Between 4 September and 7 October 2026, nine research-peptide vendors asked vialaudit for coverage, a listing or an affiliate deal. The highest offer was 40% of every referred order, repeat orders included (Hello Stacks); the next was "up to 35%" paid "via Zelle or crypto" (Peptide.Express). We are accepting one deal, Pepspan's 10% code, and only after we finish a pending lab cross-check. LabFirst Peptides and Curo are on watch until December 2026. We declined or excluded the other six. The size of an offer told us more about the vendor than about the deal.
Nine vendors pitched vialaudit in five weeks. The largest offer was 40% of every order a referred customer places, for life. We are accepting one deal, at 10%, and not yet. Two vendors go on a watch list. Six are out.
A vendor that writes to a publisher shows how it sells and how it pays. You can run most of the checks we ran before your first order.
What were we offered?
| Vendor | Pitch date | Offer | Our verdict | Main reason |
|---|---|---|---|---|
| Hello Stacks | 28 Sep | Raised from 20% to 40% of every order, repeats included, plus a code | Audit published, deal declined | Rate double what it pays another reviewer; terms let it withhold pay over "regulatory exposure" |
| Peptide.Express | 16 Sep | "Up to 35%" cash, via Zelle or crypto | Declined | No named operator; payout rail; lab with a 2026 domain |
| Costides | 13 Sep, 27 Sep (x2) | 10% referral | Declined | Two-month-old domain; lab domain registered after its test date |
| PForm Labs | 8 Sep | Listing request and samples; site pays 20% then 10% for 12 months | Declined | Certificates only on its own server; research kit with insulin syringes |
| NextGenPeps | 25 Sep to 5 Oct | Five or more "listing" requests, no detail | Declined | Self-hosted certificates; seeded-looking Reddit posts |
| Chameleon Peptides | 10 Sep, 17 Sep | Coverage request | Excluded | Closed to new purchases on 27 Sep |
| LabFirst Peptides | 5 Oct (follow-up) | 21 lots at Kovera, "28 more" in testing; site pays 15% of first order | Watch, re-check Dec 2026 | Lab records real; business six weeks old |
| Curo | 2 Oct | Asked for an audit; public referral pays 5% in store points | Watch, re-check Dec 2026 | Lab reports name it; lab lookup gated; runs a competing tracker |
| Pepspan | 4 Sep, 7 Oct | Code VIALAUDIT10: 10% off, 10% commission | Accepting, pending | Janoshik cross-check on its page not yet done |
Why is a high commission a warning sign?
Because someone pays for it, and it is usually you. A vendor that hands 40% of every order to a publisher, and a discount code to the buyer on top, needs a gross margin well above 40% on everything it sells. That is our inference, but the price list supports it. On the Hello Stacks audit we found its sister brand's prefilled pens cost a median 3.05x the per-mg price of the same compound in a Hello Stacks vial.
The same vendor pays less elsewhere. PeptideBenchmark disclosed on 1 October 2026 that it "may earn 20%" on Hello Stacks orders. The offer to us started at 20% and rose to 40%. Hello Stacks' public affiliate terms publish no rate at all ("disclosed upon acceptance") and say it "may withhold unpaid commissions where content creates legal or regulatory exposure". Under that clause, our own audit page, which covers HGH and GLP code names, could cost us the commission. We did not want an arrangement where what we publish affects what we are paid, so we declined.
What does a normal rate look like? We only have two kinds of source, and both have limits:
- Published programs. A comparison of seven programs dated 25 August 2026 lists published rates from 10% to 30% and calls 10% "the most common published rate". Its author, Validated Peptides, is a vendor comparing itself with rivals, so treat the ranking with care. The raw rates are on each program's own page.
- The pitches we got. Curo pays 5% in store points. Costides offered 10%. LabFirst pays 15% of a new customer's first order only. PForm pays 20% of the first order and 10% of reorders for 12 months. NextGenPeps advertises up to 20%.
Against that, 35% and 40% are outliers. Pepspan's 10%, the only offer we are taking, sits at the floor.
Why do Zelle and crypto payment rails matter?
Peptide.Express' partner page says: "Get paid in cash via Zelle or crypto — not store credit." Its example shows $35,000 in commission on $100,000 of referred sales. Programs that pay through a bank usually ask for a tax form: LabFirst pays by ACH and requires a W-9; PForm pays by ACH from a $50 minimum. A program that pays only through Zelle or crypto leaves no bank-to-bank record of who paid whom, and gives the partner no tax paperwork. We do not take payouts we cannot account for, so we stayed out.
The rail matters more on the buyer side. Zelle says on its own security page that "unlike a credit card, Zelle does not offer a protection program for any authorized payments", including when an item never arrives or is not as described. Crypto has no chargeback either. Card networks are also where vendors get cut off. Chameleon Peptides told customers its banks had received Visa notices before it closed, and it briefly reopened to existing customers on Bitcoin and Zelle (see our vendor closures tracker).
What the pitching vendors take at checkout, as of 9 October 2026:
- PForm Labs: its FAQ lists Zelle, or Melio for bank transfer or card. It explains that card processors have shut down accounts "in our industry".
- LabFirst Peptides: Zelle, Cash App or Venmo, no card, according to PeptidePrices (6 October). We did not run a checkout ourselves.
- Curo: cards, plus Zelle and crypto, per Peptigrity.
- Peptide.Express: cards, wallets and crypto, per PeptidePrices. Here the problem is the partner payout, not the checkout.
A six-week-old domain with a full COA page
LabFirst Peptides is the most polished pitch we received, and the youngest: its domain was registered on 25 August 2026. The public record, in order:
| Date (2026) | Event | Source |
|---|---|---|
| 25 Aug | labfirstpeptides.com registered (Amazon Registrar) | RDAP |
| 24 Sep | zipdo.co publishes a "Top 10" list ranking LabFirst first at 9.1/10 | zipdo.co |
| 28 Sep | Kovera creates the records for the three lots we looked up, under one order | Kovera's public verification system |
| 29 Sep | All 21 lots on the COA page show "tested 2026-09-29"; every lot code ends "-2609" | LabFirst COA page |
| 5 Oct | Follow-up to us: "28 more lots at Kovera" with sterility and endotoxin | Our inbox |
| 6-8 Oct | Three articles titled "LabFirstPeptides.com Guide: …" appear on three unrelated sites | offthemrkt, noobpreneur, rawmags |
The zipdo ranking came before any certified lot existed. The same page, read on 9 October, still says LabFirst's COA portal "currently has no certified lots" in several places, next to newer text praising 21 of them. The three guide articles share a headline format and a subject, which suggests placed content. We have not confirmed whether LabFirst paid for any of it.
What holds up. On 9 October we looked up three LabFirst certificates on Kovera's own verification system: KVR-2026-402EE1 (MOTS-c, lot LF-18A-2609), KVR-2026-F84AE3 (Semax, LF-24B-2609) and KVR-2026-D2CBCF (BPC-157, LF-05B-2609). All three matched the shop's cards exactly and named "LabFirst Peptides" as client. PeptidePrices reports it matched all 21 against Kovera's originals; it also publishes a LabFirst discount code. LabFirst's return policy refunds a lot in full, with no time limit, if an independent lab finds the wrong compound, purity below 99% or content below 85% of label.
What does not hold up yet. One lab, one order, one test date. Kovera's public view of the three records hides the LC-MS section. We could not confirm the 28 extra lots, because Kovera's system cannot list records we do not already have a token for. The catalog includes retatrutide and tirzepatide, the products FDA and Lilly targeted in August (see our letters article). Kovera itself carries open questions, covered in Is Kovera Labs legit?.
What would change our view: a second set of lots tested on later dates, the extended-panel lots resolving at Kovera, a card checkout, and a named legal entity. We re-check in December 2026.
Costides is younger still. Its domain was registered on 12 August 2026 (RDAP). Its COA page lists three retatrutide certificates from "Biolumin Labs" and says: "Test results on this page come from customers and large group orders." bioluminlabs.com was registered on 16 September 2026 (RDAP). Peptide Critic reported on 27 September that the stated test date was 14 September, two days earlier, and that the mass-spectrum caption contradicts the identity result printed beside it. A lab can test before it launches a website, so the dates alone do not show that anything was invented. They do leave a new vendor, a new lab and customer-sourced results, with no record we could check independently.
The other pitches, vendor by vendor
Peptide.Express. Domain registered 25 January 2026 (RDAP). Peptide Grades found no legal entity, business address or named operator, and neither did we. PeptidePrices, which publishes a Peptide.Express code, matched 26 of 29 retained reports; Mistral Diagnostics returned no record for reports 27442 and 40844. mistraldiagnostics.com was registered on 2 March 2026 and sits on parking nameservers (RDAP). PeptidePrices' catalog table lists GLP-3R and HGH 191AA. peptide.express and costides.us also use the same Cloudflare nameserver pair, princess and kipp. That can point to a shared Cloudflare account, but Cloudflare gives the same pair to many unrelated customers. The link is circumstantial, and we are not claiming the two shops share an owner.
PForm Labs. Domain registered 7 July 2025 (RDAP). Its 22 BioRegen certificates are PDFs on PForm's own server, with no link to a lab lookup, and each carries the security key "PFORMLABS". On the retatrutide report (#11485) the lab printed "Batch/Lot #: N/A", while the site shows a batch number for the same product. The shop sells GLP-1S, GLP-2T and GLP-3R, and a Peptide Research Kit with bacteriostatic water and 10 insulin syringes. FDA's 31 March 2026 letter to Prime Sciences cited a kit of BAC water and "a syringe" as evidence of intent to inject. Its partner page tells affiliates to "talk about the compounds you already use".
NextGenPeps. Domain registered 30 April 2025 (RDAP). It sent five or more follow-ups between 25 September and 5 October asking for a "listing", without saying what it wanted listed. Its certificates sit on its own pages. On 9 October its homepage listed GLP-RT and GLP-TZ code names, HCG, and a Telegram link. On Reddit, two posts a day apart in June 2026 carry edits that read alike: "I ordered my semaglutide from nextgenpeps" in r/Semaglutide and "I ended up getting my semaglutide from a site called nextgenpeps" in r/NoStupidQuestions. The pattern is consistent with seeded posts. We cannot tell who wrote them. Separately, a 27 April 2026 r/PeptidePathways post describes an emergency and rheumatology workup after a blend the poster says came from NextGenPeps. One account proves nothing about cause.
Curo. Domain registered 6 April 2026 (RDAP). Curo asked for an audit and named no commission. Its strength is paperwork: PeptideBenchmark reported on 22 September that BT Labs' copies of Curo's reports read "customer CURO", and Curo archived its lot table on Zenodo. The weak spot is access: the BT Labs links on its COA page open a form that asks for your name and email first, so a reader cannot re-check anonymously. PeptideBenchmark saw a retatrutide-coded "RTA-GLP3" listing on 21 September; we found no GLP listing on 9 October. Curo also runs a vendor tracker that competes with ours, so a commercial deal would be a conflict. If we cover Curo, it gets a public-data page with no affiliate link. Re-check December 2026.
Chameleon Peptides. It asked for coverage on 10 and 17 September and closed to new purchases on 27 September. On 9 October its storefront still read "Chameleon Peptides is now closed for new purchases" and "New account registration is closed."
Pepspan. The one offer we are taking: code VIALAUDIT10, 10% off for you and 10% commission for us. Pepspan has a UK company number and sells no GLP products. Our Pepspan page still lists the Janoshik cross-check against the lab's own listing as not done. The code goes on that page only after that check is complete. If the check fails, the deal is off.
Our acceptance checklist: use it before you order
We apply these seven checks to every vendor that pitches us. All of them work for a buyer with a browser.
- Resolve every certificate on the lab's own site. Type the report number into the lab's lookup yourself. The record should name the vendor as client and match the compound, lot and figures. A PDF on the vendor's server proves only that the vendor made a PDF (how forged COAs worked at Paradigm). A lookup gated behind your name and email is a weaker check.
- Check that lot numbers are real batch IDs. One lot code on nine different peptides cannot name a batch. Match the lot on your vial to the lot on the record.
- Look for an identity test. HPLC purity can read 99% on the wrong molecule. You want LC-MS or another identity result on the report.
- Check the domain and the operator. Look up the domain at rdap.org. A shop under six months old with a full certificate library needs a second look. Find a legal entity and a street address that is not a mailbox. Check the lab's domain date too.
- Check how you pay. Card checkout gives you a chargeback right. Zelle-only, P2P-only or crypto-only checkout gives you none.
- Read the catalog for FDA-cited patterns. GLP code names, bac water, insulin syringes, reconstitution calculators and prefilled pens all appear in the 2026 letters. The decoder is in peptide code names. A vendor selling that mix carries regulatory risk that its paperwork does not show.
- Read the affiliate terms behind the reviews you trust. Watch for a rate well above the 10-30% that published programs pay, a rate kept secret, or a clause that cuts pay over critical coverage. Check whether the reviewer discloses the rate.
For the failure modes these checks map to, see how peptide vendors fail.
What we did not check
We placed no orders, tested no vials and asked no vendor for comment. We could not resolve Mistral Diagnostics reports ourselves; the Peptide.Express match counts are PeptidePrices'. We could not verify LabFirst's 28 extra lots or its checkout. We did not give our name to BT Labs' lookup to open Curo's reports, and we searched no state business registry. The Reddit posts show what was posted, not who posted it.
Sources
All retrieved 9 October 2026 unless noted. Pitch dates and offer terms come from vialaudit's inbox.
- Domain records (RDAP): labfirstpeptides.com, peptide.express, costides.us, bioluminlabs.com, mistraldiagnostics.com, pformlabs.com, nextgenpeps.com, curo.you
- Vendor pages: Hello Stacks affiliate terms, Peptide.Express partner page, LabFirst COA page, LabFirst affiliate terms, LabFirst return policy, Costides COA page, PForm FAQ, PForm partner program, PForm research kit, NextGenPeps affiliate page, Curo COA page, Chameleon Peptides
- Lab records: Kovera Labs verification system, reports KVR-2026-402EE1, KVR-2026-F84AE3 and KVR-2026-D2CBCF; Curo lot table on Zenodo
- Regulators: FDA warning letter to Prime Sciences, 31 March 2026
- Payments: Zelle security page
- Third parties: Peptide Critic on Costides (27 September 2026), PeptidePrices on LabFirst (6 October 2026), PeptidePrices on Peptide.Express (4 October 2026), Peptide Grades on Peptide.Express (6 October 2026), zipdo.co ranking (24 September 2026), Validated Peptides affiliate comparison (25 August 2026), PeptideBenchmark on Hello Stacks (28 September, updated 1 October 2026) and on Curo (22 September 2026), Peptigrity on Curo
- Placed articles: offthemrkt, 6 October, noobpreneur, 7 October, rawmags, 8 October
- Reddit: r/Semaglutide, 18 June 2026, r/NoStupidQuestions, 19 June 2026, r/PeptidePathways, 27 April 2026
- Search volume: DataForSEO, US, monthly data to August 2026
Frequently asked
Is LabFirst Peptides legit?
Its lab paperwork checks out so far. Three of its Kovera certificates we looked up on Kovera's own system on 9 October 2026 matched the shop's cards and named LabFirst as the client. But the domain was registered on 25 August 2026, and all 21 lots were tested on one day. We re-check in December 2026.
Is Peptide.Express legit?
We could not establish who runs it. The site names no legal entity or street address. Its partner page offers "up to 35% cash commission" paid "via Zelle or crypto". PeptidePrices matched 26 of 29 of its lab reports, with two no-matches at Mistral Diagnostics, a lab whose domain dates from March 2026. We declined its offer.
Is NextGenPeps legit?
We declined to list it. Its certificates sit on its own pages, not on lab lookups, and it sells GLP code-name vials and HCG. Two Reddit posts from June 2026 carry near-identical edits naming NextGenPeps as the seller, a pattern consistent with seeded posts. It sent us five or more follow-ups without any detail.
Is Costides legit?
We declined it. The domain was registered on 12 August 2026, the site names no company or address, and its three certificates come from Biolumin Labs, whose own domain was registered on 16 September 2026. Peptide Critic reports that date is two days after the stated test date.
How do you know if a peptide vendor is legit?
Look up each certificate on the testing lab's own site and check that it names the vendor as client. Check the domain registration date, the legal entity and the payment options. Avoid vendors that sell GLP code-name vials beside bac water and syringes. Our seven-point checklist is on this page.
What commission do peptide affiliate programs pay?
Published rates mostly run from 10% to 30%. A comparison of seven programs by Validated Peptides, itself a vendor, found 10% the most common published rate. The offers we received ran from 5% in store points (Curo) to 40% of every order for life (Hello Stacks). Pepspan's 10% sits at the low end.
Does vialaudit take affiliate commission?
On some vendor links, yes, and we disclose it on the page. Commission never sets a score or a ranking. From the nine pitches in this round we are accepting only Pepspan's 10% code, and only after a pending Janoshik cross-check. This article contains no affiliate links.