[.]it[.]com/<token>

Benefits vertical, disability screening aimed at older recipients:

CYB: [recipient name], New SSDI screening for adults 50+ is open. Check if
you qualify in 1 min here: rd[.]claim-your-benefits[.]com/<token>
to stop text Stop

Benefits vertical, note the consistent misspelling of "stimulus":

FF: Track down your stimlus [recipient name] Here's how you can find
yours at rd[.]fiscal-friend[.]com/<token>

Technical Analysis

The Shared Site Template

The five landers are one build, reskinned. On medtrial-usa[.]com the Terms of Use footer still reads © 2023 Paid Clinical, Inc., naming the brand of a different domain in the same cluster, and the homepage hero video is served under the filename Paid-Clinicals-Main-Hero.mp4. The privacy-policy body is word-for-word identical to paid-clinicals[.]com, differing only in brand name and revision date. fiscal-friend[.]com carries the same policy opener and the same verbatim GDPR and CASL passage stating that the operator does not accept referrals from citizens outside the United States.

The apexes are also worth reading against the texts that point at them. Checked while writing this, fiscal-friend[.]com resolves to a generic personal-finance content site, titled "Fiscal Friend - Your Guide to Financial Products," carrying credit-card and insurance articles plus testimonials. It says nothing about stimulus payments, unclaimed money, or benefits anywhere, which is the entire premise of the FF: texts that route to it. The lure lives on the rd. path and the apex holds filler. Any review that opens the apex, finds unremarkable financial content, and stops there will clear a domain whose actual funnel it never saw.

Below the copy, the landers share tooling. Each embeds a third-party push-notification SDK from the same path. The clinical landers both load a lead-capture script from the LeadSalesHub lead marketplace, carrying a per-brand campaign key: PAID-CLINICALS on one, MEDTRIAL-USA on the other. LeadSalesHub is a real two-sided lead marketplace and the operator is a customer selling leads into it, not its owner. The same is true of the consent-capture layer: TrustedForm and Jornaya, both now under ActiveProspect, are industry-standard TCPA certification vendors used across the lawful lead-generation industry, and their presence is not a scam signal.

That last point cuts against easy conclusions. A legitimate, disclosed recruitment broker operating as Clinical Media, LLC runs the same site template family and the same consent-vendor stack, publishes its own SMS shortcode, and honors a standard opt-out. Its intake collects contact and demographic fields and no government identifiers. Template overlap does not separate it from this operator. The intake scope and the disclosure do.

Registration Cohorts and Aged-Domain Staging

Four of the five operator domains sit on Amazon Registrar, spanning both pretexts, with triallooks[.]com the lone GoDaddy outlier. The registration-to-first-use lag is the more interesting column.

Domain	Registered	First observed use	Lag
claim-your-benefits[.]com	2020-07-16	2026-01-13	~5.5 years
paid-clinicals[.]com	2023-03-30	2025-07-31	~28 months
fiscal-friend[.]com	2024-02-06	2025-12-16	~22 months
medtrial-usa[.]com	2025-07-28	2026-07-02	~11 months
triallooks[.]com	2025-07-25	2026-03-11	~7.5 months

Nothing here is register-and-burn. Every domain was held for months or years before its first send, and claim-your-benefits[.]com sat unused for more than five years. Domain age is therefore useless as a risk signal against this operator, and so is registration recency. Note also that triallooks[.]com and medtrial-usa[.]com were registered three days apart on different registrars, then staggered into service roughly eight months apart, which points to inventory bought ahead of need rather than provisioned per campaign.

Third-party reputation data offers little help. At the time of our pull, all five domains showed no VirusTotal malicious detections, and general-purpose reputation scores rated them between 76 and 100 on benign-leaning scales. Services that score registration completeness and site structure rather than content behavior will read a well-built lead-gen funnel as legitimate, because structurally it is well built.

Subdomain Grammar

Subdomains across the cluster are short, single-purpose functional tokens.

Domain	Observed subdomains
paid-clinicals[.]com	apex, go., rd., web., web3.
medtrial-usa[.]com	apex, rd., web.
claim-your-benefits[.]com	apex, rd., ssdi., www.
fiscal-friend[.]com	apex, rd.
triallooks[.]com	apex only

rd. is the redirect and click-attribution host, web. and web3. look like landing-page tiers or iterations, go. is an entry point, and ssdi. is pretext-specific. Every operator domain that has a subdomain at all has rd., which makes it the single most durable structural pivot in the set and the pattern that exposed the benefits vertical.

What the Cluster Does Not Share

The negative result is as useful as the positive ones. There is no shared mail or DNS infrastructure across the five domains. One publishes an enforcing DMARC policy, two publish monitor-only DMARC, one publishes an Amazon SES sender policy, and one returns no records at all. We found no shared hosting or nameserver overlap tying the verticals together.

This is compartmentalized on the layers a defender would normally pivot on, and careless on the layers nobody expects to be checked. Attribution here comes from copyright strings, asset filenames, script paths, campaign keys, and subdomain naming, not from infrastructure co-location. Any pivot strategy that starts and ends at shared hosting would have found two unrelated clusters.

The Relay Layer and Its Word Generator

From June 2026 the clinical vertical routed through 11 hosts shaped lsm.<word>.it[.]com. The apex belongs to a legitimate hosting and domain-parking provider and is shared multi-tenant space; an unrelated operator uses the identical structure with a drv. prefix. The discriminating signal is the lsm. prefix plus campaign correlation, never the parent domain.

The generated words are the interesting part. All 11 are seven or eight lowercase characters, three syllables, alternating consonant and vowel blocks, with consonant blends like cr, dr, tr, and qu. Ten of the eleven end in a vowel. They read as pseudo-Latinate brand-name generator output, closer to pharmaceutical naming than to random strings: corvanta, keldravo, ulvexia, quantilo, ultravo, crevona, torluma, sivmora, vornakio, evoxral, raxmilo.

That construction sidesteps a whole class of control. Randomness-based domain-generation scoring, the standard industry approach, assigns low suspicion to pronounceable low-entropy words, so any filter built to catch random consonant strings reads this cohort as ordinary vocabulary. The durable signal is structural rather than statistical: fixed prefix, single generated word, then the parking provider's domain.

Path tokens run nine to eleven mixed-case alphanumeric characters with no separator or extension. They are not independently minted per message. Tokens issued on the same day share a stem across different relay hosts, with onifX... and onifZ... appearing on two hosts on 10 June and a jfZs... stem on two more hosts on 23 June. That points to same-day batch generation from a shared counter, and it links hosts that otherwise have nothing in common.

Rotation over the 29-day window averaged a new relay host every 2.6 days, front-loaded in pairs and then thinning to singles. Hosts were reused for several message variants within a day before being retired, so this is cheap-burner behavior on legitimate shared hosting rather than per-message rotation.

Message Template Structure

Seven branded prefixes map to landers, which is how the operator runs parallel personas over shared sending infrastructure.

Prefix	Destination	Pretext
PCT:, PaidClinical:	paid-clinicals[.]com	Paid research study, deadline framing
MDTU:	medtrial-usa[.]com	Paid clinical study, per-volunteer figure
TL:, TrialLooks:	triallooks[.]com	Fabricated match claim
FF:	fiscal-friend[.]com	Unclaimed stimulus tracking
CYB:	claim-your-benefits[.]com	Benefits, disability screening, final expense
none	lsm.<word>.it[.]com	Precise-figure clinical payout

PCT: is simply the abbreviation of PaidClinical:, and both point at the same lander, which is what let us read the prefix scheme as a routing table rather than as noise. MDTU: appeared on a shortcode pointing at paid-clinicals[.]com months before medtrial-usa[.]com entered service, so the persona preceded its own domain.

Payout figures split into two tiers. The branded prefixes use round capped amounts, "up to $3k" or "up to 3,500." The unbranded relay tier uses randomized figures with cents in a tight $3,175.67 to $3,985.34 band, engineered to look individually calculated rather than advertised. We counted roughly 15 distinct sentence templates across the prefix families.

Evasion in the copy is light but consistent: capital-I substituted for lowercase-l in "sIots Ieft," and a persistent misspelling of "stimulus" as "stimlus" across both benefits prefixes. Apostrophes are stripped throughout ("Youre matched," "Heres how"), which is a generation artifact rather than deliberate obfuscation, though it is consistent enough to serve as a weak fingerprint.

Detection Observations

Behavioral signals that distinguish this traffic from lawful recruitment messaging:

The prefix-plus-colon opener followed by a first name and a capped dollar figure is a compact, stable shape. Legitimate recruiters identify themselves by organization name rather than by a two-to-four character code, and they do not lead with compensation.

Absence of verifiable study references is the strongest content signal. Lawful recruitment can cite an NCT number, a sponsor, or a named site. A recruitment message that offers a specific dollar amount and a deadline while naming no study is asserting something it cannot support.

The rd.<domain> shape as an SMS click target is a cheap structural pivot, and in this cluster it crossed pretexts. A defender who groups by CTA subdomain convention rather than by hosting will see one operator where hosting-based grouping sees two.

Relay hostnames built from pronounceable invented words on a shared parking provider do not register as random. Keying on the fixed subdomain prefix plus the single-generated-word-then-provider structure is more reliable than any entropy measure.

Same-day path-token stem reuse across different relay hosts is a strong short-window correlation signal, and it survives host rotation.

Neither domain age nor third-party reputation score is useful here. Landers were aged deliberately, one for more than five years, and general-purpose reputation services rated all five as low-risk.

Finally, the intake-scope test is what separates this operator from lawful brokers running the same template: whether the funnel's own disclosures claim government identifiers and financial-account numbers, and whether the sender identifies itself. Structural similarity to a legitimate broker is expected in this vertical and is not by itself evidence of anything.

Indicators of Compromise

All indicators below are defanged. Recipient data has been removed. The 11 rotating relay hosts are described by pattern rather than enumerated, since each is short-lived transit on a shared legitimate provider whose apex must never be blocked.

Domains

Value	Role	Notes
paid-clinicals[.]com	Landing	Primary clinical lander, Amazon Registrar, created 2023-03-30
medtrial-usa[.]com	Landing	Clinical lander, Amazon Registrar, created 2025-07-28
triallooks[.]com	Landing	Clinical lander, GoDaddy, created 2025-07-25
fiscal-friend[.]com	Landing	Benefits lander, Amazon Registrar, created 2024-02-06
claim-your-benefits[.]com	Landing	Benefits lander, Amazon Registrar, created 2020-07-16

Hosts

Value	Role	Notes
rd.paid-clinicals[.]com	CTA redirect	Click-attribution host
rd.medtrial-usa[.]com	CTA redirect	Redirects to the lander apex
rd.fiscal-friend[.]com	CTA redirect	Benefits vertical
rd.claim-your-benefits[.]com	CTA redirect	Benefits vertical

Phone Numbers and Shortcodes

Sender-attributed only. All numbers are leased from a shared aggregator pool, so treat them as operator-rented rather than operator-owned.

Value	Role	Notes
+1-312-209-9214	Sender	Primary clinical sender, carried the relay layer
+1-312-209-9213	Sender	Benefits vertical, CYB: prefix
+1-833-508-9305	Sender	Toll-free, TrialLooks lure
+1-855-957-4997	Sender	TL: prefix
27512	Sender	Shortcode, PCT: and MDTU: prefixes
87562	Sender	Shortcode, MDTU: to medtrial-usa[.]com
20979	Sender	Shortcode, CYB: prefix

Patterns

Value	Type	Notes
lsm.<7-8 char invented word>.it[.]com	Relay host	11 observed. Never block the provider apex
PCT:, PaidClinical:, MDTU:, TL:, TrialLooks:, FF:, CYB:	Body prefix	Prefix maps to destination lander
$3,1XX.XX to $3,9XX.XX with cents	Payout figure	Relay tier only
sIots, Ieft, stimlus	Homoglyph and typo	Capital-I for lowercase-l; misspelled "stimulus"

MITRE Fight Fraud Framework Mapping

Mapping aligns to the MITRE Fight Fraud Framework (F3) v1.1, https://ctid.mitre.org/fraud. F3 is scoped to post-access fraud behavior, so this pre-access lead-generation operation maps only partially, and unmapped stages are noted rather than forced.

F3 Tactic	Technique	ID
Reconnaissance	Phishing for Information	T1598
Reconnaissance	Gather Customer Information	F1029
Resource Development	Acquire Infrastructure: Domains	T1583.001
Resource Development	Create Fake Materials: Fake Website	F1020.002
Initial Access	Phishing	T1660
Initial Access	Impersonate Official	F1032
Monetization	Resale of harvested lead data to downstream buyers; no discrete F3 technique covers lead brokerage

Impersonate Official applies to the benefits vertical, where the lures reference disability screening, county benefit programs, and unclaimed government payments. The clinical vertical impersonates no specific institution and instead invents an unnamed one.

Conclusion

This operator's tradecraft is asymmetric in a way worth remembering. It compartmentalized the layers defenders habitually pivot on, keeping mail, DNS, and hosting separate across five domains, then left a previous brand's name in a copyright footer and its own asset filenames. It aged domains for years to defeat recency scoring, then routed every one of them through a subdomain named rd.. The lesson for anyone mapping lead-generation infrastructure is that build conventions outlive operational hygiene, and the artifacts worth collecting are the ones nobody thinks to clean: script paths, campaign keys, asset filenames, and the strings in a footer.