Lesser known mobile adtech domains where data is sent

https://jamesoclaire.com/2025/08/28/uncovering-lesser-known-mobile-adtech-domains/

107•ddxv•5mo ago

Comments

ddxv•5mo ago

Just wanted to share a quick blog about figuring out who owns the lesser known adtech domains since most of these I couldn't find anything about when I did quick searches.

If you found this interesting, let me know!

qingcharles•5mo ago

Good info!

What's the best way to log the API calls from an Android app? I want to document the undocumented API calls the Reddit app makes.

adithyassekhar•5mo ago

Without root, pcapdroid might work.

ddxv•5mo ago

You can follow my tutorial here: https://github.com/ddxv/mobile-network-traffic

Overview: I use Waydroid + MITM

Feel free to contact me for a call if you need help. Additionally, I'll scan the Reddit app, the new API calls should show up in a day or two on AppGoblin: https://appgoblin.info/apps/com.reddit.frontpage/data-flows

You can see some of the SDKs Reddit's Android app uses from a decompile in October 2024: https://appgoblin.info/apps/com.reddit.frontpage/sdks

Let me know if there was something specific to look for for the API calls, usually I don't interact with the app, but I can do it manually if there is something interesting to check out.

Happy to share the raw MITM logs with you as well.

qingcharles•5mo ago

Thank you so much!

6LLvveMx2koXfwn•5mo ago

Just an FYI your link to this conversation actually goes to: https: //appgoblin.info/apps/com.adidas.app/sdks

ddxv•5mo ago

Thanks, my bad, will fix.

netsharc•5mo ago

I've started noticing unity3d.com, I thought it was a game... oh, nope, they also operate an ad network called Unity Ads, I guess they like their reputation!

miohtama•5mo ago

It's spyware they acquired some time ago, discussed here

https://news.ycombinator.com/item?id=44334167

anttiharju•5mo ago

Unity Ads have been a thing long before (2014) ironSource merger (2022)

https://unity.com/news/unity-technologies-acquire-applifier-...

https://unity.com/blog/news/welcome-ironsource

politelemon•5mo ago

Nice work on the author to do this digging. Thanks for sharing it.

marketingcloudapis.com has namesevers on salesforce.com and I see it in their documentation too, so it's Salesforce integration?

https://developer.salesforce.com/docs/marketing/marketing-cl...

ddxv•5mo ago

Wow! That's it! Docs match and each app has a SalesForce SDK as well: https://appgoblin.info/apps/com.adidas.app/sdks

Did you just search that and find it or did you recognize it? I tried searching but not sure what I was missing.

PS: I'll update the article to say it's Salesforce and give you a shoutout, thanks again!

tux3•5mo ago

Nit: You updated the wrong line in your table at the end!

ddxv•5mo ago

Well that was a good nit, fixed.

DownGoat•5mo ago

Would be interesting to snatch one of these domains should the ever be available. If the author has a list of the domains 40k different apps called, there must be some requests going out to domains that are no longer registered.

ddxv•5mo ago

That's pretty interesting! I was surprised how many domains like this show up as fairly recent registrations.

mxuribe•5mo ago

So, the mischievous part of my brain is activated....what could be done with such domain names? :-)

DownGoat•5mo ago

Depends a lot on what they were used for. Maybe they are downloading some HTML to render in a view, images, icons or other assets, or just posting some form of telemetry.

raffael_de•5mo ago

Seems like none of those 8 domains is denied by my Pi-hole :/ Added them manually but I'd prefer to rely on Pi-holes blacklists.

mmsc•5mo ago

It'd be nice to have a feature in uBlock origin where you can block certain websites' ip addresses, with a requirement to re-resolve the ip address every few days to ensure the ip hasn't been rotated (blocking unnecessary websites due to the cache).

noja•5mo ago

Reminder that a website you are visiting may be proxying your data to the adtech company through their services a domain.

Check out the Facebook Conversions API Gateway.

usernomdeguerre•5mo ago

qa-analytics.com's oldest entry in Internet archive redirects to www.qwickanalytics.com, so not sure if that domain changed hands?

ddxv•5mo ago

Given it's sending an internal Unity app id it must have become available and later purchased. It looks like qwickanalytics still exists and is selling analytics for bankers, so unlikely it's working so closely with a game engine?

ectospheno•5mo ago

This is the first site I’ve encountered that caused Obsidian Web Clipper to fail.

Goal: Ship 1M Lines of Code Daily

Show HN: Codex-mem, 90% fewer tokens for Codex

FastLangML: FastLangML:Context‑aware lang detector for short conversational text

LineageOS 23.2

Crypto Deposit Frauds

Substack makes money from hosting Nazi newsletters

Framing an LLM as a safety researcher changes its language, not its judgement

Are there anyone interested about a creator economy startup

Show HN: Skill Lab – CLI tool for testing and quality scoring agent skills

2003: What is Google's Ultimate Goal? [video]

Roger Ebert Reviews "The Shawshank Redemption"

Busy Months in KDE Linux

Zram as Swap

Green’s Dictionary of Slang - Five hundred years of the vulgar tongue

Nvidia CEO Says AI Capital Spending Is Appropriate, Sustainable

Show HN: StyloShare – privacy-first anonymous file sharing with zero sign-up

Part 1 the Persistent Vault Issue: Your Encryption Strategy Has a Shelf Life

Show HN: Teleop_xr – Modular WebXR solution for bimanual robot teleoperation

The Highest Exam: How the Gaokao Shapes China

Open-source framework for tracking prediction accuracy

India's Sarvan AI LLM launches Indic-language focused models

Show HN: CryptoClaw – open-source AI agent with built-in wallet and DeFi skills

ShowHN: Make OpenClaw respond in Scarlett Johansson’s AI Voice from the Film Her

CReact Version 0.3.0 Released

Show HN: CReact – AI Powered AWS Website Generator

The rocky 1960s origins of online dating (2025)

Show HN: Agent-fetch – Sandboxed HTTP client with SSRF protection for AI agents

Why there is no official statement from Substack about the data leak

Effects of Zepbound on Stool Quality

Show HN: Seedance 2.0 – The Most Powerful AI Video Generator

Goal: Ship 1M Lines of Code Daily

Show HN: Codex-mem, 90% fewer tokens for Codex

FastLangML: FastLangML:Context‑aware lang detector for short conversational text

LineageOS 23.2

Crypto Deposit Frauds

Substack makes money from hosting Nazi newsletters

Framing an LLM as a safety researcher changes its language, not its judgement

Are there anyone interested about a creator economy startup

Show HN: Skill Lab – CLI tool for testing and quality scoring agent skills

2003: What is Google's Ultimate Goal? [video]

Roger Ebert Reviews "The Shawshank Redemption"

Busy Months in KDE Linux

Zram as Swap

Green’s Dictionary of Slang - Five hundred years of the vulgar tongue

Nvidia CEO Says AI Capital Spending Is Appropriate, Sustainable

Show HN: StyloShare – privacy-first anonymous file sharing with zero sign-up

Part 1 the Persistent Vault Issue: Your Encryption Strategy Has a Shelf Life

Show HN: Teleop_xr – Modular WebXR solution for bimanual robot teleoperation

The Highest Exam: How the Gaokao Shapes China

Open-source framework for tracking prediction accuracy

India's Sarvan AI LLM launches Indic-language focused models

Show HN: CryptoClaw – open-source AI agent with built-in wallet and DeFi skills

ShowHN: Make OpenClaw respond in Scarlett Johansson’s AI Voice from the Film Her

CReact Version 0.3.0 Released

Show HN: CReact – AI Powered AWS Website Generator

The rocky 1960s origins of online dating (2025)

Show HN: Agent-fetch – Sandboxed HTTP client with SSRF protection for AI agents

Why there is no official statement from Substack about the data leak

Effects of Zepbound on Stool Quality

Show HN: Seedance 2.0 – The Most Powerful AI Video Generator

Lesser known mobile adtech domains where data is sent

Comments