In an era where the digital economy is fueled by the relentless collection of user data, the machinery behind online advertising has remained notoriously opaque. For years, the average internet user has been subject to a "black box" ecosystem: websites serve ads and apps harvest location data, but determining exactly who is behind these transactions—and where that data ultimately travels—has been a task reserved for specialized security researchers and industry insiders.
That paradigm is beginning to shift with the launch of DecryptAds, a powerful, free service designed to illuminate the complex web of advertising technology (adtech) partnerships. By scraping and cross-referencing public disclosure files that most users never see, DecryptAds provides a transparent look at the data brokers and ad networks currently tracking our digital footprints.
The Mechanics of Transparency: Decoding the Files
The core functionality of DecryptAds lies in its ability to aggregate and analyze three critical types of files that major websites and mobile apps are required to maintain:
- ads.txt: A file that lists the authorized adtech companies and data brokers permitted to run ads or harvest data on a specific website.
- app-ads.txt: The mobile and smart TV equivalent of ads.txt, identifying entities that have access to application-level user data.
- buyers.json/sellers.json: These files reveal the complex chain of custody, detailing the entities buying, selling, or reselling ad inventory.
While this data has technically been "public," it has historically existed in silos. Zach Edwards, Chief Research Officer for DecryptAds and a veteran threat researcher at Infoblox, explains that the true value of the platform is its ability to correlate these disparate sources. "It’s an adtech tool, but we’re trying to approach adtech from a security perspective," Edwards notes. "It’s really built for a lot of privacy and security use cases that have been dramatically underserved."
Chronology of a Data Ecosystem
The shift toward greater transparency has been a slow, bureaucratic crawl, punctuated by recent legislative breakthroughs. Four U.S. states—California, Oregon, Texas, and Vermont—have recently passed laws mandating that data brokers register their activities if they handle consumer data. This has forced a gradual disclosure of previously hidden practices.
However, researchers like Edwards argue that static file disclosure is insufficient. Supply-chain integrity issues, such as cloned declarations across unrelated domains or broken cross-references, are near-impossible to detect when viewing a single file. DecryptAds was launched to bridge this gap, providing a centralized dashboard that tracks these "supply chain objects" (SCOs) and identifies inconsistencies that often indicate fraud or malicious activity.
Supporting Data: The Case of ESPN.com
To illustrate the sheer scale of the tracking apparatus, a search for a high-traffic destination like espn.com via DecryptAds reveals staggering figures. The sports giant lists 143 ad partners and 19 registered data brokers within its ads.txt and app-ads.txt files.
Of these brokers, DecryptAds reports that nearly half are harvesting geolocation data from visitors who do not employ ad-blocking technology. Even more concerning, three of these entities explicitly disclose the collection of device fingerprints and sensitive personal information. This is not merely about displaying a banner ad; it is about building a persistent, multi-layered profile of the user’s physical location and digital identity.
High-Risk Partnerships and Geopolitical Exposure
One of the most alarming features of the DecryptAds platform is its "Geo-Risk" indicator. The tool flags adtech partners based in jurisdictions that present significant national security concerns, including Russia, China, and countries with deep ties to these nations, such as the United Arab Emirates (UAE) and Cyprus.
The investigation into espn.com found that the site works with four advertising entities linked to these high-risk regions. Among them is Between Digital, a firm that presents a New York address but is identified by DecryptAds as a Russian-based entity. The dossier reveals that Between Digital’s financial transactions are processed through Alfa Bank, Russia’s largest private commercial bank—an institution that has been under strict U.S. sanctions since the 2022 invasion of Ukraine.
The issue extends beyond sports media. A search for major U.S. military news outlets—including Army Times, Air Force Times, and Defense News—reveals that these platforms also allow Between Digital to serve ads. This creates a potential vulnerability where military personnel and their families are being tracked by an entity with deep financial and political ties to an adversarial state. When asked for comment regarding these findings, both Between Digital and its founder remained silent.
The Rise of "AI Slop" and Malvertising
Beyond data privacy, DecryptAds has become a vital tool in the fight against "malvertising"—the insertion of malicious ads that redirect users to phishing sites or distribute malware. Edwards points out that these threats are increasingly migrating away from high-traffic, well-monitored sites and toward "AI slop" websites.
These "slop" farms—sites populated with low-quality, machine-generated content—are frequently used as delivery vehicles for zero-click payloads. Because these sites lack the sophisticated security infrastructure of major publishers, they often sign up the lowest-tier ad partners, creating a "greased rail" for attackers to reach users.
The danger is amplified by the fact that many ad networks "quietly remove" offending advertisers when fraud is detected, without notifying the wider public. DecryptAds maintains a "Quiet Removals Feed" that tracks these disappearances, allowing security teams to identify patterns of bad actors who are being purged by one exchange only to surface on another.
Implications: The Need for Industry-Wide Reform
The findings from DecryptAds suggest that the modern digital advertising industry is built on a foundation of "willful blindness." As Edwards asserts, the industry must move toward greater transparency by sharing the "supply chain object" (SCO). This structured data would allow buyers to see every intermediary involved in passing an ad impression from the publisher to the final buyer.
"If we can encourage the adtech industry to expose that SCO," Edwards says, "it will get easier to find the culprit behind any one bad ad." Without this, government agencies and private organizations will continue to struggle against zero-click exploits targeting their personnel.
Consumer Protection: How to Defend Your Data
For the individual user, the proliferation of tracking and malvertising is a clarion call for defensive action. While there is no "silver bullet," a multi-layered approach can significantly reduce one’s digital exposure:
- Browser-Level Blocking: For desktop users, uBlock Origin Lite remains the gold standard for open-source ad blocking. It is highly efficient and frequently updated to counter new tracking techniques.
- Mobile Caution: Mobile apps are frequently more intrusive than their browser counterparts. Whenever possible, access services via a mobile browser rather than installing a dedicated app, which often requests excessive permissions and bypasses network-level protections.
- Network-Level Defense: For technically inclined users, a Raspberry Pi running Pi-hole offers the most robust protection. By acting as a DNS sinkhole, Pi-hole blocks ads and trackers for every device on your home network, effectively neutralizing many of the threats identified by DecryptAds before they even reach your screens.
- Verification: Before downloading new apps—especially those related to smart TVs or streaming sticks—users are encouraged to query those apps on
decryptads.com. Understanding the network of data brokers associated with an application is the first step in reclaiming control over your personal information.
As the digital landscape grows more hostile, tools like DecryptAds provide a necessary window into the mechanics of the internet. By exposing the invisible threads that connect our devices to data brokers in adversarial nations and content farms, we can begin to hold the adtech industry accountable for the privacy and security of the global user base.
