Determining who is responsible for serving advertisements on a given website or harvesting personal data from a mobile application has long been a daunting, if not impossible, task for the average user. While this information is technically public, it has historically remained siloed within proprietary databases managed by major advertising platforms, effectively walled off from public scrutiny. A new, free-to-use service, DecryptAds, seeks to change this by scraping and correlating complex adtech data, providing a transparent view of the entities tracking user behavior across the digital landscape.
The launch of decryptads.com addresses a critical visibility gap in the modern internet economy. By continuously scanning files that websites and apps are mandated to make public—specifically ads.txt, app-ads.txt, and sellers.json—the platform maps the intricate relationships between publishers, ad brokers, and data harvesters. This transparency is vital for security professionals, privacy advocates, and researchers who have previously struggled to build a comprehensive picture of the advertising ecosystem.
The Mechanics of Adtech Transparency
The advertising technology industry relies on a series of text files to authorize who is permitted to buy, sell, or resell ad inventory. The "ads.txt" (Authorized Digital Sellers) file is a standard intended to prevent counterfeit inventory, while "app-ads.txt" extends this framework to mobile and smart TV applications. Furthermore, the "buyers.json" and "sellers.json" files provide a ledger of the entities operating within the ad exchange ecosystem.
Zach Edwards, the Chief Research Officer for DecryptAds and a threat researcher at Infoblox, explains that these files are often useless in isolation. The value of DecryptAds lies in its ability to cross-reference these fragmented data sets. "It’s an adtech tool, but we are trying to approach it from a security perspective," Edwards stated. "The service is built for privacy and security use cases that have been dramatically underserved."
The implications of this tool extend to tracking the origins of malicious advertisements—often referred to as "malvertising"—which can lead users to phishing sites or distribute malware. Furthermore, the platform serves as a diagnostic tool for identifying ad networks operating out of adversarial nations and detecting the rapid proliferation of "AI-generated slop," which consists of low-quality websites or apps designed solely to harvest ad revenue via automated traffic.
Supply Chain Integrity and Cross-Platform Analysis
Security researchers have long noted that supply-chain vulnerabilities rarely manifest in a single file. Instead, they appear as broken cross-references between various disclosure files, cloned declarations across unrelated domains, or discrepancies in bid logs. DecryptAds enables users to identify these irregularities by aggregating data that previously required manual, time-intensive investigation.
A case study provided by the platform involves the sports network espn.com. A search reveals a complex web of 143 ad partners and 19 registered data brokers. This discovery is bolstered by recent legislative shifts in the United States; laws in California, Oregon, Texas, and Vermont now mandate that data brokers register if they buy or sell consumer information. DecryptAds highlights that nearly half of the brokers associated with the network are actively collecting geolocation data from non-blocking users, while others capture device fingerprints and sensitive personal metadata.
Addressing Geo-Risk and Financial Sanctions
One of the most concerning features revealed by the platform is the geographic origin of certain advertising entities. DecryptAds flags "geo-risk" areas, including Russia, China, and nations with significant political or financial ties to those states, such as the United Arab Emirates (UAE) and Cyprus.
A notable finding involves "Between Digital," an adtech firm with a reported New York office that is nevertheless identified by the platform as a Russian-based entity. Analysis of the company’s documentation shows its publisher offers are processed through Alfa Bank, Russia’s largest private commercial bank, which has been subject to U.S. sanctions since the 2022 invasion of Ukraine. Despite these links, multiple U.S. military-focused news outlets, including Armytimes.com and Navytimes.com, have been found to permit Between Digital to serve ads. This suggests a systemic lack of vetting in the adtech supply chain, where publishers may be unaware of the ultimate ownership or financial affiliations of their advertising partners.
The Proliferation of AI Slop and Malvertising
The rise of AI-generated content farms has exacerbated the malvertising crisis. Unlike major media outlets that employ sophisticated tools to filter bad actors, these content farms often prioritize high-volume, low-quality traffic. By signing up with low-tier advertising partners, these sites create "greased rails" for malicious actors to reach users.
Research from firms like Bitsight has confirmed that malicious apps, such as those found on H96 TV streaming sticks, have been used to spoof mobile devices, clicking on ads within these AI-generated networks to commit fraud. DecryptAds helps map these connections by revealing shared seller IDs across disparate domains. By pivoting on a single seller ID, researchers can uncover hundreds of active websites that serve as conduits for low-quality games and utilities, all contributing to a sprawling ecosystem of fraudulent ad impressions.
The Need for Industry-Wide Data Sharing
According to Edwards, the industry remains opaque because ad networks often remove suspected bad actors "quietly." When an exchange identifies a fraudulent entity, they may simply purge them from their sellers.json file without notifying the wider industry. This lack of communication allows the bad actors to continue operating on other platforms, effectively moving their fraud from one exchange to another without consequence.
To combat this, DecryptAds has implemented a "quiet removals feed" that correlates these deletions across the entire adtech landscape. This provides a mechanism for stakeholders to see the "why" and "where" behind sudden changes in advertising partnerships. However, Edwards argues that real change will only come when major networks share the "Supply Chain Object" (SCO). The SCO is structured data attached to ad bid requests that identifies every intermediary involved in an impression. Currently, this data is kept server-side, preventing publishers and security analysts from identifying the exact culprit behind a malicious ad payload.
Practical Steps for User Security
Given the breadth of tracking and the risk of malvertising, experts continue to recommend robust ad-blocking measures. For desktop users, open-source extensions like uBlock Origin remain the gold standard. For those seeking a network-wide solution, hardware-based blocking using a Raspberry Pi and Pi-hole software offers a highly effective, scalable defense.
Mobile app users face a steeper challenge. Many applications are designed specifically to circumvent browser-based protections, often to facilitate deeper data collection or to serve as vessels for tracking SDKs (Software Development Kits). Consequently, the most effective security strategy remains a healthy skepticism toward unnecessary mobile applications and a preference for browser-based interaction whenever possible.
The launch of DecryptAds marks a significant shift in the power dynamic between the adtech industry and the public. By providing a clear, navigable, and free view of the digital supply chain, the platform empowers users and organizations to make informed decisions about their privacy. As regulatory bodies continue to examine the data broker economy, tools that democratize this information will play an increasingly vital role in maintaining the security and integrity of the digital ecosystem. The ability to verify the partners behind the ads we see is no longer just a technical luxury; it is a necessary component of modern cybersecurity hygiene.
