4 ms·

Lesser known mobile adtech domains where data is sent

107 points by ddxv 1y ago

netsharc 1y ago
I've started noticing unity3d.com, I thought it was a game... oh, nope, they also operate an ad network called Unity Ads, I guess they like their reputation!
- miohtama 1y ago
  It's spyware they acquired some time ago, discussed here https://news.ycombinator.com/item?id=44334167 https://news.ycombinator.com/item?id=44334167
  - anttiharju 1y ago
    Unity Ads have been a thing long before (2014) ironSource merger (2022) https://unity.com/news/unity-technologies-acquire-applifier-bring-everyplay-social-gaming-community https://unity.com/news/unity-technologies-acquire-applifier-... https://unity.com/blog/news/welcome-ironsource https://unity.com/blog/news/welcome-ironsource
ddxv 1y ago
Just wanted to share a quick blog about figuring out who owns the lesser known adtech domains since most of these I couldn't find anything about when I did quick searches. If you found this interesting, let me know!
- qingcharles 1y ago
  Good info! What's the best way to log the API calls from an Android app? I want to document the undocumented API calls the Reddit app makes.
  - adithyassekhar 1y ago
    Without root, pcapdroid might work.
  - ddxv 1y ago
    You can follow my tutorial here: https://github.com/ddxv/mobile-network-traffic https://github.com/ddxv/mobile-network-traffic Overview: I use Waydroid + MITM Feel free to contact me for a call if you need help. Additionally, I'll scan the Reddit app, the new API calls should show up in a day or two on AppGoblin: https://appgoblin.info/apps/com.reddit.frontpage/data-flows https://appgoblin.info/apps/com.reddit.frontpage/data-flows You can see some of the SDKs Reddit's Android app uses from a decompile in October 2024: https://appgoblin.info/apps/com.reddit.frontpage/sdks https://appgoblin.info/apps/com.reddit.frontpage/sdks Let me know if there was something specific to look for for the API calls, usually I don't interact with the app, but I can do it manually if there is something interesting to check out. Happy to share the raw MITM logs with you as well.
    - qingcharles 1y ago
      Thank you so much!
- 6LLvveMx2koXfwn 1y ago
  Just an FYI your link to this conversation actually goes to: https: //appgoblin.info/apps/com.adidas.app/sdks
  - ddxv 1y ago
    Thanks, my bad, will fix.
politelemon 1y ago
Nice work on the author to do this digging. Thanks for sharing it. marketingcloudapis.com has namesevers on salesforce.com and I see it in their documentation too, so it's Salesforce integration? https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/requestToken.html https://developer.salesforce.com/docs/marketing/marketing-cl...
- ddxv 1y ago
  Wow! That's it! Docs match and each app has a SalesForce SDK as well: https://appgoblin.info/apps/com.adidas.app/sdks https://appgoblin.info/apps/com.adidas.app/sdks Did you just search that and find it or did you recognize it? I tried searching but not sure what I was missing. PS: I'll update the article to say it's Salesforce and give you a shoutout, thanks again!
  - tux3 1y ago
    Nit: You updated the wrong line in your table at the end!
    - ddxv 1y ago
      Well that was a good nit, fixed.
DownGoat 1y ago
Would be interesting to snatch one of these domains should the ever be available. If the author has a list of the domains 40k different apps called, there must be some requests going out to domains that are no longer registered.
- ddxv 1y ago
  That's pretty interesting! I was surprised how many domains like this show up as fairly recent registrations.
- mxuribe 1y ago
  So, the mischievous part of my brain is activated....what could be done with such domain names? :-)
  - DownGoat 1y ago
    Depends a lot on what they were used for. Maybe they are downloading some HTML to render in a view, images, icons or other assets, or just posting some form of telemetry.
raffael_de 1y ago
Seems like none of those 8 domains is denied by my Pi-hole :/ Added them manually but I'd prefer to rely on Pi-holes blacklists.
mmsc 1y ago
It'd be nice to have a feature in uBlock origin where you can block certain websites' ip addresses, with a requirement to re-resolve the ip address every few days to ensure the ip hasn't been rotated (blocking unnecessary websites due to the cache).
noja 1y ago
Reminder that a website you are visiting may be proxying your data to the adtech company through their services a domain. Check out the Facebook Conversions API Gateway.
usernomdeguerre 1y ago
qa-analytics.com's oldest entry in Internet archive redirects to www.qwickanalytics.com, so not sure if that domain changed hands?
- ddxv 1y ago
  Given it's sending an internal Unity app id it must have become available and later purchased. It looks like qwickanalytics still exists and is selling analytics for bankers, so unlikely it's working so closely with a game engine?
ectospheno 1y ago
This is the first site I’ve encountered that caused Obsidian Web Clipper to fail.

107 points by ddxv 1y ago

I've started noticing unity3d.com, I thought it was a game... oh, nope, they also operate an ad network called Unity Ads, I guess they like their reputation!

miohtama 1y ago
It's spyware they acquired some time ago, discussed here https://news.ycombinator.com/item?id=44334167 https://news.ycombinator.com/item?id=44334167
- anttiharju 1y ago
  Unity Ads have been a thing long before (2014) ironSource merger (2022) https://unity.com/news/unity-technologies-acquire-applifier-bring-everyplay-social-gaming-community https://unity.com/news/unity-technologies-acquire-applifier-... https://unity.com/blog/news/welcome-ironsource https://unity.com/blog/news/welcome-ironsource

ddxv 1y ago

Just wanted to share a quick blog about figuring out who owns the lesser known adtech domains since most of these I couldn't find anything about when I did quick searches. If you found this interesting, let me know!

qingcharles 1y ago
Good info! What's the best way to log the API calls from an Android app? I want to document the undocumented API calls the Reddit app makes.
- adithyassekhar 1y ago
  Without root, pcapdroid might work.
- ddxv 1y ago
  You can follow my tutorial here: https://github.com/ddxv/mobile-network-traffic https://github.com/ddxv/mobile-network-traffic Overview: I use Waydroid + MITM Feel free to contact me for a call if you need help. Additionally, I'll scan the Reddit app, the new API calls should show up in a day or two on AppGoblin: https://appgoblin.info/apps/com.reddit.frontpage/data-flows https://appgoblin.info/apps/com.reddit.frontpage/data-flows You can see some of the SDKs Reddit's Android app uses from a decompile in October 2024: https://appgoblin.info/apps/com.reddit.frontpage/sdks https://appgoblin.info/apps/com.reddit.frontpage/sdks Let me know if there was something specific to look for for the API calls, usually I don't interact with the app, but I can do it manually if there is something interesting to check out. Happy to share the raw MITM logs with you as well.
  - qingcharles 1y ago
    Thank you so much!
6LLvveMx2koXfwn 1y ago
Just an FYI your link to this conversation actually goes to: https: //appgoblin.info/apps/com.adidas.app/sdks
- ddxv 1y ago
  Thanks, my bad, will fix.

politelemon 1y ago

Nice work on the author to do this digging. Thanks for sharing it. marketingcloudapis.com has namesevers on salesforce.com and I see it in their documentation too, so it's Salesforce integration? https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/requestToken.html https://developer.salesforce.com/docs/marketing/marketing-cl...

ddxv 1y ago
Wow! That's it! Docs match and each app has a SalesForce SDK as well: https://appgoblin.info/apps/com.adidas.app/sdks https://appgoblin.info/apps/com.adidas.app/sdks Did you just search that and find it or did you recognize it? I tried searching but not sure what I was missing. PS: I'll update the article to say it's Salesforce and give you a shoutout, thanks again!
- tux3 1y ago
  Nit: You updated the wrong line in your table at the end!
  - ddxv 1y ago
    Well that was a good nit, fixed.

DownGoat 1y ago

Would be interesting to snatch one of these domains should the ever be available. If the author has a list of the domains 40k different apps called, there must be some requests going out to domains that are no longer registered.

ddxv 1y ago
That's pretty interesting! I was surprised how many domains like this show up as fairly recent registrations.
mxuribe 1y ago
So, the mischievous part of my brain is activated....what could be done with such domain names? :-)
- DownGoat 1y ago
  Depends a lot on what they were used for. Maybe they are downloading some HTML to render in a view, images, icons or other assets, or just posting some form of telemetry.

raffael_de 1y ago

Seems like none of those 8 domains is denied by my Pi-hole :/ Added them manually but I'd prefer to rely on Pi-holes blacklists.

mmsc 1y ago

It'd be nice to have a feature in uBlock origin where you can block certain websites' ip addresses, with a requirement to re-resolve the ip address every few days to ensure the ip hasn't been rotated (blocking unnecessary websites due to the cache).

noja 1y ago

Reminder that a website you are visiting may be proxying your data to the adtech company through their services a domain. Check out the Facebook Conversions API Gateway.

usernomdeguerre 1y ago

qa-analytics.com's oldest entry in Internet archive redirects to www.qwickanalytics.com, so not sure if that domain changed hands?

ddxv 1y ago
Given it's sending an internal Unity app id it must have become available and later purchased. It looks like qwickanalytics still exists and is selling analytics for bankers, so unlikely it's working so closely with a game engine?

ectospheno 1y ago

This is the first site I’ve encountered that caused Obsidian Web Clipper to fail.