Comparison of External Requests from Keitaro and Binom v2 Trackers

Following the news about updated Keitaro usage rules, we checked which requests Binom v2 and Keitaro send during installation, campaign creation, and domain addition. We recorded destinations, methods, and request frequency, and examined the available content.

When and where Keitaro sends requests

Test environment and methodology

We installed the trackers on separate Friendhosting VPS servers, sent a small volume of visits through them for natural activity, and observed normal operation. The main observation lasted 24 hours, then we added domains to the active installations and monitored them for another two hours.

In each tracker, we created three traffic sources, offers, campaigns, and streams with test labels. We checked renaming, then added three more objects of each type midway through the test. We searched outgoing data for the labels.

We recorded connections, DNS, and available HTTP, including before TLS encryption. Browser requests were saved separately, and the browser was closed after the actions.

The tables show how many HTTP requests the tracker attempted to send based on our observations. Network connections and DNS requests were counted separately and were not added to the HTTP request total.

A comparison of Binom v2 and Keitaro trackers under load and on live traffic is available here: https://cpa.rip/services/binom-vs-keitaro/

Requests during installation

• Binom downloaded the installer and databases from data.binom.org, Protect from private.binom.dev, and Observer from Amazon S3; it checked IP, license, and versions.
• Keitaro downloaded scripts and components from files.keitaro.io, geolocation, bot, and carrier databases from keitaro.io and keitaro-geo-db.keitaro.io; it checked IP and license, and sent its first POST to maintenance.

Browser requests from the admin panel

We separately checked browser requests by opening both trackers’ admin panels in separate clean profiles.

The Keitaro admin panel connected to analytics.google.com, stats.g.doubleclick.net, www.googletagmanager.com, and www.google.com.vn. The requests transmitted information about viewed pages and form interactions, browser parameters, user role, application edition, and license ID.

In 54 Google Analytics requests, the page URL or referrer contained the tracker IP. At the same time, test object names and the added domain were not found in the readable browser request data.

The dp parameter contained the path of the open page and its URL parameters. For example, when working with a campaign, it transmitted its internal ID: dp=/campaign/<CAMPAIGN_ID>/main. On the statistics page, it transmitted the period, time zone, selected metrics and report columns, etc.

Below is an example request from the statistics page with all URL parameters. Values are shown after one level of URL decoding. The long dp field contains report display settings; it does not contain the actual values of costs, revenue, or other metrics.

POST https://analytics.google.com/g/collect

URL parameters:
v=2
tid=<GA_PROPERTY_ID>
gtm=45je6ac1v9191639167za200zd9191639167xf1
_p=<PAGE_ID>
_gaz=1
gcd=13l3l3l3l1l1
npa=0
dma=0
ecid=<ECID>
_eu=AAAAAGAC
cid=<GA_CLIENT_ID>
ec_mode=a
frm=0
pscdl=noapi
rcb=9
sr=1280x720
uaa=arm
uab=64
uafvl=Google%20Chrome;155.0.8059.41|Chromium;155.0.8059.41|Not(A%3ABrand;24.0.0.0
uam=
uamb=0
uap=macOS
uapv=27.0.1
uaw=0
ul=ru-ru
gaf=2
_s=1
tag_exp=115616986~115938466~115938468~118897920~118897930~120213116~120385422~120469145~120469153~121246026~121246034
dp=/dashboard/?s=%7E%28campaign%7Enull%7Erange%7E%28from%7E%272026-10-14%7Eto%7E%272026-10-14%7Einterval%7E%27today%7Etimezone%7E%27UTC%29%7EenabledMetrics%7E%28%7E%27clicks%7E%27campaign_unique_clicks%7E%27conversions%7E%27cost%7E%27sale_revenue%7E%27profit_confirmed%7E%27roi_confirmed%29%7EenabledEntities%7E%28%7E%27campaign%7E%27landing%7E%27offer%7E%27ts%29%7ElastClicksColumns%7E%28%7E%27event_id%7E%27datetime%7E%27campaign%7E%27os_icon%7E%27browser_icon%7E%27ip%7E%27destination%29%7EtopMetrics%7E%28%7E%27clicks%7E%27campaign_unique_clicks%7E%27conversions%29%29
sid=<GA_SESSION_ID>
sct=1
seg=0
dl=https://<TRACKER_IP>/admin/
dr=https://<TRACKER_IP>/admin/
dt=Dashboard
en=page_view
_fv=1
_nsi=1
_ss=1
_ee=1
epn.license_id=<LICENSE_ID>
up.user_role=admin
up.app_edition=starter
tfd=2980

What requests Binom transmitted

Over 24 hours, we recorded 217 external HTTP requests: 206 over TLS and 11 over open HTTP. These include tracker components, the certificate, and the OS.

Service requests revealed the tracker ID, component versions and tags, authorization data, and user role. During installation, we also recorded a GET checker.binom.lgbt/check request with a url parameter that contained the server IP in our test.

We also recorded POST requests to tinker.binom.org/updates/observer/result/save with the tracker_id, version, status, message, and output fields (empty), as well as POST requests to /updates/observer/version/save with the tracker ID and version.

Contents of the request to metrics.binom.dev

Observer made one observed attempt to send POST /api/v2/tracker. The full request body contains 3 555 bytes of JSON with a single body field: 3 544 Base64 characters. After reverse conversion, we got 2 657 bytes, but could not read their contents. One such request was recorded over 24 hours.

What requests Keitaro transmitted

On the server running Keitaro 11.4.1, we recorded 153 outgoing HTTP requests to external servers over 24 hours: 141 using TLS and 12 using unencrypted HTTP. Of these, 102 went to Keitaro services and 51 to Linux repositories, meaning package and update sources.

What was in the data field

We fully read the external structure of two POST /v1/maintenance requests: one before the 24-hour observation began and one during it. Around 24 hours passed between the requests, and the body sizes were 304 and 302 bytes.

In both, the data field contains 217 characters: two Base64 parts separated by a colon. The purpose of hash, the conversion method, and the contents of data are unknown.

Requests when adding a domain

After the main test, we added one domain to each tracker. We separately recorded the actions themselves and two hours after closing the browser.

• Binom: the domain was found in POST /acme/new-order and /acme/finalize/… requests to Let’s Encrypt. This is communication with the certificate authority.
• Keitaro: during addition and over the two hours afterward, we received 10 TLS/SNI records with the Let’s Encrypt name. They show the start of a secure connection and its destination; the HTTP content could not be read.

The domain name was found in DNS requests: 2 times for Binom and 80 for Keitaro. These are technical DNS queries about the domain, and repeats are possible.

We also analyzed separate fragments containing domains. In Binom, one turned out to be the admin panel response to our browser’s GET /api/domains request. In Keitaro, there were three: MariaDB responses containing data from the keitaro_domains.name field; it is unknown which program received them.

Binom Operation with External Requests Blocked

Keitaro’s updated terms prohibit intentionally blocking telemetry, and violations may result in license suspension. Binom’s terms contain no such restriction. We tested how the tracker performs when external connections are restricted.

We blocked all non-essential outbound requests on the Binom server, allowing only licensing, certificate issuance, DNS, and time synchronization. We created a new campaign, checked the main admin panel sections, and sent 21 test clicks. All clicks reached the test landing page and were recorded in the database. The campaign was created successfully, and reporting continued to work.

During a follow-up check 18 hours later, the admin panel was still operational, and an additional test click reached its destination and was recorded in the database. During this period, a request to metrics.binom.dev was also blocked.

Conclusion: Blocking non-essential external connections did not disrupt Binom’s core functionality.

Promo code CPARIP gives you a 30-day trial of the Binom tracker without payment. After the trial, promo code CPARIP gives you a 40% discount on your first payment for a Binom license on your own server.