Chain 8
Mobile simulated Domain Redirections for lagerfeuer.net
Introduction
Tracked: Thursday, 05 March 2026 · 20:00–21:00 CET · Mobile simulated browser
Chain 8 stands apart from the preceding chains: it originates from health-browsers.theconsumersearch.com, a domain within the theconsumersearch.com ad network, and terminates at gesundheitsvergleich-deutschland.de - a legitimate German health product comparison site promoting Viktilabs Amino 8. The routing passes through Yahoo Search referral tracking and a Microsoft Advertising (Bing) click tracker, suggesting this represents a paid search or display advertising placement rather than malvertising. Its presence in this dataset alongside the malvertising chains confirms that the push notification ad rotation observed during this monitoring session includes both legitimate advertising placements and harmful content — a pattern that provides plausible cover against enforcement actions targeting the malicious chains.
Overview of the Domain Redirections
| # | Status Code | IP | URL | Redirect Type | Notes |
|---|---|---|---|---|---|
| 1 | 302 | 52.12.55.19 | temporary | Ad Network Entry Point | |
| 2 | 302 | 2a00:1288:110:c104::2000 | temporary | Yahoo Search Ad Tracker | |
| 3 | 302 | 2a02:26f0:3380:1c::17c8:1895 | temporary | Bing Ad Click Tracker | |
| 4 | 200 | 23.227.38.32 | none | Final Destination – Amino Supplement Product Page |
Pictures of the Final Page
AI Analysis
AI Security Analysis
Automated threat assessment · claude-sonnet-4-6
Chain 8 is the first legitimately-sourced chain in the dataset, representing a paid advertising placement via theconsumersearch.com, routed through Yahoo and Microsoft Advertising (Bing) tracking infrastructure, landing on a genuine German health product comparison site. No direct security risk to the individual user is evident in this specific chain.
However, its presence alongside malicious chains in the same push notification rotation is analytically significant. From a user's perspective, there is no reliable way to distinguish between a legitimate advertising redirect and a malicious one before clicking - both arrive as push notification alerts, both route through multiple tracking domains, and both land on what may appear to be functional websites.
This deliberate mixing of legitimate and illegitimate advertising serves two functions for the domain operator: it generates real revenue that partly subsidises the malicious infrastructure, and it provides cover against enforcement actions by enabling the operator to demonstrate good-faith advertising activity. Internet users should understand that a "legitimate-looking" destination does not imply a legitimate delivery chain.
Original Data from Redirect Path
Status Code URL IP Page Type Redirect Type Redirect URL
302 https://health-browsers.theconsumersearch.com/session/track/cf5626c0-4f51-b20f-c746-594bc67c9526/f869b428-f16d-b501-179e-08b9c2431307/c8e565e8-6660-7221-59c9-90b84d49f9ba?d=eJxtVFtvozgU_i.R.rZtsQm5VOpDEwKBBpNwx6pUYZsEgg2ZhJTAav_7OtXsjEZa.X70.Vw.n.O_Rxlty6YevYya2shztuQlrUZ_ja5nLmVF254uLx_PH8_np0uenWnx1GdF0zzRRkgZo7z6eGZxOHcUb.srKIhWredXtumXGDBduaGB9miwVDRUwA2oYtfR1zagAwqqsatX0A3eejfYaba4KdvAEnRQeltEwzYE3OOLaxrPY8yjyjO724YbJT0WZ6qAKjridWSG4_RYxP46Ao6gY6LiLlH4JgxBGVTY8eMVpDCCToLHtGp6P2Rrx2QCVa3nhoYfwK4jgx18PHvRK5Tz6hVMp5oK5tP5RB7dVzCWS_j6zcKDmj3Avexd1z2Rsj7cOZDHjN4Ze1D3nD2oLJ9l4SkHbtWdWNv5Kz_4UiEwgyhcht3cE7ddyLQeNk1cJ3EYJDdrb382dXUr.Wk.g8U.wYXrLAJMYG6FboQXdPH4OaSp9kNvHI7ZlLjGkaRlwK.b3TAtpMFZM9k_LjgjsWudxZi0hdGvbEr0pVlkWdNMNofh8LZIKrrqjPmQzrdvs_VmstC0vjO.PP2Rv23ZwGKtaKMlObz35bV7gJOrDCdbewpdO9yBK.6IVA5c4wQBIrwGx1yhKuZUsIvcH7MlqHASKRSihpjGFS.1Cvthj4V9IZBJom2RQQPg2i6YyXgqov4uS2NwImImbWCFCrQnCTqSZLHP4p2U7QAa3gDSrRvSD9w5_sIUGMxPeBkOWF_d00ziDppzXGlocKCjh39ijf.w_5N6gQVZ4rWJir5YYh.lzwM2bekTvesAzAR7EkdVlkStHaCKru0vqi54qnp3TPvT_xaruNrEbcFi3KeJV.PY5rQEA46NPoUHidPKLI4UnFgtE90v3Sk0WmoaJwzHMl4PkmXYozpSSDSXWPvbJhP8zEx.SWNb8mgB57goSMyvpJfYwOrc33fkG.BTCsO7rvYe2zefZvsz_oPq6M4NBSFw4qh0htXgDGHn6B5HEIkUWgPS6Q0J4yhT4MzLe1LPpooKNE0DOVGBqmqKMs6ndE.JOp6CSUZlkbx_F5D_Wm92P3Jjshvaq_h8r0M.y5QKmrlnzx7lr9KWIr.0mTiNXmSpQdlkqakT5Z9_AZWvgnU- 52.12.55.19 server_redirect temporary https://r.search.yahoo.com/rdclk/dWU9M0RPS0NTVEtRSkJGSiZ1dD0xNzcyNzI3Nzk1OTc0JnVvPTczNTk4ODk2OTAyOTQ5Jmx0PTImcz0yJmVzPU1lRlBuYW9WZlVkRGwxLlFicjhrc01kVjZHVGU4YjhWSHV1Mmc4b3ZwX0lLUU1iTkZMSWE2c2V2MXZ4ckoySUdHMGdmNktROUFST2wwbzJT/RV=2/RE=1775319796/RO=14/RU=https%3a%2f%2fwww.bing.com%2faclick%3fld%3de8aUpe1OkwpdtwSESTv321GTVUCUw9RmxQUd5y2ooWnXWUTXxIfJ_onkxilp982hfXZhOMBTZb2eIUOVZBcB-_zYY5qDoMlZd7bOFjbYiTluLQz7he8a8o6f-BldbWOIrm4bthFyEJcbDCGhaaoo6LgzgABXkcEwF9zY9PA8HL6B55ywFvRD-lAPdzdW5htVCbgKyiuw%26u%3daHR0cHMlM2ElMmYlMmZnZXN1bmRoZWl0c3ZlcmdsZWljaC1kZXV0c2NobGFuZC5kZSUyZmJsb2dzJTJma2F1ZnJhdGdlYmVyJTJmYW1pbm8lM2Z0cmNfbXNjbXBfaWQlM2Q1NzA1NDIxNDglMjZ0cmNfbXNhZ19pZCUzZDExNzc1Nzg5MjE5NzM2MDUlMjZ0cmNfbXNhZF9pZCUzZDczNTk4ODk2OTAyOTQ5JTI2dXRtX3NvdXJjZSUzZGJpbmclMjZ1dG1fbWVkaXVtJTNkcHJvc3BlY3RpbmctYW1pbm8tZ3ZkLWthdWZyYXRnZWJlci1zZWFyY2gtYW5iaWV0ZXItdmwlMjZ1dG1fY2FtcGFpZ24lM2R2bCUyNnV0bV90ZXJtJTNkdmlrdGlsYWJzJTI1MjBhbWlubyUyNTIwOCUyNnV0bV9kZXZpY2UlM2RtJTI2bXNjbGtpZCUzZDg3MDMxNTU1MWViMzEzMzUwMDRlN2NmY2IzNDcxNmFj%26rlid%3d870315551eb31335004e7cfcb34716ac/RK=2/RS=nLQqeF6Qztum_KnUl8a0k2GeRJ8-
302 https://r.search.yahoo.com/rdclk/dWU9M0RPS0NTVEtRSkJGSiZ1dD0xNzcyNzI3Nzk1OTc0JnVvPTczNTk4ODk2OTAyOTQ5Jmx0PTImcz0yJmVzPU1lRlBuYW9WZlVkRGwxLlFicjhrc01kVjZHVGU4YjhWSHV1Mmc4b3ZwX0lLUU1iTkZMSWE2c2V2MXZ4ckoySUdHMGdmNktROUFST2wwbzJT/RV=2/RE=1775319796/RO=14/RU=https%3a%2f%2fwww.bing.com%2faclick%3fld%3de8aUpe1OkwpdtwSESTv321GTVUCUw9RmxQUd5y2ooWnXWUTXxIfJ_onkxilp982hfXZhOMBTZb2eIUOVZBcB-_zYY5qDoMlZd7bOFjbYiTluLQz7he8a8o6f-BldbWOIrm4bthFyEJcbDCGhaaoo6LgzgABXkcEwF9zY9PA8HL6B55ywFvRD-lAPdzdW5htVCbgKyiuw%26u%3daHR0cHMlM2ElMmYlMmZnZXN1bmRoZWl0c3ZlcmdsZWljaC1kZXV0c2NobGFuZC5kZSUyZmJsb2dzJTJma2F1ZnJhdGdlYmVyJTJmYW1pbm8lM2Z0cmNfbXNjbXBfaWQlM2Q1NzA1NDIxNDglMjZ0cmNfbXNhZ19pZCUzZDExNzc1Nzg5MjE5NzM2MDUlMjZ0cmNfbXNhZF9pZCUzZDczNTk4ODk2OTAyOTQ5JTI2dXRtX3NvdXJjZSUzZGJpbmclMjZ1dG1fbWVkaXVtJTNkcHJvc3BlY3RpbmctYW1pbm8tZ3ZkLWthdWZyYXRnZWJlci1zZWFyY2gtYW5iaWV0ZXItdmwlMjZ1dG1fY2FtcGFpZ24lM2R2bCUyNnV0bV90ZXJtJTNkdmlrdGlsYWJzJTI1MjBhbWlubyUyNTIwOCUyNnV0bV9kZXZpY2UlM2RtJTI2bXNjbGtpZCUzZDg3MDMxNTU1MWViMzEzMzUwMDRlN2NmY2IzNDcxNmFj%26rlid%3d870315551eb31335004e7cfcb34716ac/RK=2/RS=nLQqeF6Qztum_KnUl8a0k2GeRJ8- 2a00:1288:110:c104::2000 server_redirect temporary https://www.bing.com/aclick?ld=e8aUpe1OkwpdtwSESTv321GTVUCUw9RmxQUd5y2ooWnXWUTXxIfJ_onkxilp982hfXZhOMBTZb2eIUOVZBcB-_zYY5qDoMlZd7bOFjbYiTluLQz7he8a8o6f-BldbWOIrm4bthFyEJcbDCGhaaoo6LgzgABXkcEwF9zY9PA8HL6B55ywFvRD-lAPdzdW5htVCbgKyiuw&u=aHR0cHMlM2ElMmYlMmZnZXN1bmRoZWl0c3ZlcmdsZWljaC1kZXV0c2NobGFuZC5kZSUyZmJsb2dzJTJma2F1ZnJhdGdlYmVyJTJmYW1pbm8lM2Z0cmNfbXNjbXBfaWQlM2Q1NzA1NDIxNDglMjZ0cmNfbXNhZ19pZCUzZDExNzc1Nzg5MjE5NzM2MDUlMjZ0cmNfbXNhZF9pZCUzZDczNTk4ODk2OTAyOTQ5JTI2dXRtX3NvdXJjZSUzZGJpbmclMjZ1dG1fbWVkaXVtJTNkcHJvc3BlY3RpbmctYW1pbm8tZ3ZkLWthdWZyYXRnZWJlci1zZWFyY2gtYW5iaWV0ZXItdmwlMjZ1dG1fY2FtcGFpZ24lM2R2bCUyNnV0bV90ZXJtJTNkdmlrdGlsYWJzJTI1MjBhbWlubyUyNTIwOCUyNnV0bV9kZXZpY2UlM2RtJTI2bXNjbGtpZCUzZDg3MDMxNTU1MWViMzEzMzUwMDRlN2NmY2IzNDcxNmFj&rlid=870315551eb31335004e7cfcb34716ac
302 https://www.bing.com/aclick?ld=e8aUpe1OkwpdtwSESTv321GTVUCUw9RmxQUd5y2ooWnXWUTXxIfJ_onkxilp982hfXZhOMBTZb2eIUOVZBcB-_zYY5qDoMlZd7bOFjbYiTluLQz7he8a8o6f-BldbWOIrm4bthFyEJcbDCGhaaoo6LgzgABXkcEwF9zY9PA8HL6B55ywFvRD-lAPdzdW5htVCbgKyiuw&u=aHR0cHMlM2ElMmYlMmZnZXN1bmRoZWl0c3ZlcmdsZWljaC1kZXV0c2NobGFuZC5kZSUyZmJsb2dzJTJma2F1ZnJhdGdlYmVyJTJmYW1pbm8lM2Z0cmNfbXNjbXBfaWQlM2Q1NzA1NDIxNDglMjZ0cmNfbXNhZ19pZCUzZDExNzc1Nzg5MjE5NzM2MDUlMjZ0cmNfbXNhZF9pZCUzZDczNTk4ODk2OTAyOTQ5JTI2dXRtX3NvdXJjZSUzZGJpbmclMjZ1dG1fbWVkaXVtJTNkcHJvc3BlY3RpbmctYW1pbm8tZ3ZkLWthdWZyYXRnZWJlci1zZWFyY2gtYW5iaWV0ZXItdmwlMjZ1dG1fY2FtcGFpZ24lM2R2bCUyNnV0bV90ZXJtJTNkdmlrdGlsYWJzJTI1MjBhbWlubyUyNTIwOCUyNnV0bV9kZXZpY2UlM2RtJTI2bXNjbGtpZCUzZDg3MDMxNTU1MWViMzEzMzUwMDRlN2NmY2IzNDcxNmFj&rlid=870315551eb31335004e7cfcb34716ac 2a02:26f0:3380:1c::17c8:1895 server_redirect temporary https://gesundheitsvergleich-deutschland.de/blogs/kaufratgeber/amino?trc_mscmp_id=570542148&trc_msag_id=1177578921973605&trc_msad_id=73598896902949&utm_source=bing&utm_medium=prospecting-amino-gvd-kaufratgeber-search-anbieter-vl&utm_campaign=vl&utm_term=viktilabs%20amino%208&utm_device=m&msclkid=870315551eb31335004e7cfcb34716ac
200 https://gesundheitsvergleich-deutschland.de/blogs/kaufratgeber/amino?trc_mscmp_id=570542148&trc_msag_id=1177578921973605&trc_msad_id=73598896902949&utm_source=bing&utm_medium=prospecting-amino-gvd-kaufratgeber-search-anbieter-vl&utm_campaign=vl&utm_term=viktilabs%20amino%208&utm_device=m&msclkid=870315551eb31335004e7cfcb34716ac 23.227.38.32 normal none none