Mara, who fixed code for a living and secrets for sport, should have closed the tab. Instead she captured the network trace. The redirect resolved through three obscure domains, each with certificate dates from five years ago and then nothing. The final host served a tiny JavaScript payload that checked timezones and geolocation permissions before presenting a second page: an invitation. “Find the three markers. Bring nothing you value.”