DecryptAds Exposes The Shady Underworld Of Adtech And Data Brokers

A newly launched web service called DecryptAds aims to demystify the online advertising ecosystem by scraping and correlating publicly available adtech disclosure files. According to the platform’s developers, the free tool provides security researchers, privacy advocates, and everyday users with a streamlined way to analyze tracking entities, data brokers, and supply-chain partnerships across websites and mobile applications.

Unlocking Public Adtech Disclosures

The platform continually scrapes standard files that websites and apps publish to declare permitted ad networks and data collection entities. These files include ads.txt for websites, app-ads.txt for mobile and smart TV applications, and buyers.json or sellers.json files that track ad inventory transactions. Zach Edwards, chief research officer for DecryptAds and a threat researcher at Infoblox, stated that the service was created because this data only becomes useful when cross-referenced to build a comprehensive picture of the advertising ecosystem.

“It’s an adtech tool but we’re trying to approach adtech from a security perspective,” Edwards said. “It’s really built for a lot of privacy and security use cases that have been dramatically underserved.”

According to DecryptAds, those use cases include tracking sources of malicious advertisements that attempt to deliver malware, identifying ad networks linked to adversarial nations, and detecting rapidly growing networks of AI-generated low-quality content sites. The site notes that supply-chain integrity problems rarely appear in a single isolated file, instead manifesting as broken cross-references, cloned declarations, and hidden seller removals.

High-Risk Partners and Geo-Risk Evaluations

DecryptAds highlights advertising firms based in designated geo-risk regions, such as China, Russia, and countries with close financial ties like Cyprus and the United Arab Emirates. For example, a search for the sports network espn.com reveals 143 ad partners and 19 registered data broker domains within its disclosure files. DecryptAds reports that nearly half of those data brokers collect geolocation data from visitors who do not block ads, while three disclose the collection of device fingerprints and sensitive personal information.

The platform’s analysis shows that espn.com works with four advertising entities based in Russia, China, or the UAE. Among them is Between Digital, an adtech firm listing a New York address that DecryptAds flags as a Russian enterprise. Records indicate its publisher offers are processed through Alfa Bank, Russia’s largest private commercial bank, which was placed under United States sanctions in 2022 following the invasion of Ukraine. DecryptAds reports that Between Digital collects ad data across approximately 55,000 partner websites, including several U.S. military news domains such as armytimes.com and defensenews.com.

Edwards pointed out potential conflicts of interest in how certain firms operate within these supply chains. “It means they are basically playing both sides of the bidding equation, which creates opportunities to direct client spend at your owned and operated properties or client infrastructure, essentially creating opportunities for conflicts of interest,” Edwards said.

Quiet Removals and AI Slop Networks

To address transparency gaps regarding ad fraud, DecryptAds features a quiet removals feed that tracks when advertising networks quietly delete questionable vendors from their sellers.json files without public disclosure. Edwards noted that ad networks frequently remove suspected bad actors behind the scenes, making it difficult for the broader industry to track suspicious entities.

The platform also sheds light on the intersection of malvertising and machine-generated content farms, commonly referred to as AI slop. Edwards explained that malicious ads are increasingly found on newly generated AI content sites that fail to employ basic protective security technologies, creating an easy pathway to target unsuspecting visitors with zero-click payloads and malware.