**TL;DR** Website tracks movements with get requests to an endpoint, wireshark shows requests to that endpoint, put two and two together, bam, you have a ~~misc~~ forensics challenge

where's the malware at? >:(
probably shouldn't taunt them before they make a wiper program that is just excruciating to analyze