For the average internet user, the web experience is a seamless, if occasionally interrupted, stream of content. You visit a news site, scroll through an app, or check a weather report, and advertisements appear almost instantaneously. To the user, these are just pixels. To the advertising technology (adtech) industry, these interactions are high-stakes data auctions involving a labyrinthine network of brokers, trackers, and resellers.
For years, the inner workings of this ecosystem—who is harvesting your data and which entities are permitted to bid on your digital identity—have remained locked behind proprietary walls and fragmented technical files. That opacity is now being challenged by DecryptAds, a powerful new service that scrapes, parses, and cross-references public adtech data to pull back the curtain on the industry’s most opaque practices.
The Architecture of Disclosure: How It Works
At the heart of the digital advertising supply chain are three key files that websites and mobile applications are encouraged to publish: ads.txt, app-ads.txt, and sellers.json. These files serve as a ledger of authorization, declaring which companies have permission to sell ad space on a particular domain or app.
Historically, these files have been static, isolated, and ignored by the general public. DecryptAds changes this by continuously scraping these declarations and correlating them across the entire web. By mapping the relationships between publishers, ad exchanges, and data brokers, the platform provides a bird’s-eye view of how an entity’s ad inventory is being traded.
"It’s an adtech tool, but we’re trying to approach the industry from a security perspective," explains Zach Edwards, Chief Research Officer for DecryptAds and a veteran threat researcher at Infoblox. "These files were never intended to be viewed in isolation. They only become truly meaningful when cross-referenced to build a complete picture of the advertising ecosystem. We are building this for privacy and security use cases that have been dramatically underserved."
A Chronology of Surveillance and Systemic Risk
The rise of the current surveillance-heavy ad model did not happen overnight. It was built on the back of “programmatic advertising”—an automated process where the right to show an ad is auctioned in milliseconds.
- The Early Days (2010s): Adtech grew rapidly, with little oversight regarding where ads were placed or what data was harvested.
- The Regulatory Push (2020s): States like California, Oregon, Texas, and Vermont began passing laws requiring data brokers to register, finally forcing some transparency into the shadowy world of third-party data collection.
- The Rise of "Slop" (2024-2026): With the proliferation of generative AI, the web has been flooded with "AI-generated slop"—low-quality websites designed solely to host ads and harvest data. These sites often lack the security protocols of reputable publishers, making them prime real estate for malvertising.
- The Launch of DecryptAds (2026): By consolidating fragmented data, the service emerged to provide the public and security researchers with the tools to see exactly who is lurking behind the digital curtain of their favorite sites.
Supporting Data: The ESPN Case Study
To understand the scale of the tracking apparatus, one need only look at the dossier for espn.com. A search on DecryptAds reveals a staggering 143 ad partners and 19 registered data brokers operating within its advertising supply chain.
According to the data, nearly 50% of these brokers are actively collecting geolocation data from users who do not utilize ad-blocking software. Even more concerning, three of these entities explicitly disclose the collection of device fingerprints and sensitive personal information. This is not a anomaly; it is the industry standard for high-traffic websites that rely on third-party ad exchanges to monetize their audience.
High-Risk Geographies and Supply-Chain Integrity
One of the most critical features of DecryptAds is its "Geo-Risk" indicator. The platform flags advertising entities based in high-risk jurisdictions, including Russia, China, and countries with close financial ties to these nations, such as Cyprus and the United Arab Emirates.
The findings are jarring. Even prominent U.S. military news outlets—including Army Times, Air Force Times, and Defense News—have been found to allow adtech partners with direct ties to Russian financial institutions to serve ads and track their readers. Specifically, the firm Between Digital, which maintains a New York presence, has been flagged for its deep ties to Russia’s Alfa Bank—a financial institution under U.S. sanctions.
This raises significant questions about supply-chain integrity. As Edwards notes, "Supply-chain integrity issues rarely live in a single file. They show up as broken cross-references between ads.txt and sellers.json files, or as cloned declaration sets across unrelated domains. When we see adtech companies playing both sides of the bidding equation—acting as both publisher and reseller—it creates massive conflicts of interest."
Official Responses and Industry Accountability
When confronted with evidence of suspicious behavior or links to high-risk actors, ad networks often resort to "quiet removals." They may excise a bad actor from their sellers.json file without public explanation or notification to the publishers who trust them.
DecryptAds tracks these "quiet removals," creating a feed that allows researchers to spot patterns of fraud that would otherwise remain hidden. This lack of transparency is a central complaint among security experts. The industry’s refusal to share the "supply chain object" (SCO)—a piece of data that tracks the entire journey of an ad impression from the publisher to the final buyer—is, according to Edwards, the primary obstacle to stopping malvertising. Without the SCO, victims of malicious zero-click redirects or phishing ads have no way of knowing which entity in the chain facilitated the attack.
Implications for Security and Privacy
The implications of this opaque ecosystem are far-reaching. For the average consumer, it means that every mobile app and web page is a potential conduit for data exfiltration. For government and corporate entities, it presents a tangible security threat: the potential for "zero-click" payloads delivered through legitimate-looking ad networks on low-quality, AI-generated sites.
As the lines between digital advertising and malicious surveillance blur, the responsibility for protection falls increasingly on the user. Security experts are now advocating for a multi-layered defense:
- Network-Level Blocking: Utilizing tools like Pi-hole on a Raspberry Pi allows users to block ad-tracking at the DNS level for every device on a local network.
- Browser-Based Defense: Utilizing robust, open-source extensions like uBlock Origin Lite remains the most effective way to prevent the execution of tracking scripts on desktops and select mobile browsers.
- App Skepticism: Users should be wary of mobile apps that push for excessive permissions. In many cases, these apps are simply vehicles for more invasive tracking than what is possible through a standard web browser.
Conclusion: The Path Toward Transparency
DecryptAds is more than just a research tool; it is a diagnostic instrument for the modern internet. By exposing the hidden relationships between websites and the vast, often adversarial, adtech industry, the service provides the transparency necessary to demand accountability.
As Edwards concludes, "A lot of serious organizations are starting to understand that if we’re not breaking down this ad data, we’re not going to know who’s targeting people with zero-click payloads." The era of "blind trust" in digital advertising is coming to an end. Whether through government regulation or personal vigilance, the demand for visibility into the digital supply chain has never been higher. For now, services like DecryptAds provide the only real map we have for navigating this surveillance-ridden landscape.
