Cracking the Adtech Black Box: How DecryptAds Exposes Global Tracking, Geopolitical Risks, and the Dark Side of Online Advertising

Navigating the modern internet often feels like walking through a digital minefield. Every website visit and mobile application engagement triggers a complex, invisible auction where adtech platforms, data brokers, and unseen corporations scramble to harvest personal information. While transparency disclosures have technically existed for years, this vital data has historically remained locked behind walled gardens, buried in obscure text files, or deliberately obfuscated by massive advertising conglomerates.

Enter DecryptAds, a powerful, free, and publicly accessible service designed to scrape, parse, and correlate adtech data. By translating dense industry disclosures into actionable insights, DecryptAds is transforming how security researchers, privacy advocates, and everyday web users understand the digital advertising supply chain.

Main Facts: What is DecryptAds and How Does It Work?

Launched at decryptads.com, the platform addresses a critical blind spot in cybersecurity and data privacy. For years, the advertising industry has utilized standardized public text files to disclose which entities are authorized to buy, sell, or place ads. However, analyzing these files in isolation rarely reveals the full picture.

DecryptAds continuously monitors, scrapes, and cross-references four primary data sources:

• ads.txt: Outlines the specific adtech companies and data brokers permitted to run advertisements or harvest data from a given website.
• app-ads.txt: Extends this accountability to mobile and smart TV applications.
• buyers.json and sellers.json: Explicitly identify the entities buying, selling, or reselling digital ad inventory.

By aggregating this information, DecryptAds allows users to look up virtually any major website or mobile app to view its entire ad partnership network, check for foreign ownership or geopolitical risks, and investigate suspicious supply chain anomalies.

Chronology: The Evolution of Ad Transparency and the Rise of DecryptAds

To understand why DecryptAds is a game-changer, it helps to examine how the digital advertising ecosystem developed transparency standards—and where those standards fell short.

• The Wild West of Early Adtech (Early 2010s): As programmatic advertising exploded, publishers and brands lost control over where their ads appeared. Fraudsters capitalized on this opacity through domain spoofing and unauthorized ad reseller networks.
• The Introduction of Ads.txt (2017): To combat ad fraud, the Interactive Advertising Bureau (IAB) introduced ads.txt (Authorized Digital Sellers). While a step forward, the raw data remained difficult for non-technical individuals to parse, and enforcement mechanisms were weak.
• The Rise of State Privacy Laws (2020–2025): Driven by legislation in states like California, Oregon, Texas, and Vermont, data brokers were legally forced to register if they bought or sold consumer data. This inadvertently opened new windows into the shadow economy of data collection.
• The Launch of DecryptAds (2026): Recognizing that security threats rarely live in a single file, threat researcher Zach Edwards and his fellow founders built DecryptAds. Designed to approach adtech from an adversarial security perspective, the platform brought together fragmented infrastructure data to expose supply-chain integrity issues, malicious ad networks, and state-backed tracking operations.

Supporting Data: Inside the Numbers

The scale of data collection revealed by DecryptAds is staggering, and its application to high-profile domains paints a concerning picture of modern internet surveillance.

The ESPN Ecosystem

A search for the popular sports network espn.com reveals 143 ad partners and 19 registered data broker domains declared within its ads.txt and app-ads.txt files. According to DecryptAds:

• Nearly 50% of those data brokers collect precise geolocation data from visitors who do not employ ad blockers.
• Another three partners explicitly disclose that they gather device fingerprints and sensitive personal information.

High-Risk Jurisdictions and Geopolitical Exposure

DecryptAds features a specialized "Geo Risk" warning system that flags adtech partners based in high-risk countries like Russia, China, or nations with deep financial ties to them, such as Cyprus and the United Arab Emirates (UAE).

For example, espn.com works with four entities based in Russia, China, or the UAE. Among them is Between Digital, an adtech firm listing a New York address but flagged by DecryptAds as a Russian entity. Its publisher offers are processed through Alfa Bank, Russia’s largest private commercial bank, which was placed under U.S. sanctions following the 2022 invasion of Ukraine.

Furthermore, searches across top U.S. military news sites—including Army Times, Air Force Times, Defense News, Navy Times, Marine Corps Times, and Federal Times—show that all of these platforms permit Between Digital to serve ads and track users, alongside entities based in the UAE and the corporate secrecy haven of Panama. DecryptAds reports that Between Digital actively collects data across approximately 55,000 partner websites.

Official Responses and Industry Dynamics

Despite the public availability of these records, institutional accountability within the adtech ecosystem remains weak.

Zach Edwards, chief research officer for DecryptAds and a threat researcher at Infoblox, points out a structural conflict of interest in the market. Platforms like Between Digital frequently list themselves as both publishers and resellers on roughly two-thirds of their portfolios.

"It means they are basically playing both sides of the bidding equation, which creates opportunities to direct client spend at your owned and operated properties or client infrastructure, essentially creating opportunities for conflicts of interest," Edwards explained to security journalist Brian Krebs.

Furthermore, when ad networks suspect an advertiser of generating unauthentic clicks or serving malicious payloads, they often practice quiet removals. Rather than issuing a public warning, networks simply delete the offender from their sellers.json files overnight. To counteract this, DecryptAds has introduced a Quiet Removals Feed to track and correlate these silent bans across multiple ad exchanges, shedding light on bad actors who try to quietly slip back into the supply chain.

Note: KrebsOnSecurity reached out to Between Digital and its founder for comment regarding its sanctions alignment and operational structure, with plans to update their reporting should a response be received.

Implications: Malvertising, AI Slop, and Protecting Your Privacy

The implications of DecryptAds’ launch extend far beyond corporate compliance; they directly touch upon national security, consumer safety, and the future of the internet.

Malvertising and AI-Generated Content Farms

Malicious advertising—where fake ads distribute malware or redirect users to phishing pages—is increasingly migrating away from high-traffic, heavily monitored destinations like major news outlets. Instead, threat actors are weaponizing fast-growing swarms of AI-generated "slop" websites (content farms featuring machine-generated text and images covering home improvement, recipes, cars, and technology).

These low-quality sites rarely invest in ad-filtering protections, opting instead for the lowest-tier advertising partners. This creates a "greased rail" where government officials, military personnel, and everyday consumers can be targeted with zero-click payloads simply by clicking a search result leading to an unverified content farm.

What Can You Do?

Security experts universally agree that the only foolproof defense against pervasive tracking and malvertising is proactive ad and script blocking. Depending on your technical proficiency and device ecosystem, several robust options exist:

1. Desktop and Laptop Browsers: uBlock Origin Lite is a free, open-source, and actively maintained extension that excels at stripping away tracking scripts and advertisements.
2. Mobile Devices: iPhone and iPad users can utilize Adblock Plus. Android users can leverage Firefox paired with uBlock Origin. Both adblockers support custom filtering rules from community lists like EasyList.
3. Network-Level Blocking (Power Users): For the highest level of security, setting up a Raspberry Pi running Pi-hole creates a network-wide DNS sinkhole that blocks advertisements and trackers across every connected device in a home network.
4. Exercise Caution with Apps: Major web platforms frequently pressure users to download dedicated mobile apps. While pitched as a better user experience, these apps are primarily designed to keep users locked into ecosystems and to harvest far more precise tracking data—including data increasingly utilized to train large language models. Whenever possible, interact with services via a privacy-respecting web browser rather than installing proprietary mobile or smart TV applications.

By laying bare the complex, often shadowy web of global advertising partnerships, tools like DecryptAds give security professionals and everyday internet users the visibility they need to fight back against ubiquitous digital surveillance.