Comparison of External Requests From Keitaro and Binom v2 Trackers

Following the news about updated Keitaro usage rules, we checked what requests Binom v2 and Keitaro send during installation, campaign creation, and domain addition. We recorded the destinations, methods, and request frequency, and analyzed the accessible content.

Test setup and methodology

We installed the trackers on separate Friendhosting VPS instances, sent a small stream of visits for natural activity, and observed normal operation. The main observation lasted 24 hours, then we added domains to the running installations and monitored them for another two hours.

In each tracker, we created three traffic sources, offers, campaigns, and flows with test labels. We checked renaming, then added three more objects of each type halfway through the test. We searched outgoing data for the labels.

We recorded connections, DNS, and accessible HTTP, including before TLS encryption. Browser requests were saved separately, and the browser was closed after the actions.

The tables show how many HTTP requests the tracker attempted to send based on our observations. Network connections and DNS requests were counted separately and were not added to the HTTP request total.

A comparison of Binom v2 and Keitaro trackers under load and with real traffic is available here: https://cpa.rip/services/binom-vs-keitaro/

Requests during installation

• Binom downloaded the installer and databases from data.binom.org, Protect from private.binom.dev, and Observer from Amazon S3; it checked IP, license, and versions.
• Keitaro downloaded scripts and components from files.keitaro.io, geolocation, bot, and carrier databases from keitaro.io and keitaro-geo-db.keitaro.io; it checked IP and license, and sent the first POST to maintenance.

Browser requests from the admin panel

We separately checked browser requests by opening both trackers’ admin panels in separate clean profiles.

The Keitaro admin panel connected to analytics.google.com, stats.g.doubleclick.net, www.googletagmanager.com, and www.google.com.vn. The requests transmitted information about viewed pages and form interactions, browser parameters, user role, application edition, and license ID.

In 54 Google Analytics requests, the page URL or referrer contained the tracker IP. At the same time, test object names and the added domain were not found in the readable browser request data.

The dp parameter contained the path of the open page and its URL parameters. For example, when working with a campaign, it transmitted its internal ID: dp=/campaign/<CAMPAIGN_ID>/main. On the statistics page, it transmitted the period, time zone, selected metrics and report columns, etc.

Below is an example request from the statistics page with all URL parameters. Values are shown after one level of URL decoding. The long dp field contains report display settings; it does not contain the actual values of costs, revenue, or other metrics.

POST https://analytics.google.com/g/collect

URL parameters:
v=2
tid=<GA_PROPERTY_ID>
gtm=45je6ac1v9191639167za200zd9191639167xf1
_p=<PAGE_ID>
_gaz=1
gcd=13l3l3l3l1l1
npa=0
dma=0
ecid=<ECID>
_eu=AAAAAGAC
cid=<GA_CLIENT_ID>
ec_mode=a
frm=0
pscdl=noapi
rcb=9
sr=1280x720
uaa=arm
uab=64
uafvl=Google%20Chrome;155.0.8059.41|Chromium;155.0.8059.41|Not(A%3ABrand;24.0.0.0
uam=
uamb=0
uap=macOS
uapv=27.0.1
uaw=0
ul=ru-ru
gaf=2
_s=1
tag_exp=115616986~115938466~115938468~118897920~118897930~120213116~120385422~120469145~120469153~121246026~121246034
dp=/dashboard/?s=%7E%28campaign%7Enull%7Erange%7E%28from%7E%272026-10-14%7Eto%7E%272026-10-14%7Einterval%7E%27today%7Etimezone%7E%27UTC%29%7EenabledMetrics%7E%28%7E%27clicks%7E%27campaign_unique_clicks%7E%27conversions%7E%27cost%7E%27sale_revenue%7E%27profit_confirmed%7E%27roi_confirmed%29%7EenabledEntities%7E%28%7E%27campaign%7E%27landing%7E%27offer%7E%27ts%29%7ElastClicksColumns%7E%28%7E%27event_id%7E%27datetime%7E%27campaign%7E%27os_icon%7E%27browser_icon%7E%27ip%7E%27destination%29%7EtopMetrics%7E%28%7E%27clicks%7E%27campaign_unique_clicks%7E%27conversions%29%29
sid=<GA_SESSION_ID>
sct=1
seg=0
dl=https://<TRACKER_IP>/admin/
dr=https://<TRACKER_IP>/admin/
dt=Dashboard
en=page_view
_fv=1
_nsi=1
_ss=1
_ee=1
epn.license_id=<LICENSE_ID>
up.user_role=admin
up.app_edition=starter
tfd=2980

What requests Binom sent

Over 24 hours, we recorded 217 external HTTP requests: 206 over TLS and 11 over open HTTP. Tracker components, the certificate, and the OS are included.

Service requests show the tracker ID, component versions and tags, authorization data, and user role. During installation, we also recorded a GET checker.binom.lgbt/check request with the url parameter, which contained the server IP in our test.

We also recorded POST requests to tinker.binom.org/updates/observer/result/save with the tracker_id, version, status, message, output (empty) fields, and a POST to /updates/observer/version/save with the tracker ID and version.

Contents of the request to metrics.binom.dev

Observer made one observable attempt to send POST /api/v2/tracker. The full request body contains 3,555 bytes of JSON with a single body field: 3,544 Base64 characters. After reverse conversion, we obtained 2,657 bytes, but could not read their contents. One such request was recorded over 24 hours.

What requests Keitaro sent

On the server running Keitaro 11.4.1, we recorded 153 outgoing HTTP requests to external servers over 24 hours: 141 using TLS and 12 over unencrypted HTTP. Of these, 102 were sent to Keitaro services and 51 to Linux repositories, meaning package and update sources.

What was in the data field

We fully read the outer structure of two POST /v1/maintenance requests: one before the 24-hour observation began and one during it. Around 24 hours elapsed between the requests, and the body sizes were 304 and 302 bytes.

In both requests, the data field contains 217 characters: two Base64 parts separated by a colon. The purpose of hash, the transformation method, and the contents of data are unknown.

Requests when adding a domain

After the main test, we added one domain to each tracker. We separately recorded the actions themselves and the two hours after closing the browser.

• Binom: the domain was found in POST requests to /acme/new-order and /acme/finalize/… at Let’s Encrypt. This is communication with the certificate authority.
• Keitaro: during addition and in the two hours afterward, we obtained 10 TLS/SNI records with the Let’s Encrypt name. They show the start of a secure connection and its destination; the HTTP content could not be read.

The domain name was found in DNS requests: 2 times for Binom and 80 for Keitaro. These are technical DNS queries about the domain, and repeats are possible.

We also analyzed separate fragments containing domains. For Binom, one turned out to be the admin panel’s response to our browser’s GET /api/domains. For Keitaro, there were three: MariaDB responses containing data from the keitaro_domains.name field; it is unknown which program received them.

Promo code CPARIP gives you 30 days of tracker trial Binom at no cost. After the trial, promo code CPARIPgives you a 40% discount on the first payment for a Binom license on your own server.