Chain 2
Desktop Domain Redirection for lagerfeuer.net
Introduction
Tracked: Thursday, 05 March 2026 · 20:00–21:00 CET · Desktop browser simulation
This chain enters via xml-v4.pushub.net - a Pushub push notification ad network click endpoint - and terminates at nachrichtenanalyse-online.click, a German-language political disinformation landing page promoting the Merz/Chrupalla narrative. Unlike Chain 1 which originates directly on lagerfeuer.net, this sequence begins at the push notification ad network layer, indicating lagerfeuer.net is registered as a Pushub publisher feeding traffic into the network's offer rotation. The intermediate domain beedirect.vip acts as a bidding and distribution hub, selecting the final destination based on offer parameters (campaign ID, pubfeed, bid amount) before issuing the terminal redirect. The three-hop structure is notably compact compared to the desktop chains, as Pushub-sourced traffic bypasses the bot detection layer.
Overview of the Domain Redirections
| # | Status Code | IP | URL | Redirect Type | Notes |
|---|---|---|---|---|---|
| 1 | 302 | 173.239.53.32 | temporary | - | |
| 2 | 302 | 2600:9000:2017:7c00:15:545f:c980:93a1 | temporary | - | |
| 3 | 200 | 2606:4700:3031::ac43:a5f8 | none | - |
Pictures of the Final Page
AI Analysis
AI Security Analysis
Automated threat assessment · claude-sonnet-4-6
This chain delivers political content to German-speaking internet users via a push notification channel that subscribers likely associated with lagerfeuer.net. The landing page promotes a narrative around two prominent German politicians — a content pattern consistent with those classified as systemic disinformation risk under EU Digital Services Act Article 34.
The danger for internet users is subtle but severe: push notifications bypass most ad blockers and arrive with the visual authority of system-level alerts. Users clicking what they expect to be campfire or community content are instead served manufactured political material designed to alter their political beliefs. The use of a .click TLD for the final domain is a common pattern for disposable disinformation infrastructure - cheap, quickly replaced when flagged, and visually similar to legitimate news sources.
This chain constitutes a clear violation of multiple EU regulations, including the Digital Services Act (Article 34 - systemic risk from disinformation via advertising) and the ePrivacy Directive (unsolicited commercial communications without consent).
Original Data from Redirect Path
Status Code URL IP Page Type Redirect Type Redirect URL
302 https://xml-v4.pushub.net/click2?i=RYwDYfX0oj4_0&ci=-6012402443632827597&j=rv%3Db%26ss%3D2048x1152%26ws%3D2007x962%26wp%3D0x0%26ce%3D1%26ck%3Djc%26cv%3D318%26cs%3D1%26fr%3D0%26hc%3D0%26fl%3Dnull%26jv%3Dnull%26sc%3D24%26hr%3D2%26rf%3D%26lo%3Dlive.pushub.net%26mb%3D0%26hb%3D0%26pl%3DLinux%2Bx86_64%26ua%3DMozilla%252F5.0%2B%28X11%253B%2BLinux%2Bx86_64%29%2BAppleWebKit%252F537.36%2B%28KHTML%252C%2Blike%2BGecko%29%2BChrome%252F144.0.0.0%2BSafari%252F537.36%26nd%3D0%26to%3Dnull%26wbd%3D1%26wbde%3D0%26sqm%3D0%26phj%3D0%26nmj%3D0%26sln%3D0%26es%3D0%26ln%3Dde-DE%252Cde%252Cen-US%252Cen%252Cru%26lnl%3D5%26hsc%3D1%26frc%3D1%26dbt%3D0%26prb%3D20030107%26tz%3D-60%26hid%3D0%26mq%3D1%26my%3D8%26geo%3D1%26thx%3D0%26the%3D0%26ths%3D0%26cpc%3D%26ocp%3D%26hwc%3D12%26hrl%3D%26acd%3Dpppmp%26vcd%3Dnpp%26pal%3D5%26pai%3D1%26pli%3D1%26win%3D2007x962%26wout%3D2048x1080%26wpof%3D0x0%26bcld%3D1976x18%26scrp%3D0x0%26scrad%3D2048x1152%26spd%3D24%26pxr%3D1.25%26sck%3D1%26ckl%3D52%26sls%3D1%26sss%3D1%26six%3D1%26sdb%3D0%26vvr%3DGoogle%2BInc.%2B%28AMD%29%26vrd%3DANGLE%2B%28AMD%252C%2BAMD%2BRadeon%2BGraphics%2B%28radeonsi%2Brenoir%2BACO%29%252C%2BOpenGL%2BES%2B3.2%29%26cnvs%3D7f7f7f80%26pnt%3Dprompt%26bch%3D1%26blv%3D1%26mmd_ao%3D1%26mmd_ai%3D1%26mmd_vi%3D0 173.239.53.32 server_redirect temporary https://beedirect.vip/db4e0d00-f99b-4f6c-9c89-aa5aa5ccb614?pubfeed_subid=965920_lagerfeuer.net&offer=3865151&banner=9477943&campaign=2309667&pubfeed=965920&subid=lagerfeuer.net&bid=0.015&clickid=rI*n1SSTIzM
302 https://beedirect.vip/db4e0d00-f99b-4f6c-9c89-aa5aa5ccb614?pubfeed_subid=965920_lagerfeuer.net&offer=3865151&banner=9477943&campaign=2309667&pubfeed=965920&subid=lagerfeuer.net&bid=0.015&clickid=rI*n1SSTIzM 2600:9000:2017:7c00:15:545f:c980:93a1 server_redirect temporary https://nachrichtenanalyse-online.click/c/de/52_merzchrupalla/?method=pop®form=1&on=Norentia&icid=weosu609ul811nogjofo5t3m&traff=ee903878-3dd9-4e7f-a44a-09a84f313c34&cmp=db4e0d00-f99b-4f6c-9c89-aa5aa5ccb614
200 https://nachrichtenanalyse-online.click/c/de/52_merzchrupalla/?method=pop®form=1&on=Norentia&icid=weosu609ul811nogjofo5t3m&traff=ee903878-3dd9-4e7f-a44a-09a84f313c34&cmp=db4e0d00-f99b-4f6c-9c89-aa5aa5ccb614 2606:4700:3031::ac43:a5f8 normal none none