It can be a daunting challenge to determine precisely who is responsible for serving advertisements on the websites we visit, or which hidden entities are harvesting behavioral data from the mobile applications we rely on every day. While much of this underlying information is theoretically semi-public, it has traditionally been difficult to parse, heavily siloed, and locked away within the proprietary systems of large advertising platforms.
That dynamic is beginning to shift with the launch of DecryptAds, a powerful and free service designed to scrape, correlate, and simplify adtech data. The platform allows security researchers, journalists, and privacy-conscious users to quickly learn a great deal about the corporate entities, data brokers, and tracking networks operating behind the scenes of popular web properties and mobile applications.
The newly launched service operates by constantly scraping the public-facing files that websites and digital applications use to declare their authorized business partners. These repositories include "ads.txt" files, which list all adtech companies and data brokers permitted to run advertisements or harvest data from a specific site; "app-ads.txt" files, which disclose the entities authorized to operate on mobile and smart television applications; and "buyers.json" and "sellers.json" files, which map out the organizations buying, selling, or reselling advertising inventory across the digital ecosystem.
Zach Edwards, chief research officer for DecryptAds and a threat researcher at the security firm Infoblox, explained that he and two co-founders built the platform because raw adtech files are rarely useful in isolation. They only reveal their true value when cross-referenced to construct a complete, comprehensive picture of the advertising supply chain for any given domain or app.
"It’s an adtech tool, but we’re trying to approach adtech from a security perspective," Edwards said, noting that the platform is engineered to address major gaps in privacy and security infrastructure that have historically been underserved by traditional tools.
Those security and privacy use cases include tracking down the origin sources of malicious advertising campaigns designed to distribute malware, identifying ad networks anchored in adversarial or high-risk geopolitical nations, and detecting the rapidly growing proliferation of AI-generated content farms and low-quality "slop" applications. As DecryptAds demonstrates, these multi-faceted threats are nearly impossible to uncover by merely reviewing an isolated ads.txt or app-ads.txt file.
As the platform notes in its analytical documentation, supply-chain integrity issues rarely manifest within a single file. Instead, they typically appear as broken cross-references across different regulatory lists, cloned declaration sets spanning unrelated domains, selective seller removals that only become apparent when viewed across multiple exchanges, and supply paths visible in bid logs that never actually appear on a publisher’s authorized-seller list.
A standard search on DecryptAds for the prominent sports network ESPN reveals a sprawling web of 143 advertising partners and 19 registered data broker domains listed within its public authorization files. Information regarding these data brokers is gradually becoming more accessible due to legislation passed in states such as California, Oregon, Texas, and Vermont, which now require data brokers to register if they buy or sell consumer information originating from those jurisdictions. According to DecryptAds, nearly half of those registered entities are collecting precise geolocation data from visitors who do not employ ad-blocking technology, while others disclose the collection of device fingerprints and sensitive personal attributes.
High-Risk Ad Partners and Geopolitical Exposure
DecryptAds also provides clear visibility into the corporate beneficiaries and national origins of advertising firms lurking within applications and websites. The platform displays prominent warnings when associated adtech partners are based in high-risk geographic areas—such as Russia, China, or nations with close financial and political alignments to them, including Cyprus and the United Arab Emirates.
For instance, the platform’s analysis of ESPN shows commercial relationships with four distinct advertising entities based in Russia, China, or the UAE. This includes an adtech firm named Between Digital, which officially lists a corporate address in New York. However, the DecryptAds dossier on the company flags it as a Russian enterprise, demonstrating that its publisher financial transactions are processed through Alfa Bank, Russia’s largest private commercial bank. Alfa Bank was among the major financial institutions placed under sweeping economic sanctions by the United States government following the 2022 invasion of Ukraine.
A similar search across several prominent U.S. military-focused news websites—including publications covering the Army, Air Force, Defense, Navy, Marine Corps, and federal civil service—reveals that they all permit Between Digital to serve advertisements and track users. They also share space with entities based in the UAE and the ownership secrecy haven of Panama. DecryptAds reports that Between Digital actively collects advertising and user data across approximately 55,000 partner websites.
Pivoting further into Between Digital’s app-ads.txt files uncovers hundreds of domains featuring simple web-based games frequently interrupted by commercial interruptions. Edwards noted that the company’s own public declarations indicate it operates as both a direct publisher and a reseller on roughly two-thirds of its portfolio. This dual positioning allows firms to act on multiple sides of the automated bidding equation, creating potential conflicts of interest where client ad spend can be directed toward owned-and-operated properties.
Similar complexities are visible elsewhere in the digital ecosystem. The popular Opera web browser, which has been majority-owned by the Chinese company Kunlun Tech since 2016 while maintaining its operational headquarters in Norway, presents an intricate adtech profile. A search of the browser’s parent domain on DecryptAds identifies 27 registered data brokers collecting information, including partners located in the UAE, China, Cyprus, Russia, Hong Kong, and Ukraine.
Legal Dossiers and Supply-Chain Investigations
Another advanced feature of the platform is its legal dossier lookup tool. While queries can take several minutes to process as they compile large volumes of data, the tool ultimately generates extensive intelligence regarding domain ownership history, registration timelines, corporate aliases, and structural relationships connecting disparate adtech companies, websites, and mobile applications.
This capability connects directly to broader industry investigations. Security researchers from firms like Bitsight recently uncovered an expansive security issue involving popular TV streaming sticks sold under the brand name H96. Investigators discovered that these devices quietly rent out consumer internet connections to unknown third parties while also spoofing mobile device signatures to artificially click on advertisements hosted on AI-generated content farms. Bitsight linked these malicious operations to a Chinese entity known as the Fengwo Group, which operated both the underlying device applications and the network of low-quality ad landing pages.
Using DecryptAds to inspect a now-dormant domain associated with the Fengwo Group reveals shared seller identifiers with unrelated gaming websites, which in turn connect to hundreds of active web properties operating within Russian advertising networks like Yandex. These interconnected networks typically feature low-quality games or utility tools that continuously generate automated ad impressions.
Quiet Removals and Industry Transparency
A significant challenge in combating digital ad fraud is the adtech industry’s tendency to handle bad actors through quiet administrative actions. When advertising networks suspect that a specific partner is engaging in fraudulent traffic or distributing malicious advertising payloads, they frequently remove the offender from their authorized seller lists without issuing public notifications.
This lack of transparency allows compromised or malicious adtech firms to avoid public accountability and continue operating across other exchanges. To bridge this visibility gap, DecryptAds incorporates a "quiet removals feed" that aggregates and cross-references sellers.json removals across multiple advertising exchanges.
Edwards explained that because traditional fraud reports are often shared privately among select clients rather than published broadly, administrative bans are frequently executed silently. By tracking sudden disappearances from sellers.json files across the industry, researchers can reconstruct a clearer picture of suspicious entities that are being quietly ejected from major exchanges.
Malvertising and AI Content Farms
Malvertising—the injection of malicious code into legitimate ad networks to distribute malware or redirect users to credential-harvesting phishing pages—remains a persistent threat across the digital economy. However, security researchers observe that these attacks are now predominantly hosted on automated, AI-generated content farms rather than high-traffic mainstream destinations. Major news and media websites typically deploy sophisticated protective technologies and third-party monitoring tools to rapidly detect and block malicious ad content.
In contrast, automated content farms designed to generate low-quality blog posts and images covering topics ranging from home improvement to consumer technology rarely invest in advanced brand safety protections. By signing up low-tier advertising partners, these sites inadvertently create vulnerable conduits for attackers to target unsuspecting visitors with malicious payloads.
Edwards emphasized that addressing structural security issues like malvertising and fraudulent AI-generated traffic will ultimately require greater data sharing and transparency from major ad networks. Specifically, he points to the industry’s limited sharing of the "supply chain object," a structured data component attached to programmatic ad bid requests that allows buyers to trace every seller, reseller, and intermediary involved in delivering an ad impression. Without visibility into these server-side supply chain objects, identifying the precise origin of a malicious ad delivery remains a complex and often frustrating endeavor.
Mitigation and User Protection
Given the pervasive nature of commercial tracking and ad-based security threats, industry experts continue to recommend comprehensive ad-blocking strategies at both the browser and network levels. For desktop and laptop users, extensions such as uBlock Origin Lite offer open-source protection against tracking and advertising scripts, while options like Adblock Plus serve mobile platforms like iOS.
More advanced users frequently implement network-wide blocking solutions by deploying local DNS sinkholes, such as Pi-hole running on lightweight hardware, to intercept tracking requests before they reach connected devices throughout a home network.
Security researchers also advise caution regarding the installation of mobile applications and smart TV software that aggressively prompt users to move away from standard web browsers. Because mobile apps often facilitate more invasive data collection and continuous user tracking, interacting with services directly through a secured browser environment can significantly reduce exposure to unwanted surveillance and data harvesting.
