The Dark World of Adtech: A New Service Sheds Light on Who’s Tracking You
A new, free online service called DecryptAds is changing the game for individuals and organizations seeking to uncover who’s behind the ads they see on their favorite websites and mobile apps. This powerful tool scrapes and correlates publicly available data from these platforms, making it easy to quickly learn about the entities that are tracking you.
At its core, adtech refers to the complex network of companies involved in buying, selling, and reselling online advertising space. These companies often operate behind the scenes, making it difficult for users to know who’s collecting their data or showing them ads. DecryptAds founder Zach Edwards, a threat researcher at Infoblox, explains that his team created the service because adtech data is only useful when cross-referenced to build a complete picture of the advertising ecosystem.
“We’re approaching adtech from a security perspective,” Edwards said. “It’s really built for a lot of privacy and security use cases that have been dramatically underserved.” These use cases include tracking down malicious ads, identifying ad networks in adversarial nations, and detecting AI-generated websites and apps. DecryptAds makes it easy to spot these potential threats by highlighting suspicious connections between adtech companies, data brokers, and other entities.
A search of the popular sports network espn.com reveals 143 ad partners and 19 registered data broker domains listed within its ads.txt and app-ads.txt files. What’s concerning is that almost half of those data brokers are collecting geolocation data from visitors who aren’t blocking ads, while three others disclose that they collect device fingerprints and sensitive personal information.
DecryptAds also makes it easy to learn the beneficiaries and national origins of adtech firms lurking in apps and websites. The service displays a warning when adtech partners of an app or website are based in “geo-risk” areas like China and Russia, or in countries with strong financial and political ties to both. According to DecryptAds, espn.com works with four different advertising entities that are based in either Russia, China, or the UAE.
One such entity is Between Digital, which lists a New York address but is flagged by DecryptAds as a Russian firm. Their publisher offers are processed through Alfa Bank, Russia’s largest private commercial bank and one of several financial institutions placed under U.S. sanctions in 2022 after Russia invaded Ukraine.
For individuals concerned about their online privacy, DecryptAds provides a valuable tool for uncovering the entities behind the ads they see. By using this service, users can take steps to protect themselves from potential threats. For organizations, DecryptAds offers a way to monitor and improve their own adtech supply chain integrity.
Ultimately, DecryptAds sheds light on the complex world of adtech and empowers users to make informed decisions about their online presence. As Edwards notes, “Supply-chain integrity issues rarely live in a single file.” By cross-referencing publicly available data, DecryptAds helps users spot these issues before they become major problems.
Source: Krebs on Security — 2026-08-14