Good news everyone:
The people who ran the first jump-off point finally fixed the issue with what looks like a filter returning a 403 for every forwarding-request that doesn't start with "https://<their-domain>/"
The slash at the end makes it so that one can't just register <their-domain>.example.org and keep going.