Technology in terms you understand. Sign up for the Confident Computing newsletter for weekly solutions to make your life easier. Click here and get The Ask Leo! Guide to Staying Safe on the Internet — FREE Edition as my thank you for subscribing!

What are all these domain references in my router log?


My DSL modem/router (ActionTec) I use keeps a web log. I’ve never liked the
idea of ANYone keeping track of my computer, and I DO route that log to
/dev/null. That, of course, does not mean the events are not HAPPENING,

My question: What ARE these things? I can understand ‘’ and
such..but… The last list listed as a
site ‘maintained’ by four DNS servers. OK..doing WHAT? It’s a

Anyway, there are pages..and PAGES of sites my machine accesses..and most I
would probably prefer are NOT accessed.

Although..there is a good lot of ‘leo’ stuff listed there, too. Still, how
can ‘’ matter to me?


Yep, surfing the web’s a complex operation these days and your browser is
busy fetching information from sites all over the internet.

The vast majority of it is for two district reasons: displaying you the
content you want and displaying the advertising that pays for it all.

I’ll show you how to determine who owns those domain names … sometimes,
that’s enough to determine what they’re up to. I’ll also run down the list of
domains that are currently involved in displaying a single page on Ask Leo!
and show you the tool I use to figure it out.

Become a Patron of Ask Leo! and go ad-free!

Who Is The Owner?

We’ll start with a tool called “whois”. That’s actually an old generic name
for a specific information seeking protocol on the internet that is used to
determine who owns a specific resource. For domains I like to use the whois
service from

The easiest is simply to do it in one step, by going to a URL constructed
from the whois service and the domain you’re interested in
looking up.

Let’s look up

Note that the url begins with “whois.” on – that’s how you
access their whois service. The domain you’re looking up is simply appended to
the URL as shown above.

The resulting page will show you that I own the server, and give you a
mailing address and the telephone number of my voicemail service1. Additional pages there will give you
more information, including the “Site Overview” tab, and the “Server Stats” tab
which will tell you the IP address of and where the site is

Interpreting an Example Domain

Let’s use one of your examples. Let’s figure out what’s up with

The first step is to ignore everything except for the last two segments – in
otherwords we’ll look up “”. Anything that gets placed in front of that
is under the control and direction of whomever owns the base domain, so that’s
all we need to look up. In fact it’s all we can look up, since that’s the only
part that is registered when you actually register a domain.

The intial results aren’t very helpful, showing that the domain is
registered to “Automattic, Inc”. We could Google that, but instead I’ll look at
the “Site Profile” tab to see that the title of the site is “ –
Get a Free Blog Here”.

So I test it out. I go to and am immediately redirected to

In this case is most likely used in conjunction with sites that host
on – perhaps it’s a domain they use to put pictures or other
types of support files for sites that are hosted there.

And at some point you probably visited one of those sites causing your
browser to fetch whatever is kept there.

Now, do the same thing on “” (remember, just the last part, no
need to include the “kona.”) and you’ll find out that they’re one of the
advertising networks I use here on Ask Leo! to keep it a free service to

But what else does an Ask Leo! page load involve? Much more than you’d

What Does That Page Reference?

To get an idea of the sheer number of items that can be referenced by
visiting a single web page, let’s analyse one.

Web Page
is a service I use to test how many different things my pages are
loading, and how long they all take. From a website designer’s point of view
it’s a pretty darned cool service. ( NOTE: it is free, but it’s also not
speedy, and can take a little time to run.)

If you go to Web Page Test you’ll see a form where you can enter the full URL
of any page. Let’s test this URL:

After a while you’ll see what’s called a “waterfall” diagram of everything
that’s referenced by loading that page:

Web Page Test Waterfall Diagram

There’s a lot of information for people like me on that page, but what’s
interesting to you would be the list of additional files that are loaded when
displaying that page. Click on the diagram after a run at Web Page Test and
you’ll get a readable list of everything that was referenced in order to
display that page.

In my example run there were 85 different items on 35 domains associated
with 23 parent domains.


Let’s run the list of parent domains:


    This one we expect – it’s where the page we’re looking at lives, and we
    might assume also the source for additional resources required by that

  • and are two domains I use to hold resources
    that don’t change often. Files stored on these domains are delivered via a
    CDN or content delivery network so as to be transfered more
    quickly to your machine when you view the page. I happened to set up my own,
    but domains from, and others are often used for this same
    purpose. In my case “med” stands for media, and hosts the CSS files used on
    every page of Ask Leo!, and “img” stands for images and is the domain on which
    all the images you see from Ask Leo! are hosted, including the logo at the top
    of every page.


    Aweber is the
    service I use to publish my newsletter. is
    where the newsletter signup form comes from, is analysis software that allows me to
    determine what newsletter articles people actually click on and find useful, is apparently where aweber stores the button
    image used in the form.


    Owned by Google, is a well known advertising network, and
    the primary advertising network I use to keep Ask Leo! free. The three
    different subdomains referenced off of all provide ads, or
    software related to displaying ads.


    Facebook provides the “Like” widget below each article.


    This is Facebooks CDN. Subdomains on it are used to
    provide various resources such as button images used in the Facebook Like


    Google provides a powerful analytics tool that allows me to understand
    exactly how my site is used. Each page loads some analytics code directly from
    Google via this domain.


    I use Google’s search on every page, and pull the “Google Custom Search”
    graphic from their servers, as well as the Google Plus One icon that appears at
    the end of articles.


    This is apparently some support code requested as part of Google


    As described in
    Why do some blogs have pictures next to some people’s comments?
    , Gravatar
    is a service that allows you define a picture associated with the email address
    you use whdd


    Kontera is the other ad network that I contract with, once again providing
    part of the revenue that keeps Ask Leo! free.


    This domain appears to be involved in fetching the default gravatar. appears to be owned by the same people that own WordPress, and
    thus the domain is used.


    These all are or appear to be ad-related, typically involved in market
    research, analysis or actual ad delivery. Some are specifically related to the
    ad networks being used, and others are unique to the specific ads that were

Note that the various domains and resources used will change, probably every
time you reload a page, since the advertisements will change. This is just an
example of a single load.

85 different items on 35 domains associated with 23 parent domains.

That’s a lot of stuff! And, in fact, my pages are relatively simple – both
in design, and the number of ads and ad networks I choose to work with. Other
pages on other sites can easily load several hundred different resource before
they’re done.

Do I Want All This?

To quote the original question: “most I would probably prefer are NOT

Maybe, maybe not.

I made it a point above to mention that ads are what keep Ask Leo! free. In
fact, without ads Ask Leo! would simply not exist.

You can certainly use an ad blockers to prevent the ads from showing, and
all those accesses not to be made.


There’s a serious and growing concern that the use of ad-blockers is
beginning to noticeably impact the ability of free sites to stay viable.

I hate to say it, but I can envision a future where popular free sites might
need to shut down simply because so many people are blocking ads that the
revenue required to keep the site up goes away.2

So in my mind you do want it, as it’s part of what keeps large
portions of the free internet free.

Your Router Logs More Than the Web

I do have to point out that your router is, of course, logging all
internet access, not just your web browsing. I focus on web browsing
specifically because it’s responsible for so many more internet accesses of
obscure domain names than people realize.

The other concern, of course, would be the other programs running on your
PC, and malware.

To really understand everything that’s possibly being accessed from your
machine requires more extensive techniques, as outlined in
How do I see what’s happening on my machine’s network connection?

Since you have the list of domain names from your router, however, you may
be able to more easily reverse engineer what’s going on by identifying the
specific domains, as I’ve outlined above, and what they’re used for. Given that
you can make some reasonable deductions as to what kind of thigns – web
browsing or otherwise – might be responsible for the access.

If nothing else it’ll give you a great starting point and will allow you to
weed out the majority of the list.

1: For the record I can’t take questions by voicemail, and any left there
are, sadly, ignored. Please ask questions using the ask-a-question form. The number is present there
because it’s a required part of domain registration.

2: Ask Leo! is not at imminent risk, but it absolutely could
happen. Advertising revenue per visitor has been steadily declining, which
could well correspond to the increased use of ad-blocking technologies.

Do this

Subscribe to Confident Computing! Less frustration and more confidence, solutions, answers, and tips in your inbox every week.

I'll see you there!

13 comments on “What are all these domain references in my router log?”

  1. If you’re using Firefox, you can use the add-on Ghostery. This gives you a list of all the domains any page uses. It can also be used to block any you think are dubious as well. I believe other browsers have similar systems.

  2. Well said! You tackled an incredibly complex subject and once again condensed it to an understandable level.

    I do think you meant ‘imminent’ not ‘immanent’ though. Sometimes grammar & spelling checkers do not help!

  3. Leo, thanks for your enlightening response to the writer’s question. I don’t personally have concerns about all the websites that get accessed because I have a pretty good idea of what goes on behind the scenes, but it is good to learn more details from someone who is actually involved in the creation of the websites we browse. I really enjoy your email and it’s one of the first things I open when it arrives. Keep up the good work.

  4. Thanks, Leo! This is a great write-up.

    I have a ‘pretty good idea’ myself of behind the scenes goings-on, but comes a time, with the torrential deluge of data/information that tags along with the simplest of requests on the web, you gotta’ wonder WHAT is going on.

    I do!

    Well answered. Thanks.

  5. Yes, very enlightening.

    And there’s also Ghostery, which claims “Full detection of tracker scripts, img tags, and iframes from over 1000 data collection services” for all popular browsers, though it’s less comprehensive for IE.

  6. Another great article from Ask Leo. I must say that of all the Newsletters I receive yours is the only one I read from start to finish. I always look forward to seeing your answers and sometimes wonder if you get tired of the repeat questions you seem to get. I long ago decided that using adblockers was wrong as I know the work and effort that you and all the other websites put into making their sites available for free. Keep up the great work.

  7. Thank you Leo,
    I am one of them who has grown pretty annoyed with advertisments until reading this post. In fact, I have now come to appreciate them because it is their advertisments which contribute to e and all other ask-leo readers the opportunity to subscribe to you’refree service.

  8. “There’s a serious and growing concern that the use of ad-blockers is beginning to noticeably impact the ability of free sites to stay viable.”

    Might the increased use of ad-blockers be due to the increasing annoying ads that websites keep tacking on?

    A banner ad at the top of the page was never bad. A small ad here or there in a longer article, okay.

    Now we’ve got websites who use javascript to keep popping the ad at the top or bottom of the screen as you scroll through the page, so you get annoyed by the ad.

    There’s a website I frequent which shows the TV schedule in my area. They frequently fill the left and right side of the screen with “loud” ads (it’s even worse on my wide screen laptop which has more of a page border).

    And Yahoo! keeps showing this flashy annoying ad telling me that sexy singles in my area want to meet me.

    I submit that if people are using ad-blockers more often, it’s because the advertising has got more annoying. And the downside is that people like Leo who use advertising responsibly also end up getting blocked. I believe that many a website these days is using the advertising not only to pay for the site, but also to make a profit.

    I’m a little concerned about your use of the word profit, seemingly in a way that paints it as a bad thing. Can people not profit from the work? Is it not OK for me to profit from my work?

    In my opinion the way to deal with sites that have overly annoying ads is to a) let them know, and b) stop using them. Vote with your feet. I can attest to traffic numbers as being one thing that websites pay close attention to.


  9. Leo I agree with all the comments above, that your newsletter regarding internet content is the best in the “whole wide world”! I can’t believe that ten years have gone by since I gave up trying to create ameteur websites, because it all got just to complicated and confusing to stay “current”. And yes I used to use “Ad blockers” because here in Africa we have to pay service providers per byte of information flow and if you exceeded your allocated 100 Mbyte per month you were charged R2.50 ($0.8) per Mbyte on top of your fixed monthly charge, cruel isn’t it? However, every time I read your newsletter about how the internet and websites work, I am reminded what a wonderfully complex system the whole internet is, and that so much has happened since I typed my first “www” on a UNIX machine and our generation joined the “information age”.

  10. Interesting article. Since you mentioned Ad-blockers and their effect on revenues I have excluded all “” domain pages from Chrome’s AdBlock. You do good work here and you should get paid for it.

    Thank you, it’s appreciated.


  11. In reply to Leo’s reply to my comment dated December 2, 2012 11:45 AM:

    No, I don’t think profit is necessarily a bad thing. Sure a writer such as yourself should be compensated to pay for operating costs and something extra (the profit) to put food on the table and heat in the furnace and save some for a rainy day.

    My comment about making a profit was more directed at the larger companies, who make bucket-fulls of cash on a regular basis such as Yahoo! If they declined the flashy ad and substituted a different ad, which might bring in a slightly less amount, they would still be making a decent amount.

    I get what you say about using your feet. But how do you use your feet when your email address has been established for 15-20 years? And many of these big companies don’t have published email addresses to contact them, so you can’t even tell them how you feel.


Leave a reply:

Before commenting please:

  • Read the article.
  • Comment on the article.
  • No personal information.
  • No spam.

Comments violating those rules will be removed. Comments that don't add value will be removed, including off-topic or content-free comments, or comments that look even a little bit like spam. All comments containing links and certain keywords will be moderated before publication.

I want comments to be valuable for everyone, including those who come later and take the time to read.