DecryptAds provides new transparency into the opaque world of digital advertising and data tracking
Determining exactly who is responsible for the advertisements displayed on a website or the data harvested by a mobile application has long been an exercise in frustration. While this information is technically public, it has historically remained siloed within proprietary adtech platforms, obscured by complex supply chains and a lack of standardized reporting. A newly launched service, DecryptAds, aims to dismantle these barriers by scraping, aggregating, and correlating fragmented adtech data, offering users and security researchers an unprecedented view into the entities tracking their digital behavior.
The service, available at decryptads.com, functions by systematically crawling files that websites and mobile apps are required to publish for the sake of ad transparency. These files, specifically ads.txt, app-ads.txt, and various JSON-formatted seller disclosures, act as a ledger for the digital advertising ecosystem. By cross-referencing these documents, DecryptAds provides a holistic picture of the relationships between publishers, ad exchanges, and data brokers.
The Anatomy of Adtech Transparency
The foundation of DecryptAds lies in its ability to parse three primary data sources that govern the modern internet:
- ads.txt: A file used by website publishers to publicly declare which companies are authorized to sell their digital advertising inventory.
- app-ads.txt: The mobile and smart TV equivalent of the above, vital for identifying the entities capable of harvesting data from connected device applications.
- buyers.json/sellers.json: These files detail the specific companies participating in the buying, selling, or reselling of ad impressions.
Zach Edwards, Chief Research Officer for DecryptAds and a veteran threat researcher at Infoblox, notes that the service was born out of a necessity to treat adtech through the lens of cybersecurity rather than just marketing performance. "It is an adtech tool, but we are approaching it from a security perspective," Edwards stated. "The industry has long suffered from a lack of visibility into supply-chain integrity. These issues rarely manifest in a single file; they appear as broken cross-references, cloned declaration sets across unrelated domains, and supply paths that exist in bid logs but are absent from authorized seller lists."
Chronology of Data Exposure
The push for this level of transparency is largely a reaction to the rapid growth of the "adtech supply chain," which has expanded exponentially over the last decade. Historically, publishers had little incentive to disclose the breadth of their partnerships. However, the introduction of consumer privacy legislation in jurisdictions such as California, Oregon, Texas, and Vermont has forced data brokers to register and disclose their activities.
As these laws began taking effect, the data became more accessible, but it remained unintelligible to the average consumer. DecryptAds serves as a translation layer, taking these regulatory disclosures and mapping them against the technical reality of how ads are served. By building a searchable, visual interface for this data, the service allows users to see not just which companies are present, but the potential risks associated with them.
Case Study: The ESPN Ecosystem
The efficacy of the DecryptAds platform is best illustrated by its analysis of high-traffic domains. A search for espn.com reveals a staggering network of 143 ad partners and 19 registered data brokers. According to the data aggregated by the service, approximately 50% of these brokers are actively collecting geolocation data from visitors. Perhaps more concerning are the three entities identified as collecting device fingerprints and sensitive personal identifiers.
This visibility extends to the geographic origins of these firms. DecryptAds implements a "geo-risk" flag for adtech partners based in jurisdictions with heightened regulatory or political scrutiny, such as Russia, China, or countries with close financial ties to these regions, including Cyprus and the United Arab Emirates.
For instance, the service highlights the presence of Between Digital, an entity with a registered New York address that is nonetheless identified in the dossier as a Russian-based firm. The analysis notes that their publisher offers are processed through Alfa Bank, Russia’s largest private commercial bank—an institution currently under U.S. sanctions following the 2022 invasion of Ukraine. Similar patterns emerge when analyzing major U.S. military news outlets, which frequently allow the same high-risk entities to serve advertisements to their audiences.
Implications for Malvertising and AI Slop
The rise of "AI slop"—low-quality, machine-generated websites designed solely to host advertisements—has created a fertile ground for malvertising. Because these sites lack the stringent quality controls of major media outlets, they often act as gateways for malicious ads that distribute malware or redirect users to phishing sites.
Edwards emphasizes that malicious actors are increasingly exploiting the lack of coordination between ad networks. When an ad network suspects fraud, they often quietly remove an advertiser from their lists without informing the broader ecosystem. This "quiet removal" prevents other platforms from blacklisting the same malicious actors. DecryptAds aims to solve this by providing a "quiet removals feed," which alerts the industry to when an entity is suddenly purged from multiple exchanges, effectively creating a public record of suspected bad actors.
Furthermore, the platform highlights the risks of "supply chain objects" (SCO). These are structured data packets that track an ad impression from the publisher to the final buyer. While critical for auditing, SCOs are rarely shared openly. Edwards argues that if the industry were to mandate the disclosure of SCO data, security professionals could immediately identify the source of zero-click payloads and malware distribution.
Broader Security and Privacy Considerations
The implications of these findings reach far beyond annoying pop-up ads. The research underscores a significant privacy risk: the use of mobile applications as a vector for data harvesting. Many large web destinations push users toward mobile apps, ostensibly for a better experience, but these apps often provide a more persistent and granular stream of user data. This data is increasingly being utilized to train large language models (LLMs) and other AI systems, often without explicit user consent.
Experts suggest that the most effective way for the average user to mitigate these risks is through a layered approach to blocking:
- Browser-Level Protection: Utilizing open-source, maintained extensions like uBlock Origin Lite.
- Network-Level Blocking: Deploying a DNS sinkhole, such as Pi-hole on a Raspberry Pi, which prevents ad-tracking requests from ever reaching the local network, protecting all devices including smart TVs and IoT gadgets.
- App Caution: Exercising extreme discretion when installing third-party applications, particularly those that offer "free" content, as they are frequently the primary vehicles for aggressive data harvesting and device fingerprinting.
Conclusion and Future Outlook
The launch of DecryptAds represents a critical step toward holding the digital advertising industry accountable for its supply chain practices. By providing free, accessible, and correlated data, the service empowers both individual users and security researchers to identify the entities profiting from their data and, in some cases, facilitating the distribution of malicious content.
As the digital landscape becomes increasingly dominated by AI-generated content and complex, cross-border ad networks, the ability to trace the flow of data and revenue will remain a core tenet of online security. While the major ad networks have yet to fully embrace the level of transparency advocated by the DecryptAds team, the existence of such a tool provides a necessary check on an industry that has operated in the shadows for too long. Moving forward, the effectiveness of these transparency measures will likely depend on continued public pressure and the willingness of regulators to enforce stricter standards on the digital advertising supply chain.
