Unveiling the AdTech Supply Chain: Inside DecryptAds and the Hidden Dangers of Digital Tracking

By Tech & Cyber Security Desk

Navigating the modern internet often feels like walking through a digital minefield. Every website visited and mobile application opened quietly deploys a vast, invisible infrastructure of trackers, scripts, and data brokers designed to harvest personal information. Historically, the companies responsible for serving ads and sifting through consumer data have operated behind a veil of opacity. While much of this information is technically semi-public, it has traditionally been walled away inside massive advertising platforms, making it difficult for the average user—or even security professionals—to parse.

That paradigm is beginning to shift. A powerful, free new intelligence service called DecryptAds has emerged to scrape, correlate, and demystify the complex web of adtech data. By translating obscure configuration files into actionable insights, DecryptAds provides unprecedented visibility into the entities tracking users across the digital ecosystem.

1. Main Facts: Demystifying the AdTech Ecosystem

At its core, DecryptAds (decryptads.com) serves as an investigative engine for the digital advertising supply chain. Developed by a trio of cybersecurity and adtech experts—including Chief Research Officer Zach Edwards, who also serves as a threat researcher at security firm Infoblox—the platform is designed to approach the advertising industry from a rigorous security and privacy perspective.

The service continuously scrapes and cross-references configuration files that websites and mobile applications are required to make publicly available. These files dictate which third-party entities are permitted to monetize content or siphon data:

• ads.txt (Authorized Digital Sellers): Lists all adtech companies and data brokers authorized to run advertisements or harvest data from a specific website.
• app-ads.txt: The equivalent of ads.txt, but implemented for mobile applications and smart TV platforms.
• buyers.json / sellers.json: Public registries that expose the entities buying, selling, or reselling ad inventory for a given digital property.

According to Edwards, viewing these files in isolation rarely reveals the full picture. Supply-chain integrity issues, malicious ad insertions, and fraudulent schemes typically manifest as broken cross-references, cloned declarations across unrelated domains, or sudden seller removals. By centralizing and correlating this data, DecryptAds allows researchers to map out complex corporate relationships in seconds rather than days.

2. Chronology: The Evolution of AdTech Transparency and Emerging Threats

The path toward tools like DecryptAds has been paved by a steady accumulation of regulatory pressure, shifting threat landscapes, and technological loopholes exploited by malicious actors.

• The Proliferation of Disclosure Standards (2010s): Recognizing widespread ad fraud and domain spoofing, the Interactive Advertising Bureau (IAB) introduced ads.txt and later app-ads.txt to bring baseline accountability to programmatic advertising. However, these files were rarely scrutinized outside of specialized adtech circles.
• The Rise of State-Level Data Privacy Laws (Recent Years): Momentum shifted as jurisdictions including California, Oregon, Texas, and Vermont enacted laws requiring data brokers to officially register if they buy or sell consumer data originating from those states. This regulatory shift gradually forced shadowy data brokers out into the open, making their inclusion in ads.txt files traceable.
• The H96 Streaming Stick Investigation (July 2026): Researchers at Bitsight exposed a widespread hardware vulnerability involving popular "H96" TV streaming sticks. These devices were found to quietly rent out users’ internet bandwidth to strangers and—when idle—spoof themselves as mobile phones to fraudulently click on advertisements hosted on low-quality, AI-generated "slop" websites. Bitsight linked this operation to the Chinese entity known as the Fengwo Group.
• The Launch of DecryptAds (August 2026): To combat the systemic opacity surrounding such operations, Edwards and his co-founders officially launched DecryptAds, offering public access to advanced adtech data correlation, geo-risk tracking, and quiet removal monitoring.

3. Supporting Data: Uncovering High-Risk Partners and Supply-Chain Complexities

A cursory search using DecryptAds reveals staggering entanglements between mainstream digital properties and high-risk entities.

The ESPN Case Study

Consider the popular sports network espn.com. A DecryptAds query reveals that its ads.txt and app-ads.txt files declare a staggering 143 ad partners and 19 registered data broker domains.

Digging deeper into these disclosures uncovers alarming privacy implications:

• Approximately half of those data brokers are actively collecting precise geolocation data from visitors who do not utilize ad-blocking technology.
• Another three brokers explicitly disclose the collection of device fingerprints and sensitive personal information.

Geographic Risks and Sanctioned Entities

DecryptAds features a specialized "Geo-Risk" indicator that flags advertising partners headquartered in regions with elevated geopolitical tensions or lax regulatory oversight—such as China, Russia, Cyprus, and the United Arab Emirates (UAE).

Espn.com, for example, maintains relationships with four advertising entities based in Russia, China, or the UAE. Among them is Between Digital, an adtech firm listing a corporate address in New York City. However, DecryptAds’ dossier classifies Between Digital as a Russian firm. Its publisher documentation reveals that financial transactions are processed through Alfa Bank, Russia’s largest private commercial bank, which was placed under U.S. sanctions following the 2022 invasion of Ukraine.

When researchers broadened their search, they discovered that Between Digital is authorized to serve ads and track users across all major U.S. military news platforms, including Army Times, Air Force Times, Defense News, Navy Times, Marine Corps Times, and Federal Times. Across the web, Between Digital’s tracking footprint spans roughly 55,000 partner websites. Furthermore, an analysis of its app-ads.txt footprint reveals hundreds of simple mobile games, with Between Digital acting as both a publisher and a reseller on roughly two-thirds of its portfolio—a structural conflict of interest that creates prime conditions for ad routing manipulation.

The Opera Browser Footprint

The Opera web browser retains a massive global user base, though many users remain unaware that it has been majority-owned by the Chinese firm Kunlun Tech since 2016 (retaining operational headquarters in Oslo, Norway). Opera.com’s DecryptAds profile identifies 27 registered data brokers, including 15 partners in the UAE, six in China, three in Cyprus, two in Russia, and one each in Hong Kong and Ukraine—representing just 7% of the total adtech partners declared in its files.

4. Official Responses and Industry Accountability

As of publication, entities such as Between Digital and its founder have been approached for comment by cybersecurity journalists, with updates pending any official response. However, the broader adtech industry has historically relied on quiet, internal mechanisms to police bad actors—mechanisms that DecryptAds aims to expose.

The "Quiet Removals" Phenomenon

According to Zach Edwards, major ad networks frequently identify advertisers engaging in unauthentic traffic, fraudulent clicks, or malvertising. Instead of making public security disclosures, these exchanges often quietly purge the offending party from their sellers.json files without notifying publishers or the wider public.

This lack of transparency allows compromised or malicious adtech operators to pivot, rebrand, and continue preying on unsuspecting platforms. To counter this, DecryptAds introduced a Quiet Removals Feed, which aggregates and cross-references sellers.json deletions across multiple ad exchanges, illuminating who is being quietly dropped and when.

5. Implications: Malvertising, AI Slop, and Protecting Yourself

The rise of automated content generation has supercharged digital threats. Malvertising—the injection of malicious code or phishing redirects into legitimate ad spaces—is increasingly migrating away from high-traffic, heavily monitored destinations like major news outlets and sports networks. Instead, bad actors target the explosive growth of AI-generated "slop" websites—content farms populated by machine-written articles and images covering recipes, home improvement, and consumer tech.

"None of these slop AI content farms are paying for that kind of protection," Edwards noted. "They’re just signing up the lowest quality partners, and it essentially becomes a greased rail to target the users of those sites with malicious ads."

These content farms frequently serve as vectors for zero-click payloads targeting government employees and everyday citizens alike. According to researchers, solving this crisis requires industry-wide reform, specifically the universal sharing of Supply Chain Objects (SCOs) attached to ad bid requests, which would allow buyers to trace every intermediary involved in delivering a malicious payload.

Practical Steps for Users

Given the profound privacy risks and security threats embedded within the modern programmatic advertising supply chain, cybersecurity experts generally recommend taking proactive defensive measures:

1. Deploy Robust Ad Blockers: On desktop browsers, open-source tools like uBlock Origin Lite effectively strip away advertisements and block background tracking scripts. For mobile environments, options such as Adblock Plus offer baseline protection, while power users can utilize custom blocking lists from sources like easylist.to.
2. Network-Level Blocking: Advanced users can configure a Raspberry Pi running Pi-hole on their home network. By redirecting DNS queries through a local sinkhole, network-wide ad blocking can be achieved across laptops, phones, and smart home appliances.
3. Exercise Caution with Mobile Apps: Major digital services aggressively push users toward dedicated mobile apps not because of superior user experience, but because apps enable vastly more invasive tracking, device fingerprinting, and data harvesting—often including automatic opt-ins for training large language models. Whenever possible, interacting with services via a privacy-configured web browser remains the safer alternative.