For the average internet user, the digital experience is defined by convenience: clicking a link, opening an app, or streaming a favorite show. Yet, beneath this seamless surface lies a sprawling, opaque, and often predatory ecosystem. Every time an ad loads on a website or a mobile app, a complex, lightning-fast auction takes place behind the scenes. This auction involves data brokers, advertising technology (adtech) firms, and shadowy intermediaries, most of whom operate entirely outside the user’s field of vision.
Determining exactly who is harvesting your data or serving you advertisements has traditionally been a task reserved for cybersecurity professionals or industry insiders. This data was technically "public," but it was buried in obscure files like ads.txt and app-ads.txt—text files that are notoriously difficult to parse and even harder to correlate.
That dynamic is shifting. A newly launched, free service called DecryptAds is changing the landscape by scraping and synthesizing this fragmented adtech data. By creating a searchable, cross-referenced intelligence engine, DecryptAds allows anyone—from security researchers to concerned consumers—to peel back the layers of the advertising supply chain.
The Architecture of Surveillance: What is DecryptAds?
At its core, DecryptAds (decryptads.com) functions as a transparency layer for the internet’s most secretive economy. The service constantly scrapes files that websites and apps are mandated to make public to disclose which entities are authorized to trade in their ad inventory.
The service synthesizes three primary data sources:
- ads.txt: A file listing all authorized digital sellers for a website.
- app-ads.txt: The equivalent for mobile and smart TV applications, identifying who is permitted to harvest data or serve ads within the app environment.
- buyers.json/sellers.json: A comprehensive map of the entities buying, selling, or reselling ad inventory.
Zach Edwards, Chief Research Officer for DecryptAds and a veteran threat researcher at the security firm Infoblox, notes that this data is essentially useless in isolation. "It’s an adtech tool, but we’re trying to approach it from a security perspective," Edwards explains. "It’s built for privacy and security use cases that have been dramatically underserved. Supply-chain integrity issues rarely live in a single file; they show up as broken cross-references, cloned declaration sets across unrelated domains, and anomalous seller removals."
A Chronology of Opacity and the Rise of Transparency
The adtech industry has long operated on a "don’t ask, don’t tell" basis regarding supply chain integrity. For years, the industry suffered from "malvertising"—the injection of malicious code into legitimate ad networks—and the proliferation of "AI slop," low-quality websites generated by machines specifically to host ads.
In recent years, the push for transparency has gained momentum, driven partly by legislative action. Four U.S. states—California, Oregon, Texas, and Vermont—have recently enacted laws requiring data brokers to register if they buy or sell consumer data. This has forced a greater level of disclosure, which DecryptAds captures and turns into actionable intelligence.
The tool’s emergence comes at a critical juncture. As threats evolve from simple nuisance ads to sophisticated, zero-click malware payloads, the ability to trace an ad back to its source—the "Supply Chain Object" (SCO)—has become a matter of national and personal security.
Supporting Data: The Case of ESPN and Beyond
To understand the scale of this, one only needs to look at a household name. A search for espn.com on DecryptAds reveals a staggering 143 ad partners and 19 registered data brokers.
The data reveals that nearly half of these brokers are actively collecting geolocation data from visitors. Even more alarming, three of these entities explicitly disclose the collection of device fingerprints and sensitive personal identifiers. This is not a fringe case; it is the industry standard for high-traffic sites.
Furthermore, DecryptAds highlights the "geo-risk" inherent in these supply chains. The platform flags partners based in jurisdictions that present potential geopolitical risks, including Russia, China, and countries with close financial ties to these nations, such as the UAE or Cyprus.
A striking example cited by DecryptAds is the firm Between Digital. While the company lists a New York address, the platform’s research links it to Alfa Bank, Russia’s largest private commercial bank, which has been under U.S. sanctions since the 2022 invasion of Ukraine. Despite these red flags, Between Digital remains integrated into the ad supply chains of top U.S. military news outlets, including Army Times, Air Force Times, and Defense News.
Official Responses and Industry Accountability
When confronted with these findings, the response from the adtech industry has been largely silent. KrebsOnSecurity reached out to Between Digital and its founder for comment regarding the firm’s Russian financial ties and its extensive presence across U.S. military news portals. As of this writing, no response has been provided.
The silence is perhaps expected. Edwards points out that when ad networks suspect an advertiser of fraud or malicious activity, they often "quietly remove" them from their sellers.json files without notifying the broader ecosystem. This lack of communication allows "dodgy" firms to maintain their reputation in other corners of the market, effectively "laundering" their presence across different exchanges.
DecryptAds aims to end this practice with its "Quiet Removals Feed," which tracks when companies are removed from exchange files, allowing researchers to spot trends in fraudulent behavior that were previously hidden in the noise.
Implications: The Path Toward a Secure Web
The implications of this transparency tool are twofold: they provide a roadmap for policy change and a set of actionable defensive measures for individuals.
1. The Need for "Supply Chain Objects"
Edwards argues that the only way to truly solve the malvertising crisis is for major ad networks to share the "Supply Chain Object" (SCO). This structured data allows buyers to see every intermediary involved in the ad impression. Without it, finding the culprit behind a malicious ad is like trying to find a needle in a haystack of thousands of servers.
2. The Rise of "AI Slop"
The threat is no longer just large, compromised sites. A new, dangerous trend involves "AI-generated slop"—thousands of low-quality websites created by bots. These sites serve as "greased rails" for malicious actors to deliver malware to unsuspecting users. Because these sites lack the security budgets of major media outlets, they are the preferred hosts for zero-click payloads.
3. Practical Defensive Strategies
For the average consumer, the reality is that the internet is a hostile environment for personal privacy.
- Ad Blocking: Experts continue to recommend robust, open-source ad-blocking tools. For desktop users, uBlock Origin Lite is the gold standard.
- Network-Level Protection: For those seeking a "set it and forget it" solution, deploying a Raspberry Pi with Pi-hole at the local network level is the most effective way to intercept and block ads before they ever reach your device.
- The Mobile Trap: Perhaps the most vital takeaway is the caution regarding mobile apps. Many companies push users toward apps not because they offer a better experience, but because they facilitate more granular data collection and tracking. Where possible, interacting with services via a browser with robust tracking protection remains the safer choice.
Conclusion
The launch of DecryptAds represents a milestone in the digital age. By transforming opaque, technical data into a transparent, accessible, and searchable resource, the service empowers the public to see the machinery of their own surveillance. As the lines between legitimate advertising and malicious cyber threats continue to blur, the demand for this kind of visibility will only grow. For the adtech industry, the message is clear: the era of hiding in the shadows is coming to an end.
