Debounce ActiveCampaign domains

[fmarier]

I found this tracking parameter in a spam email:

• https://webappick70460.lt.acemlnb.com/Prod/link-tracker?redirectUrl=aHR0cHMlM0ElMkYlMkZ3ZWJhcHBpY2suY29tJTJGcGx1Z2luJTJGd29vY29tbWVyY2UtcHJvZHVjdC1mZWVkLXBybyUyRiUzRnV0bV9zb3VyY2UlM0RodyUyNnV0bV9tZWRpdW0lM0RlbWFpbCUyNnV0bV9jYW1wYWlnbiUzRGh3LWNtLTIyJTI2dXRtX3NvdXJjZSUzREFjdGl2ZUNhbXBhaWduJTI2dXRtX21lZGl1bSUzRGVtYWlsJTI2dXRtX2NvbnRlbnQlM0RIYWxsb3dlZW4lMkJDb3Vwb24lMkJBcnJpdmVkJTJCJTI1RjAlMjU5RiUyNThFJTI1ODMlMkJHZXQlMkJDVFglMkJGZWVkJTJCUFJPJTJCd2l0aCUyQjMwJTJCJTJCT2ZmJTJCJTI1RjAlMjU5RiUyNTk0JTI1QTUlMjZ1dG1fY2FtcGFpZ24lM0RIV0NfNXRoXzI1MTEyMl9XaXRob3V0X0F1dG9tYXRpb24=&sig=AWkJuR5VfHMdjJ87H8FbtRQYF2aoia5bJtyubrDyPeLQ&iat=1666775442&a=%7C%7C253804279%7C%7C&account=webappick70460%2Eactivehosted%2Ecom&email=XxqkePXGUrvI2IoN4Bf%2B5Yvy7T5YEJ8ohjC9vauJg30%3D&s=6808ce3a135c6eb3dfdfadf9c7595f29&i=174A311A11A622 -> https://webappick.com/plugin/woocommerce-product-feed-pro/?utm_source=hw&utm_medium=email&utm_campaign=hw-cm-22&utm_source=ActiveCampaign&utm_medium=email&utm_content=Halloween+Coupon+Arrived+%F0%9F%8E%83+Get+CTX+Feed+PRO+with+30++Off+%F0%9F%94%A5&utm_campaign=HWC_5th_251122_Without_Automation&vgo_ee=XxqkePXGUrvI2IoN4Bf%2B5Yvy7T5YEJ8ohjC9vauJg30%3D

which lead me to discover a number of other domains with the same pattern:

• https://foodtank710.lt.emlnk3.com/Prod/link-tracker?redirectUrl=aHR0cHMlM0ElMkYlMkZmb29kdGFuay5jb20lMkZuZXdzJTJGMjAyMiUyRjA1JTJGd29ybGQtY2VudHJhbC1raXRjaGVuLWRvY3VtZW50YXJ5LXNoaW5lcy1hLXNwb3RsaWdodC1vbi1jaGVmLWpvc2UtYW5kcmVzJTJG&sig=GEXTjMe1kWEs4qVF7gywyKHypkovYq96rmKqyLHkYyNU&iat=1654187335&a=%7C%7C475195397%7C%7C&account=foodtank710%2Eactivehosted%2Ecom&email=Cm9uA8mmJXE0mlD8fVEnx6mBxT2WY8PzcJ2Mu7s%2BMQ0%3D&s=f7c19e20e469e5c54830aee831e68345&i=605A3048A1A59603 -> https://foodtank.com/news/2022/05/world-central-kitchen-documentary-shines-a-spotlight-on-chef-jose-andres/?vgo_ee=Cm9uA8mmJXE0mlD8fVEnx6mBxT2WY8PzcJ2Mu7s%2BMQ0%3D
• https://creativemind.lt.emlnk1.com/Prod/link-tracker?notrack=1&redirectUrl=aHR0cHMlM0ElMkYlMkZ3ZWFyZWNyZWF0aXZlbWluZC50ZWFjaGFibGUuY29tJTJGcCUyRnBvd2VyZnVsLXByZXNlbnRpbmclM0ZmYmNsaWQlM0RJd0FSMXhKVm9tcnRLaGVXZF82djBEY2RvNDZvaXA3WFRVajE5RU5QU1Y2VlA4anc3Q2I0VGFIVlJHVWJJ&sig=2dsWndEDrTEenZ5Cu86LsWQwLc7L6C76zDS53dN7KSsA&iat=1630224982&a=648981035&account=creativemind%2Eactivehosted%2Ecom&email=lrOj7G7svNeReX5sPGwTUgwLckMouuJiFLblS3pUgDA%3D&s=93fde563249c364d19a6bb43fd632d42&i=220A259A16A2873 -> https://wearecreativemind.teachable.com/p/powerful-presenting?fbclid=IwAR1xJVomrtKheWd_6v0Dcdo46oip7XTUj19ENPSV6VP8jw7Cb4TaHVRGUbI
• https://denisonministries.lt.acemlnc.com/Prod/link-tracker?redirectUrl=aHR0cHMlM0ElMkYlMkZ0aGVkaXNwYXRjaC5jb20lMkZwJTJGaXRzLXRpbWUtZm9yLWEtcmV0dXJuLXRvLXZpcnR1ZSUzRnV0bV9zb3VyY2UlM0RBY3RpdmVDYW1wYWlnbiUyNnV0bV9tZWRpdW0lM0RlbWFpbCUyNnV0bV9jb250ZW50JTNESG93JTJCbGlrZWx5JTJCaXMlMkJjaXZpbCUyQndhciUyQmluJTJCQW1lcmljYSUyNTNGJTI2dXRtX2NhbXBhaWduJTNEMDktMDEtMjIlMkJIb3clMkJsaWtlbHklMkJpcyUyQmNpdmlsJTJCd2FyJTJCaW4lMkJBbWVyaWNhJTI1M0Y=&sig=C8ZASEHJcgfuzSQphAJuUnUWpPdbbPrBuMXNLaErNeK&iat=1662031981&a=%7C%7C27068980%7C%7C&account=denisonministries%2Eactivehosted%2Ecom&email=VHw27tavTvPMV7yK7l8NfrXEf05QuHANew5jWIBp84o%3D&s=8150452ad1d44e34df7265881cd19b8a&i=1649A1692A5A34482 -> https://thedispatch.com/p/its-time-for-a-return-to-virtue?utm_source=ActiveCampaign&utm_medium=email&utm_content=How+likely+is+civil+war+in+America%3F&utm_campaign=09-01-22+How+likely+is+civil+war+in+America%3F
• https://heroinetraining.lt.acemlna.com/Prod/link-tracker?redirectUrl=aHR0cHMlM0ElMkYlMkZpbnN0YWdyYW0uY29tJTJGZ3JhY2Vnb3Jkb25vZmZpY2lhbA==&sig=CoywHePWSvFVz38Nphtd4468UjDzdM11cz9UU96KdcLY&iat=1649829686&a=%7C%7C798851651%7C%7C&account=heroinetraining%2Eactivehosted%2Ecom&email=FICUFPKEIdUfhKEDYRKfSgvNSEJgqC%2Fs%2BGmRdXVottA%3D&s=aaad7f0fab8ac373fdc1d3bbca1fb91a&i=832A882A1A8792 -> https://instagram.com/gracegordonofficial

These are all related to ActiveHosted.com, which is owned by ActiveCampaign.

There are also companies which appear to be reselling ActiveCampaign on their own domains:

• https://theatre2.prospect2.com/Prod/link-tracker?redirectUrl=aHR0cCUzQSUyRiUyRnRoZWF0cmUyLm9yZyUyRnN1YnNjcmliZSUzRnV0bV9zb3VyY2UlM0RBY3RpdmVDYW1wYWlnbiUyNnV0bV9tZWRpdW0lM0RlbWFpbCUyNnV0bV9jb250ZW50JTNEVGhlYXRyZVNxdWFyZWQlMkJwcm9kdWN0aW9uJTJCb2YlMkJUaWdlciUyQlN0eWxlJTI1MjElMkJiZWdpbnMlMkJGZWJydWFyeSUyQjIzJTI2dXRtX2NhbXBhaWduJTNEUFIlMjUzQSUyQlRpZ2VyJTJCU3R5bGU=&sig=8MyAZqfWi4D4y6jQ74HofpnnUiWyDBP7zh1Mhb1PDywm&iat=1644533531&a=%7C%7C1001253958%7C%7C&account=theatre2%2Eactivehosted%2Ecom&email=x5iTFbWD27OamnRX5Z9MOqSyIXu03Akc1Z8hSpIr818%3D&s=3949e035518f7fd77b4f62360256cda3&i=368A382A2A4505 -> http://theatre2.org/subscribe?utm_source=ActiveCampaign&utm_medium=email&utm_content=TheatreSquared+production+of+Tiger+Style%21+begins+February+23&utm_campaign=PR%3A+Tiger+Style&vgo_ee=x5iTFbWD27OamnRX5Z9MOqSyIXu03Akc1Z8hSpIr818%3D
• https://americanprospect.bluelena.io/Prod/link-tracker?redirectUrl=aHR0cHMlM0ElMkYlMkZ3d3cud2hpdGVob3VzZS5nb3YlMkZicmllZmluZy1yb29tJTJGc3BlZWNoZXMtcmVtYXJrcyUyRjIwMjIlMkYwNSUyRjI0JTJGcmVtYXJrcy1ieS1wcmVzaWRlbnQtYmlkZW4tb24tdGhlLXNjaG9vbC1zaG9vdGluZy1pbi11dmFsZGUtdGV4YXMlMkY=&sig=UaVNd9MyfMbCYwseJghH5zsx6DSxQT8z4mWrz7x4kqt&iat=1653506233&a=%7C%7C1000784918%7C%7C&account=americanprospect%2Eactivehosted%2Ecom&email=DLloiACIYIemB%2FPqCpcSEovy7T5YEJ8ohjC9vauJg30%3D&s=ed75e9d2b1158e079db5b5129446ebfc&i=1461A1519A1A40547 -> https://www.whitehouse.gov/briefing-room/speeches-remarks/2022/05/24/remarks-by-president-biden-on-the-school-shooting-in-uvalde-texas/
• https://palmbeach.golfbacksolutions.com/Prod/link-tracker?redirectUrl=aHR0cHMlM0ElMkYlMkZ3d3cuZ29sZm9udGhlb2NlYW4uY29tJTJGdGVlLXRpbWVzJTJG&a=650306495&account=palmbeachgolf%2Eactivehosted%2Ecom&email=67%2Fs4bm78C4v4ONtJeOOD0zkASpiHornD%2Fz2wZTd1jg%3D&s=28e0bb007d2ad0693d9fc135cce9b57d&i=23A26A1A163 -> https://palmbeachgolf.activehosted.com/lt.php?s=28e0bb007d2ad0693d9fc135cce9b57d&i=23A26A1A163 -> https://www.golfontheocean.com/tee-times/?vgo_ee=67%2Fs4bm78C4v4ONtJeOOD0zkASpiHornD%2Fz2wZTd1jg%3D

[fmarier]

This page lists more domains that ActiveCampaign could be using in their redirect links:

• acemlna.com
• acemlnb.com
• acemlnc.com
• acemlnd.com
• emlnk.com
• emlnk1.com
• emlnk2.com
• emlnk3.com
• emlnk4.com
• emlnk5.com
• emlnk6.com
• emlnk7.com
• emlnk8.com
• emlnk9.com

and I verified that they all redirect to a subdomain of activehosted.com, therefore they are likely to be owned by them (the whois info is obscured by MarkMonitor).