There are some usual suspects like the utm_* parameters, but a website could be using whatever it wants.

Actually, you don't event need parameters to track, you could just use the IP of the requester and for instance do some IP geolocation.