Your analysis is incorrect. It is not a "sort of redirect". As an aside: each horizontal line in this answer indicates a leap in my assumption of your knowledge: I start with the most basic and move to more advanced topics with each successive horizontal line.
Use a software tool such as Burp Proxy or WebScarab. These are ordinarily security testing tools, but you are trying to learn very simple concepts related to URLs and HTTP, and these may help you learn by experience. Set up one of these proxies to intercept URLs in your web browser. The easiest one to use for this purpose is Mozilla Firefox, and you can install a proxy switching addon such as FoxyProxy Standard.
What actually happens when you follow the original link in your post is that your web browser:
- Queries the Domain Name System (DNS) to determine the IP address mapped to
- Establishes a TCP socket with the IP address mapped to
Sends an HTTP GET Request that looks something like this:
GET /click?p=113177&a=89693&g=189788889&url=http://track.adform.net/C/?bn=8997990;cpdir=http://www.tele2.se/mobilt-bredband.html?utm_source=tradedoubler&utm_medium=Affiliate&utm_campaign=Omnitel_Tradedoubler HTTP/1.1
... information is replaced with the relevant fields.
In order to understand the meaning of this, you must understand what it means to
make an HTTP Request. That is exactly what is going on.
The URL is deconstructed so that the entire query string of the URL, except for the
http://domain.com part, is sent to the remote server.
Now, what you must realize is that the remote server can do anything it wants with this information. It doesn't have to do ANYTHING with it. It can, among other infinite possibilities:
- Ignore the information
- Send an HTTP request to the URL(s) in the parameters specified in the query string
- Send an HTTP Response to your computer indicating a redirect to one of the URL(s) in the query string
- Store the information in a database
- Call the President of the United States and read the URL using a text reader
- Use the query string inputs as a random number generator to determine which letters to output into cans of Campbell's Alphabet Soup as they roll off the production line
- And so on...
&url=http://... is just part of the query string which is sent to
clk.tradedoubler.com. In order to know what this host is doing with that query string, you would have to see the source code of the software that is processing this information on the
clk.tradedoubler.com servers. What you can do from a "black box" perspective is to observe the HTTP Response (if any) that your browser receives from
clk.tradedoubler.com after it sends this HTTP Request. To do that, I refer you back to my above suggestion to use Burp or WebScarab.
But you should not assume, in the general case, that the remote server is doing anything in particular with the information being passed to it in a query parameter. What you should be assuming is that it probably does the worst possible thing that it can conceivably do with it -- thinking in this way will help you to at least spot any potential threats it may pose to your personal information.
Once you understand these basic concepts, you will be able to start learning about what this URL is actually doing. It is pretty obviously part of a web advertising system. The
utm references the Urchin Tracker Module which has been integrated (at least in its API; for the backend, who knows) into the Google AdWords system. So at a bare minimum it is safe to assume that this request is trying to store some information about your web browsing habits in order to serve you relevant advertisements.
Regarding this separate question:
What is the difference between
&url= is the start of a query parameter named
url whose delimiter is
;cpdir= is the start of a query parameter named
cpdir whose delimiter is
;. The delimiter used in the embedded URL is
; but is functionally equivalent to
&. The reason it is used is that, if
& were used, it would confuse the HTTP server parsing the original URL into thinking that everything following the
& were starting the name of a new URL parameter of the outer URL.
This is like one of those Matryoshka doll type problems, where you have a URL inside of a URL inside of a URL. You need some way to prevent the HTTP server receiving the "outer" URL from interpreting parameters passed to the inner URLs as parameters belonging to the outer URL. That's why the switch from
;. For more information about the formatting and syntax of a query string, see Wikipedia's entry on Query String.