The Supplement SMS Kit That Borrows Real Business Identities

Since April 2026, one operation has run 26 supplement storefront domains by text message, most carrying the legal identity of a real registered business. The texts invent a personal moment or expert finding, then link to a long sales video for a pill that claims to fix nerve pain, blood sugar, memory or weight. Every sales page we could read loads its video from the same player account, and every order form we opened pays the same merchant account. Three storefronts carry the legal identity of a real US business. Fourteen more display the name and tax number of a real company in Brazil's federal registry, and we could not determine whether those companies are involved.

Key Takeaways

• The same video-player account identifier appears on the sales pages of 23 of the 26 storefront domains, and five order forms from five product lines pay one merchant account. These storefronts are not independent affiliates.
• Three storefronts carry a real US business's legal name in the footer. One copies a nonprofit clinic's address, phone number and tax number exactly. The other two combine real details with details we could not confirm. The sales page fetches this data from a brands.json file when it loads.
• Of the fifteen Brazilian tax numbers we could read on the single-page landers, fourteen resolve to real registered companies. Thirteen of those opened in the same week of January 2023.
• Each storefront uses its own pool of sender numbers, and no number carried two unrelated storefronts. The storefronts therefore connect through the destination, never through a sender.
• The page linked from a text hides its buy button for 29 to 41 minutes of video, runs a countdown that resets at zero and lists refund contacts that cannot be reached.
• Tens of thousands of texts reached thousands of US recipients, most of whom heard from more than one storefront.
• From 2026-08-19, the branded texts open with the recipient's first name. From 2026-10-05, each of their links carries a per-recipient token.

Background

Losses from text-message fraud are rising even as reports decline. The US Federal Trade Commission counted $470 million in reported losses from scams that began with a text in 2024, more than five times the 2020 figure. Its five most-reported text scams are fake delivery notices, job offers, fraud alerts, toll notices and "wrong number" openers. Health products are absent from the list, and we found no earlier public description of the funnel documented here.

The underlying model is the supplement video sales letter. A long video builds a story around a household ingredient, withholds the product until the end, then sells bottles in bundles through a hosted checkout. Sellers usually buy social-media ads for these pages. This operation buys text messages, which go directly to a phone and look like a note from a friend.

The health claims can cost buyers more than the bottles themselves. The lures promise relief from neuropathy, unstable blood sugar and memory loss, using language aimed at readers "after 50" and "past 40". In September 2021, the FTC and the Food and Drug Administration jointly warned ten sellers of supplements marketed as diabetes treatments, and the FDA classed those products as unapproved drugs. A recipient who believes a spoonful of honey steadies blood glucose has a reason to skip the treatment that does.

The operation rents ordinary commercial services throughout: a hosted video player built for sales videos, a third-party checkout that acts as merchant of record, a messaging provider's shared link shortener, two domain registrars and toll-free and local phone numbers. None of those providers is the subject of this post, and we name none of them.

Discovery and Infrastructure

We first found the storefronts through their destinations. We clustered text messages by the domains they linked to, then retained only clusters with a newly registered destination and a rotating or isolated set of sender numbers. This reduced a large body of first-person texts to a handful of supplement sites. Most texts written in that first-person style are legitimate, especially political fundraising, so the wording alone was never enough.

Reading the live sales pages tied the sites together. Each page loads its video player from a URL containing an account identifier, and that identifier is the same on 23 domains. Five order forms from storefronts selling five different products name the same merchant account, with no affiliate attached. Thirteen domains also use one nameserver pair, which supports the connection without proving it.

The complete set contains 26 storefront domains. We publish two here, along with their click hosts, and a separate three-domain cluster. We withhold the others. Most are built from the names of real companies, and we name none that we have not individually cleared.

Indicator	Role	Notes
healthpeaceprosperity[.]com	Storefront	Public homepage plus hidden sales path; registered 2025-09-07; shared player account on the sales path
myhealthyhomecare[.]com	Storefront	Registered 2025-08-12; attributed by click-host setup, lure library and sender pattern; sales path not read
tap.healthpeaceprosperity[.]com	Click host	Per-recipient links through a shared shortener
m.myhealthyhomecare[.]com	Click host	Per-recipient links through the same shortener
go.myhealthyhomecare[.]com	Click host	First seen 2026-09-09

Three more domains (nervi[.]pro, nerves[.]live, kneecare[.]live) sent some of the same sentences word for word, but used a different site builder, a different checkout and their own numbers. We treat them as a separate operator using circulating copy. The builder's trust and safety team had already taken down the destination when we fetched it.

How It Works

The text comes from a number the recipient has never seen. It uses one of five formats: a branded line citing an expert, a "trend" that is "getting shared", a first-person anecdote, a symptom question, or a claim that doctors are discussing an alternative to weight-loss injections. More than a third of the messages had no opt-out wording at all.

The link behaves differently depending on the device. On the multi-page and single-page templates, desktop visitors see a calm supplement page, and the video script never loads. Phone visitors see a headline and a video, while everything else remains hidden.

One storefront rotates eight video variants, with pitches arriving between 33:29 and 41:27. The player displays a fake progress bar that fills quickly before slowing down. The real progress bar is disabled, as is rewinding. The player's only button appears at the pitch time. On the hidden sales paths, the page also withholds the buy section with a timer: 1,754 seconds on one site and 2,370 on another.

The pages surrounding the video promise cures: "Finally End the Tingling, Burning and Discomfort", "permanent results", and a remedy that "works even if you continue enjoying" pasta and dessert. They display a strip of national news network logos, a fake live-newsroom frame stamped by script with today's date, and comment threads headed by invented counts in the tens of thousands. On one page, the "Scientific References" are real diabetes papers with words machine-swapped into weight-loss terms. The countdown returns to 30:00 when it reaches zero, while a "bottles remaining" counter falls by six every eight seconds until it stops at 48.

The price ladder is $79 a bottle for two, $69 for three and $49 for six. On mobile, the six-bottle pack at $294 appears first beside an invented "$894" anchor. Every order form we read takes a single payment. We found no recurring billing, and we did not test what happens after a purchase.

Buyers seeking refunds have few working options. Three storefronts list phone numbers from the range reserved for fiction, and three provide a refund mailbox on a domain with no mail server. One page describes its guarantee as 30, 60 and 90 days. One storefront uses the real clinic's phone number as its customer line, so a buyer calling to complain reaches a medical office with no connection to the product. The product description is also disconnected from the product: the same three checkout items are sold as capsules of one formula on one site and as a scoop of a different formula on another.

The operation sent tens of thousands of messages to thousands of recipients, and every recipient we saw used a US device. Recipients usually received a handful of texts, while the most heavily targeted received dozens over as long as two months. About two thirds were contacted by more than one storefront.

Sample Lures

Recipient names and per-recipient link tokens have been replaced with placeholders. Storefront brand prefixes, withheld domains and the names of universities and drug brands are redacted.

SMS, branded expert claim:

[storefront brand]: [university] Nutrition Researcher: Eat THIS to Transform Your Health, Stay Young, and Live Longer: [storefront domain]/burn

Reply stop to quit

SMS, branded and personalised:

[storefront brand]: [recipient name] quit [weight-loss drug brands]. Natural method works faster & cost less: [storefront domain]/burn

Reply stop to quit

SMS, "trend" line with no opt-out:

A 10-second turmeric sip is getting attention for nerve comfort support after 50. See why: [storefront domain]/go

SMS, first-person anecdote:

Sat on the edge of the bed to take my shoes off and found this. Still had one shoe on 30 minutes later: hxxps[:]//m.myhealthyhomecare[.]com/[slug]

SMS, doctors and weight-loss injections:

This natural alternative to [weight-loss drug brand] is getting attention from doctors... If you want to slim down, this might help: go.myhealthyhomecare[.]com/[slug]

SMS, separate cluster using the same copy style:

Heard about this from my chiropractor and it surprised me. If nerve pain is something you deal with, worth a look - nervi[.]pro/[slug]. Text STOP to unsubscribe.

Technical Analysis

One Account Behind Every Sales Page

The account id is the first path segment in each sales page's player script URL, followed by a per-page test id. The account id remains constant across 23 domains and 24 pages.

Identifier	Where We Read It	Count	What It Shows
Video-player account id	Player script URL on sales pages	24 pages on 23 domains	One player account
Checkout merchant account	Order forms	5 forms, 5 product lines, no affiliate	One seller of record
Nameserver pair	DNS	13 domains	Corroborates only; the pair is shared with unrelated sites

The test ids vary by page. If they use the common layout that starts with a creation timestamp, they indicate how the kit is assembled: the earliest tests were created as two pairs minutes apart in late April 2026, three more appeared within thirteen minutes in mid-May, and one test predates the domain where it now runs by four months. Existing tests are re-skinned for new sites.

The checkout hand-off provides the same confirmation from the other side. Links leave the storefront with a product tag and a campaign tag in the form <source>-<site> or <source>-<site>-<product>. The source prefix is one of three two-letter codes corresponding to the three page templates. The same checkout product identifiers recur across storefronts, including across templates.

Three domains lack page confirmation. One exposes only per-recipient links, one was unreachable and one is a reused domain that hosted the kit for four days.

Three Page Templates

Template	Storefront Domains	Delivery	Footer Identity
Multi-page storefront	4	Toll-free numbers, brand prefix, "Reply stop to quit"	A coined company name; the one terms page we read cites an offshore arbitration seat
Single-page lander	17	One pool of local numbers and one fixed short path per site, no opt-out	A Brazilian company name and tax number where the footer could be read
Public shop with a hidden sales path	4	Local numbers through a shared link shortener, first-person lures	A real US business's legal name on three of four

The remaining domain is the reused one. The third template presents two faces. Its indexable homepage sells a modest product and promises "no countdown clocks" and no invented scarcity. The path linked from the text is marked noindex and uses the countdown, stock counter and fake comment thread.

Portuguese developer strings appear throughout all three templates. Content withheld until the video reveals it uses the class esconder, while script functions have names such as revelarTudo. Those strings do not appear on every page and are not unique to this kit. Several pages still contain template placeholders: video embeds left as YOUR_ID, a note that reads "replace portraits and quotes with your verified UGC", and stock portraits presented as customers.

Identity as a Data Row

The hidden sales pages include a block commented "SMS Compliance Block". It fetches a relative brands.json containing these fields:

domain, companyName, displayName, phone, street, city, state, postalCode, ein

The block uses a hash of the domain to select the footer's label wording, link order, phone format and copyright format, making sibling footers look different. Each deployment exposes only its own row.

Three rows contain a real US business:

• A nonprofit medical clinic in New England. Its legal name, street address, phone number and genuine tax number are copied exactly.
• A salon in upstate New York. The storefront uses its name and former street address, along with a phone number from another state.
• A nutrition company in the Northeast. The storefront uses its name, a tax number and an address we could not independently confirm.

Each business has its own website on a different domain. We found nothing connecting any of them to the storefronts. These fields are the ones a US carrier requests when a business registers to send text messages. We infer that this is why they are present, but we did not observe a registration.

Registry Identities on the Landers

The single-page landers display a Brazilian limited-company name and federal tax number. We could read a tax number on 15 of the 17 landers and checked each one against Brazil's public company registry. Fourteen resolve to a registered micro-enterprise with a legal name matching the footer, while one did not resolve. Thirteen of the fourteen began activity between 2023-01-05 and 2023-01-11. They are based in fourteen cities across eight states and are all filed under sales promotion, direct marketing or advertising. Nine are active, two are listed as unfit and three are closed. Several trade under names unrelated to supplements.

The lander domain names derive from those company names. We could not establish whether the companies are uninvolved businesses whose public records were harvested, or nominees. Companies opened in one week under three activity codes resemble a filtered slice of a public registry, but we cannot show that this is what happened. We therefore name none of them and withhold the domains that would identify them.

Registration Batches

Registered	Domains	Template
2026-03-19, one registrar	12	Single-page lander
2026-08-25, second registrar	4	Single-page lander
2026-09-10, second registrar	2	Multi-page storefront
2026-10-03, second registrar	1	Single-page lander
2026-04-28 to 2026-05-31, second registrar	3	Multi-page storefront and one hidden-path shop
2025-08-12 to 2026-02-07, first registrar	3	Hidden-path shops
2025 (reused)	1	Hosted the kit for four days

The registrar changed in April 2026. Footer style corresponds to the template rather than the registration date. A registration date can narrow a search, but thousands of unrelated domains share it, so the page marker is needed to confirm a candidate.

URL Grammar and Its Changes

The multi-page storefronts serve one product from each named path off the domain root: /boost, /burn, /ear, /manifest, /memo, /nerve and /sugar, with /gut, /joint and /vision added between 2026-09-21 and 2026-10-01. Each single-page lander uses one fixed short path. From May through late July, the multi-page links included a numbered lander variant in the query string, then removed it.

On 2026-10-05, links on all four multi-page storefront domains changed on the same day. Each path now ends with a five-character token assigned per recipient, and the same token reaches the same recipient across three storefronts. Sender numbers remain separate by storefront, while the recipient identifier is shared.

Sender Compartmentation

No sender number carried two unrelated storefronts, and none carried a domain outside the kit. One number followed its storefront when the storefront changed domains. The separation ends at the number block. Senders for four storefronts are in +1-571-298-85xx, while senders for three are in +1-207-579-3xxx; each group was first seen within about a week. We saw no unrelated sender in either range, but the ranges do not belong entirely to the operator and should not be blocked wholesale. Adjacent toll-free numbers proved nothing because the same range contains unrelated senders.

One lure library appears across every template. The same sentence appeared on a single-page lander in May and on a multi-page storefront twelve days later. An anecdote first sent for a hidden-path shop appeared again on a lander within two weeks. Copy by itself does not establish attribution because the same sentences also circulate outside the kit.

Detection Observations

The more persistent signals are on the page and in the link.

• When the page is fetched as a phone, the shared player account identifier in the page source connects a new domain to the kit in one request.
• The toll-free storefronts use a brand prefix, a product path off the domain root and a lowercase "Reply stop to quit" on a separate line. Current links append a five-character suffix to the path.
• The landers send from a local number and use a bare domain with one short path and no opt-out wording.
• A domain with an indexable homepage that disowns countdown clocks and a noindex path that runs one forms a strong pairing.
• A footer legal entity whose own website uses a different domain, a refund mailbox on a domain without a mail server and a contact number from the fictional range are each inexpensive to test.
• Sender reputation by itself will not connect the storefronts. Start with the destination, then confirm using the page marker.
• A real tax number in a footer says nothing about who runs the site. On at least one of these sites, it was copied from someone else.

Indicators of Compromise

All indicators are defanged. Recipient data has been removed. Most storefront domains are withheld because their names come from the name of a real company.

Domains

Value	Role	Notes
healthpeaceprosperity[.]com	Storefront	Hidden sales path
myhealthyhomecare[.]com	Storefront	Sales path not read
nervi[.]pro	Redirector	Separate cluster
nerves[.]live	Landing	Separate cluster; removed by the site builder
kneecare[.]live	Landing	Separate cluster
...		Representative subset; 24 further storefront domains withheld

Hosts

Value	Role	Notes
tap.healthpeaceprosperity[.]com	Click host	Per-recipient links
m.myhealthyhomecare[.]com	Click host	Per-recipient links
go.myhealthyhomecare[.]com	Click host	First seen 2026-09-09

Page Markers

Value	Type	Notes
0becd9a1-c128-4b07-a7d1-b3f261cc971d	Video-player account identifier	First path segment of the player script URL on every confirmed sales page

Phone Numbers

Value	Role	Notes
+1-844-876-1267	Sender	Toll-free; multi-page storefront
+1-833-311-1422	Sender	Toll-free; multi-page storefront
+1-844-569-4879	Sender	Toll-free; multi-page storefront
+1-844-292-9245	Sender	Toll-free; multi-page storefront
+1-833-725-5651	Sender	Toll-free; multi-page storefront
+1-844-992-0162	Sender	Toll-free; multi-page storefront
+1-833-439-4166	Sender	Toll-free; multi-page storefront
+1-475-999-0304	Sender	Local number; hidden-path shop
+1-475-222-1011	Sender	Local number; hidden-path shop
+1-334-961-7840	Sender	Local number; hidden-path shop
+1-224-337-1802	Sender	Local number; single-page lander
+1-203-793-0415	Sender	Local number; single-page lander
+1-419-830-7435	Sender	Local number; single-page lander
+1-781-318-0758	Sender	Local number; separate cluster
...		Representative subset; 100+ verified-malicious sender numbers

MITRE Fight Fraud Framework Mapping

Mapping aligns to the MITRE Fight Fraud Framework (F3) v1.1, https://ctid.mitre.org/fraud. F3 centers on financial-account fraud and is scoped to post-access fraud behavior, so this mapping of a pre-access sales lure is an alignment by analogy. Stages with no discrete F3 technique are noted, not forced.

F3 Tactic	Technique or Observed Behavior	ID
Resource Development	Acquire Infrastructure: Domains	T1583.001
Resource Development	Create Fake Materials: Fake Website	F1020.002
Resource Development	Establish Accounts	T1585
Resource Development	Real businesses' legal identities placed in storefront footers; no discrete F3 technique
Initial Access	Phishing (unsolicited text messages carrying the sales link)	T1660
Stealth	One sender pool per storefront, device-dependent page content and noindex sales paths; no discrete F3 technique
Execution	Delayed-reveal sales video with scripted scarcity; no discrete F3 technique
Monetization	One-time card payment through a hosted checkout; no discrete F3 technique

Conclusion

A new storefront requires a domain, an identity row and some numbers. Existing video tests and lure sentences can move onto it within two weeks. Blocking numbers costs the operation little because it was designed so the numbers never connect. Every storefront shares the player account and merchant account, making the page marker the first place new storefronts appear. The three US businesses whose legal names appear in these footers may not know about it, and they have the most to lose.