For the average internet user, the digital experience is defined by a paradox: we navigate a web of personalized content and free services, all while being silently tracked by a vast, invisible infrastructure of data brokers and advertising entities. Determining who is responsible for the ads on our screens—or who is harvesting data from our mobile applications—has traditionally been a task reserved for industry insiders and high-level cybersecurity researchers.
This wall of opacity is finally beginning to crack. A powerful new, free service called DecryptAds has launched, offering a sophisticated toolset designed to scrape, correlate, and demystify the complex web of adtech data that governs our online lives. By aggregating publicly available but disparate files, DecryptAds provides a clear, actionable picture of the entities tracking users across the digital landscape.
Main Facts: The Anatomy of Adtech Transparency
At its core, DecryptAds functions as a centralized intelligence hub for the digital advertising supply chain. The service continuously crawls the files that websites and apps are required to publish to disclose their authorized advertising partners. These files are the "paper trail" of the modern web:
- ads.txt: A file listing all authorized adtech companies and data brokers permitted to serve ads or collect data from a specific website.
- app-ads.txt: The mobile equivalent, identifying entities with access to user data and ad inventory on mobile and smart TV applications.
- buyers.json/sellers.json: Technical files that map out the entities involved in the buying, selling, or reselling of ad inventory, providing visibility into the "middlemen" of the ad economy.
By cross-referencing these files, DecryptAds transforms fragmented data into a comprehensive map of corporate relationships, exposing not just who is advertising on a site, but which entities are siphoning data and where those companies are headquartered.
Chronology and Origins: A Security-First Approach
The project was spearheaded by Zach Edwards, Chief Research Officer for DecryptAds and a noted threat researcher at the cybersecurity firm Infoblox. Working alongside two other founders, Edwards identified a significant gap in the market: while the data in ads.txt files was technically public, it was virtually useless in isolation.
"It’s an adtech tool, but we’re trying to approach adtech from a security perspective," Edwards explains. "It’s really built for a lot of privacy and security use cases that have been dramatically underserved."
The development of DecryptAds comes at a pivotal time. As legislative pressure mounts—notably in U.S. states like California, Oregon, Texas, and Vermont—data brokers are increasingly being forced to register their activities. DecryptAds capitalizes on these disclosures, merging them with existing technical data to provide a longitudinal view of how advertising and tracking behaviors evolve over time.
The service’s "quiet removals" feed is a standout feature in this timeline. Often, when an ad network detects fraudulent activity or malicious behavior, they quietly remove the offending party from their sellers.json file. This happens in the shadows, leaving the public and other partners in the dark. DecryptAds records these shifts, providing a historical account of which entities have been "purged" from the ecosystem, allowing researchers to spot patterns of bad behavior that would otherwise vanish from the record.
Supporting Data: The Case of ESPN and Military News
To understand the scale of this tracking, one need only look at the data for major web destinations. A search for espn.com on DecryptAds reveals 143 ad partners and 19 registered data broker domains. Of these, nearly half are actively collecting geolocation data from users who have not opted out, while others are harvesting device fingerprints and sensitive personal identifiers.
The risks extend beyond simple data collection. DecryptAds features a "Geo-Risk" flag, which alerts users when a website’s ad partners are based in nations with adversarial relationships with the West, such as Russia, China, or countries with significant ties to them, like the United Arab Emirates (UAE) or Cyprus.
Consider the case of Between Digital, an adtech firm that lists a New York address but is identified by DecryptAds as a Russian entity. The service’s dossier reveals that Between Digital’s financial transactions are processed through Alfa Bank, Russia’s largest private commercial bank—an institution currently under heavy U.S. sanctions. Despite these flags, DecryptAds shows that Between Digital is active on a massive scale, collecting data on approximately 55,000 partner websites, including high-profile U.S. military news portals like Army Times, Navy Times, and Defense News.
The implications of this are profound. When military personnel access news portals, they are unknowingly interacting with ad-tech partners that may be conduits for data leakage to foreign jurisdictions.
Official Responses and Industry Accountability
The adtech industry has long operated under a "black box" model, where supply chain integrity is rarely a priority. Edwards notes that "supply-chain integrity issues rarely live in a single file." Instead, they manifest as broken cross-references, cloned declaration sets, and illicit supply paths that appear in bid logs but are absent from official authorized-seller lists.
When questioned about the practices of companies like Between Digital, the industry often remains silent. KrebsOnSecurity reached out to Between Digital and its founder for comment regarding their Russian financial ties and their prevalence on U.S. defense-related sites; at the time of publication, no response had been received.
The industry’s failure to police itself is, according to Edwards, a direct result of a lack of transparency. Major ad networks possess a "supply chain object" (SCO)—a piece of structured data attached to every bid request that reveals exactly who sold or resold an ad impression. However, this data is kept server-side and is almost never shared with publishers or security researchers. By pushing for the exposure of SCO data, DecryptAds is attempting to force the industry toward a standard of accountability that currently does not exist.
Implications: Malvertising, AI Slop, and Privacy
The most immediate danger posed by this lack of oversight is "malvertising"—the injection of malicious code into legitimate ad networks. These attacks are increasingly migrating away from high-traffic sites like ESPN, which utilize advanced protection, and toward the rising tide of AI-generated "slop" websites.
These content farms, populated by machine-generated articles on everything from home improvement to recipes, rarely invest in security. They prioritize volume over quality, signing up the cheapest, least-vetted ad partners. For an attacker, these sites are "greased rails" for delivering zero-click malware payloads to unsuspecting users.
Furthermore, the legal implications for consumer privacy are worsening. DecryptAds’ "Legal Dossier" lookup has proven invaluable in connecting the dots between seemingly unrelated entities. For instance, recent research into H96 streaming sticks—which were found to be spoofing mobile devices to click on ads—showed that the same actors behind the malicious apps on these devices were also operating the ad-laden AI slop sites they were "visiting." This level of cross-platform, multi-device orchestration would be invisible without the granular data aggregation provided by the DecryptAds platform.
What Can Users Do?
The consensus among cybersecurity experts is that the current adtech environment is fundamentally broken. To protect themselves, users should take active measures:
- Deploy Ad-Blocking Software: For desktop users, uBlock Origin Lite remains the gold standard. It is open-source, efficient, and highly effective at blocking the tracking scripts that feed the data-broker ecosystem.
- Network-Level Protection: For more advanced users, setting up a Raspberry Pi running Pi-hole provides a "sinkhole" for ad requests across an entire household network, protecting every connected device, including smart TVs.
- App Caution: Be highly skeptical of mobile apps that demand excessive permissions. In many cases, these apps are designed primarily to facilitate data harvesting that is far more invasive than a standard web browser experience. Where possible, use a web browser to access services rather than installing a dedicated app.
- Audit via DecryptAds: Use the DecryptAds portal to investigate the privacy practices of the apps and sites you frequent. Understanding the "geo-risk" of the partners attached to your favorite apps can be a powerful motivator for changing your digital habits.
The launch of DecryptAds marks a turning point in the struggle for digital sovereignty. By providing the public with the tools to see who is watching, tracking, and profiting from our online movements, it forces a long-overdue conversation about the integrity of the internet’s most pervasive, yet least understood, economic engine.
