For years, the advertising technology (adtech) industry has operated behind a veil of complexity. While consumers interact with websites and mobile apps daily, the vast, interconnected network of data brokers, ad exchanges, and third-party trackers harvesting their personal information has remained largely invisible. The data required to unmask these entities—the ads.txt, app-ads.txt, and sellers.json files—is technically public, but it has historically been fragmented and siloed within proprietary platforms, effectively walled off from public scrutiny.
That dynamic is shifting. A powerful, free new service called DecryptAds has launched with the express purpose of scraping, correlating, and simplifying this adtech data. By turning opaque text files into searchable, actionable intelligence, DecryptAds provides researchers, privacy advocates, and security professionals with a clear picture of exactly who is tracking them, where that data is going, and the risks inherent in today’s digital supply chain.
The Genesis of Transparency: A Security-First Approach
The project is the brainchild of Zach Edwards, a seasoned threat researcher at Infoblox and Chief Research Officer for DecryptAds. Alongside two co-founders, Edwards recognized that the adtech ecosystem was suffering from a critical lack of oversight. The existing disclosure files—designed to prevent ad fraud—were being underutilized because their true value only emerges when they are cross-referenced across thousands of domains and apps.
"It’s an adtech tool, but we’re trying to approach it from a security perspective," Edwards explained. "It’s built for privacy and security use cases that have been dramatically underserved."
The core utility of the service lies in its ability to connect the dots. Supply-chain integrity issues, Edwards notes, rarely manifest in a single file. Instead, they appear as broken cross-references, cloned declaration sets across unrelated domains, and suspicious seller removals that only become apparent when viewed through an aggregate lens. By centralizing this data, DecryptAds transforms a jumble of raw text into a diagnostic tool for the modern web.
Chronology and Scope: From Files to Dossiers
The launch of decryptads.com represents a significant milestone in digital accountability. The service works by continuously scraping the files that websites and apps are required to make public. These include:
- ads.txt: A comprehensive list of companies authorized to sell or resell a website’s advertising inventory.
- app-ads.txt: The equivalent for mobile and smart TV applications, identifying entities that harvest data or serve ads within these environments.
- buyers.json/sellers.json: Metadata detailing the entities involved in the buying and selling of ad inventory.
Since its inception, the platform has begun building "Legal Dossiers" for domains and apps. This feature allows users to trace the ownership history of a digital property, identify aliases, and map relationships between adtech companies. For instance, a search for a major sports network like espn.com reveals 143 ad partners and 19 registered data brokers.
The inclusion of data broker information is particularly timely. Following new legislation in California, Oregon, Texas, and Vermont, data brokers are now required to register if they handle consumer data. DecryptAds provides the crucial link between these registrations and the specific websites where these brokers are collecting geolocation, device fingerprints, and sensitive personal information.
The Geopolitical Risk: Following the Money
One of the most concerning features of the platform is its "Geo-Risk" indicator. DecryptAds alerts users when an app or website works with adtech partners based in high-risk jurisdictions, including Russia, China, and nations with deep financial ties to those states, such as the United Arab Emirates (UAE) and Cyprus.
The implications of this are significant. For example, the site’s analysis of espn.com flagged four advertising entities with ties to Russia, China, or the UAE. A notable case is the firm Between Digital. While the company maintains a New York address, DecryptAds’ dossier identifies it as a Russian-linked firm, noting that its publisher offers are processed through Alfa Bank—Russia’s largest private commercial bank, which was hit with U.S. sanctions in 2022 following the invasion of Ukraine.
The danger extends to high-security domains. Searches for U.S. military-related news sites—including armytimes.com, defensenews.com, and navytimes.com—revealed that these outlets permit Between Digital and other entities in the UAE and Panama to serve ads. With Between Digital collecting data from an estimated 55,000 partner websites, the potential for cross-platform surveillance is immense.
The "AI Slop" and Malvertising Nexus
Perhaps the most alarming trend identified by DecryptAds is the rise of "AI slop"—low-quality, machine-generated websites and apps designed solely to capture ad revenue. These sites, which cover topics ranging from cooking to home improvement, are rarely protected by the sophisticated ad-filtering technologies used by major publishers.
"None of these slop AI content farms are paying for that kind of protection," Edwards noted. "They’re just signing up the lowest-quality partners, and it essentially becomes a greased rail to target the users of those sites with malicious ads."
This creates a perfect storm for "malvertising"—the insertion of malicious code into ads to deliver malware or redirect users to phishing pages. Because these content farms have no incentive to police their supply chain, they become the primary vector for zero-click exploits.
The platform’s research mirrors findings from firms like Bitsight, which recently exposed the H96 line of TV streaming sticks. These devices were found to be spoofing mobile phones to click on ads within AI-generated websites, creating a fraudulent revenue stream for the Fengwo Group, the Chinese entity behind the scheme. DecryptAds’ ability to pivot on "Seller IDs" allowed researchers to trace the connections between these malicious apps and a wider network of Russian Yandex-based advertising systems.
Official Responses and Industry Accountability
When pressed for comment on these findings, many adtech companies remain silent. Edwards points out that the industry often engages in "quiet removals"—deleting suspicious partners from their sellers.json files without public explanation.
"The ban is just removing them from the file, but they told nobody," Edwards said. "One day it was there, the next it was gone. If you’re trying to navigate who is suspicious, that’s usually tough to do because there are a lot of adtech companies removing things all at once."
To combat this, DecryptAds has introduced a "Quiet Removals Feed," which tracks these changes across exchanges, offering a rare glimpse into the industry’s internal policing mechanisms. Edwards argues that the only way to truly stop malvertising is to force the industry to share the "Supply Chain Object" (SCO)—structured data that identifies every participant in an ad’s journey. Currently, this data is kept server-side, preventing victims from identifying the exact point of compromise.
Implications for the Future of Privacy
The implications for the average user are stark. Mobile apps, in particular, are often sold to consumers as a "better experience" than a browser, but in reality, they are primary vehicles for invasive data collection. As companies increasingly integrate data-training models into their platforms, the risk of personal information being used to train the very AI that generates "slop" content becomes a legitimate concern.
For those looking to protect themselves, the consensus among security experts remains consistent: block everything.
- Desktop/Laptop: Tools like uBlock Origin Lite are the gold standard for open-source, maintained ad-blocking.
- Mobile: While browser-based ad blocking is effective on Firefox for Android, iOS users are more limited, often relying on Adblock Plus.
- Network Level: The most robust solution remains a hardware-based "sinkhole" like a Raspberry Pi running Pi-hole. This allows users to block trackers and ads for every device on their home network, from smart TVs to tablets.
Ultimately, the launch of DecryptAds marks a turning point. By democratizing access to the "pipes" of the internet, the service is forcing the adtech industry to confront its own lack of transparency. As consumers, researchers, and government agencies begin to leverage this data, the era of the "invisible" adtech supply chain may finally be coming to an end. The challenge ahead, however, lies in whether the industry will voluntarily embrace the transparency needed to secure the web, or if regulation will be required to force the issue.
