AppGoblin has now run over 40k apps in an emulator, tracking millions of API calls thousands of advertising domains. Unfortunately, some of them are dark, meaning they have no landing page of any kind, and I’m unclear who controls these domains.
news-cdn.site marketingcloudapis.com kickoffo.site onegg.site lazybumblebee.com qa-analytics.com acobt.tech yastatic.net
Let’s see if we can figure them out!
qa-analytics.com
This one is a mystery. Seems like it’s related to Germany since it’s always resolving to HETZNER and german IPs. Checking the shared IPs, it looks like they do overlap with unity3d.com domains sometimes.
Again, this whole list is games.
data deep dive
Looking at the requests I can match various keys to values from untiy3d.com API calls! Specifically they share the same `app_key` values.
acobt.tech
Well that name definitely comes off as esoteric at first. First let’s check the IP cluser and see what we find, of the 233 apps sending/receiving from acobt.tech we have 4 other sites with 1:1 matches that are all sites that do not have any landing pages.
... continue reading