Documented case study · 14 October 2026

From one fake MyChart email to provider-ready evidence.

The message led through hosted content and several redirects to a fake Medicare-kit survey that collected identity and payment information while disclosing a recurring fitness subscription in its terms.

The conclusion

The public-facing service name was Live Free Fitness App, while the final checkout used Easy Promo Finds. No legal operator was disclosed or independently verified. The evidence supported reports to the mail provider, hosting and cloud services, registrars, redirect infrastructure, toll-free administrator, browser safety programs and public agencies. It did not support naming a natural person.

No recipient address, private report number, full telephone number or live abusive link is published here. Provider names and timestamps remain because they explain the method and outcome.

What the email was trying to achieve

The message displayed an unrelated personal name but authenticated through a different Gmail account. Its first link used a DigitalOcean Spaces object. The visitor was moved through tracking and redirect services to a survey with a fixed winning result, a scarcity message and a countdown. The final page requested identity, delivery and card details for a C$11.95 shipping charge. Captured terms also described a 45-day fitness trial followed by recurring 30-day billing, but did not state the post-trial price.

MyChart's own safety guidance describes the same free Medicare-kit pattern: a survey requests contact and payment-card information for a small shipping fee, no kit arrives, and MyChart does not operate giveaways. See the official MyChart scam warning.

The same-day timeline

  1. 01

    10:49 UTC · Redirect evidence recorded

    The exact first redirect was observed with its UTC time, HTTP response, destination and provider request marker. The original message and hosted page were preserved with SHA-256 hashes.

  2. 02

    10:58 UTC · Investigation record completed

    The analysis connected the authenticated sender, hosted object, redirect stages, survey, checkout fields and recurring-subscription terms. The domains were assigned technical roles instead of being treated as one operator.

  3. 03

    11:20–11:25 UTC · Platform reports accepted

    DigitalOcean, Google Cloud and Vercel received reports for the services they controlled. Cloudflare's report required a visible human verification step. A later follow-up added the exact URL and observation details a hostname-only report had lacked.

  4. 04

    11:37–11:55 UTC · Broader reporting completed

    Reports reached the FTC, Competition Bureau Canada, APWG, the Canadian Centre for Cyber Security, Microsoft SmartScreen, Google Safe Browsing, the registrar/host and the toll-free-number administration chain. Each packet was limited to the relevant role.

  5. 05

    15:44 UTC · Hosted object rechecked

    The DigitalOcean Spaces object returned HTTP 403 with an AccessDenied response and was no longer publicly retrievable. The report had been accepted earlier; DigitalOcean did not disclose whether the report caused this state.

What changed after the Cloudflare reply

A hostname by itself did not let the provider reproduce the abusive request. The case was supplemented with the exact observed URL, UTC timestamp, HTTP status, Location header, server marker and Cloudflare Ray ID. The reporting engine now rejects hostname-only Cloudflare packets and requires those observation fields before a report can be prepared.

How the infrastructure was separated

Mail and hosted entry

The authenticated mail account and the hosted object were documented separately. A display name was treated as presentation, not identity.

Redirect services

Each hop was recorded with its own URL, time and response. A reverse proxy was not described as the final website host.

Checkout and subscription

The fields, shipping-fee claim, recurring terms and missing post-trial price were preserved without entering personal or payment data.

Telephone infrastructure

The official toll-free lookup identified Five9 as the Responsible Organization. That establishes the number administrator, not the private subscriber.

What the outcome proves

The public hosted object became inaccessible, reports were accepted, and the evidence process improved. Those facts do not prove who controlled every service, why a provider changed access, or whether every downstream page was removed. The case remains useful because every statement can be traced to an original message, preserved page, protocol observation, public registry or provider receipt.

Use the same evidence structure for a repeated campaign.

See the reporting workflowBuild a provider packet