In the modern digital landscape, navigating the web often feels like walking through a heavily surveilled labyrinth. Every click, scroll, and tap is monitored, analyzed, and monetized by an opaque network of advertising technologies (adtech) and data brokers. While the regulatory frameworks governing this data collection have slowly evolved—most notably through recent state-level laws—the foundational data detailing who is harvesting our information has largely remained walled off within massive advertising platforms.
For the average internet user, determining who is responsible for serving ads on a favorite news site or harvesting data from a daily mobile application is a daunting, if not impossible, task. However, a powerful and free new service aims to change that dynamic entirely. Dubbed DecryptAds, the platform scrapes, correlates, and decodes publicly available adtech configuration files, offering unprecedented visibility into the hidden entities that track users across the digital ecosystem.
Main Facts: Unmasking the AdTech Ecosystem
At its core, decryptads.com is a threat-intelligence and transparency tool designed to approach the notoriously murky adtech industry through a cybersecurity lens. Founded by a trio of researchers—including Chief Research Officer Zach Edwards, who also serves as a threat researcher at security firm Infoblox—DecryptAds addresses a critical gap in digital privacy and supply-chain security.
The service continuously scrapes and cross-references configuration files that websites and mobile applications are required (or choose) to publish to maintain operational transparency. These foundational files include:
ads.txt: A standardized text file listing all authorized digital sellers and adtech companies permitted to run advertisements or harvest data from a specific website.app-ads.txt: The mobile and smart-TV equivalent ofads.txt, detailing the entities authorized to monetize or harvest data from applications.buyers.jsonandsellers.json: Structured JSON files published by ad exchanges that identify the entities buying, selling, or reselling ad inventory for a given domain or app.
Individually, these files are dense, disparate, and rarely parsed by anyone outside the adtech industry. When aggregated and correlated by DecryptAds, however, they paint a comprehensive, often alarming picture of the digital supply chain.
According to Edwards, the tool was built to serve severely underserved security and privacy use cases. These include tracking down the origin points of malicious advertisements (malvertising), identifying ad networks tied to adversarial foreign nations, and unmasking the rapidly growing swarms of AI-generated content farms—commonly known as "AI slop"—that monetize through low-quality programmatic ads.
Chronology and Evolution of Ad Transparency
The opaque nature of online advertising is not a new phenomenon; rather, it is a byproduct of how programmatic advertising has scaled over the past two decades.
The Origins of ads.txt
In the mid-2010s, digital advertising was plagued by "domain spoofing," a form of ad fraud where malicious actors fraudulently represented themselves as premium publishers (like The New York Times or ESPN), tricking advertisers into buying nonexistent ad space. To combat this, the Interactive Advertising Bureau (IAB) introduced ads.txt in 2017. Publishers were encouraged to list their authorized sellers publicly, allowing buyers to verify supply-chain integrity.
While ads.txt and its mobile sibling app-ads.txt were designed to bring transparency, they inadvertently created a massive, decentralized public record of every adtech partner a publisher engaged with. Because these files were scattered across millions of domains and rarely viewed collectively, bad actors, dubious data brokers, and sanctioned entities quietly embedded themselves into the mainstream advertising ecosystem.
The Rise of Regional Privacy Laws
The push for broader transparency gained momentum recently as state-level legislation began forcing data brokers out of the shadows. Four U.S. states—California, Oregon, Texas, and Vermont—enacted laws requiring data brokers to formally register if they buy or sell consumer data originating from within their borders. This regulatory shift gradually forced more data brokers to declare themselves in publisher ads.txt files, inadvertently providing researchers with a clearer map of the data-harvesting landscape.
Recognizing that supply-chain vulnerabilities rarely manifest in a single, isolated file, Edwards and his co-founders launched DecryptAds to bridge the analytical gap. By automating the cross-referencing of ads.txt, app-ads.txt, and sellers.json files across the entire web, the platform transformed semi-public disclosures into actionable intelligence.
Supporting Data: Inside the Supply Chain of Major Platforms
To understand the sheer scale of third-party integration in modern media, one need only look at DecryptAds’ analysis of major digital properties.
The ESPN Case Study
A search on DecryptAds for the popular sports network espn.com reveals an expansive and complex web of partnerships. The site’s ads.txt and app-ads.txt files declare 143 ad partners and 19 registered data broker domains.
Digging deeper into the data broker disclosures yields startling statistics:
- Nearly 50% of those listed data brokers are actively collecting precise geolocation data from visitors who do not utilize ad-blocking software.
- An additional three data brokers explicitly disclose the collection of device fingerprints and sensitive personal information.
High-Risk Ad Partners and Geo-Risk Warnings
DecryptAds incorporates a prominent "Geo-Risk" classification system, flagging adtech partners headquartered in high-risk jurisdictions such as Russia, China, or nations with deep financial and political ties to them, such as Cyprus and the United Arab Emirates (UAE).
For example, espn.com maintains relationships with four advertising entities based in Russia, China, or the UAE. Among them is Between Digital, an adtech firm that lists a corporate address in New York. However, DecryptAds’ dossier exposes Between Digital as a Russian firm whose publisher payment offers are processed through Alfa Bank—Russia’s largest private commercial bank, which was placed under U.S. sanctions following the 2022 invasion of Ukraine.
The reach of Between Digital extends far beyond sports media. A search across top U.S. military news portals—including Army Times, Air Force Times, Defense News, Navy Times, Marine Corps Times, and Federal Times—shows that all of these defense-focused sites permit Between Digital to serve ads and track users, alongside other entities based in the UAE and the ownership-secrecy haven of Panama. DecryptAds reports that Between Digital is currently embedded in approximately 55,000 partner websites worldwide.
Furthermore, analyzing Between Digital’s app-ads.txt file reveals hundreds of domains featuring simple web-based games frequently interrupted by advertisements. Edwards notes that Between Digital’s own declarations list the company as both a publisher and a reseller on roughly two-thirds of its portfolio. This dual role allows the firm to play both sides of the bidding equation, creating inherent conflicts of interest where client ad spend can be funneled toward owned-and-operated properties.
The Opera Browser Footprint
The popular web browser Opera, which has been majority-owned by the Chinese company Kunlun Tech since 2016 (while maintaining its operational headquarters in Oslo, Norway), presents another complex case. DecryptAds identifies 27 registered data brokers collecting information on opera.com, including 15 adtech partners in the UAE, six in China, three in Cyprus, two in Russia, and one each in Hong Kong and Ukraine. Notably, these entities represent just 7% of the total adtech partners specified in Opera’s configuration files.
Official Responses and Industry Dynamics
As of publication, inquiries sent to Between Digital and its founder regarding its ownership structure, banking relationships, and integration with sanctioned entities remained unanswered. However, the launch of DecryptAds has ignited crucial conversations surrounding industry accountability, quiet removals, and the proliferation of AI-generated content farms.
The "Quiet Removals" Phenomenon
One of DecryptAds’ most innovative features is its Quiet Removals Feed. According to Edwards, ad networks frequently suspect specific advertisers of engaging in unauthentic traffic generation (such as bot-driven clicks) or malvertising. Rather than issuing public warnings or transparency reports, these networks often quietly purge the offending party from their sellers.json files without notifying publishers or the broader public.
This lack of communication allows shady adtech operators to evade accountability and continue victimizing other networks. DecryptAds solves this by tracking and correlating sellers.json removals across multiple ad exchanges, giving security researchers a unified view of who is being silently blacklisted and when.
Malvertising and AI "Slop"
The convergence of programmatic advertising and generative artificial intelligence has birthed a new threat vector: AI-generated content farms, colloquially known as "AI slop." These websites—mass-producing low-quality machine-generated articles and images covering topics from recipes to home improvement—rarely invest in enterprise-grade security or anti-fraud solutions.
Instead, these content farms sign up low-tier, unverified programmatic ad partners, creating a "greased rail" for malicious advertisements. As Edwards points out, sophisticated malvertising attacks—which redirect users to phishing sites or attempt drive-by malware downloads—rarely occur on high-traffic, heavily monitored platforms like espn.com or huffpost.com. Instead, they thrive on obscure content farms encountered via search engine results.
To truly combat malvertising and fraud, Edwards argues that major ad networks must begin broadly sharing the Supply Chain Object (SCO). Attached to server-side ad bid requests, the SCO details every seller, reseller, and intermediary involved in passing an ad impression. Without access to this structured data, organizations targeted by zero-click payloads or malware campaigns often hit a dead end, unable to trace the ultimate buyer who funded the malicious ad impression.
Implications for Privacy, Security, and Consumers
The revelations brought to light by DecryptAds carry profound implications for individual privacy, corporate cybersecurity, and national security. When defense-oriented media outlets and mainstream consumer sites unknowingly integrate adtech vendors tied to sanctioned nations or opaque offshore holding companies, the attack surface for espionage, tracking, and malware delivery expands exponentially.
For organizations, the takeaway is clear: ignoring adtech infrastructure is no longer an option. Security teams must begin treating ads.txt and app-ads.txt parsing as a core component of supply-chain risk management.
Practical Mitigation Strategies for Consumers
For individual consumers looking to protect themselves against aggressive tracking, data harvesting, and malvertising, security experts offer several actionable recommendations:
-
Browser-Level Ad Blocking:
- Desktop Users: Extensions like uBlock Origin Lite or standard uBlock Origin provide robust, open-source protection that strips out advertisements and blocks known trackers.
- Mobile Browsers: Firefox on Android supports uBlock Origin, while iOS users on iPhones and iPads can rely on options like Adblock Plus. Power users can also integrate custom filtering lists from
easylist.to. - Script Blockers: Advanced users can employ tools like NoScript to block all unapproved JavaScript, though this requires constant manual configuration to ensure websites render properly.
-
Network-Level Blocking (Pi-hole):
For a comprehensive and scalable household solution, tech-savvy users can install Pi-hole on a low-cost single-board computer like a Raspberry Pi. Configured as a local DNS sinkhole, a Pi-hole blocks advertisements and tracking domains across every device connected to the home network—including smart TVs and IoT gadgets. -
Approach Mobile Apps with Caution:
Many digital services aggressively pressure users into downloading dedicated mobile apps under the guise of an "improved user experience." In reality, mobile apps grant companies a deeper, more invasive pipeline for continuous tracking, location harvesting, and device fingerprinting—often with fewer privacy controls than a standard web browser. Furthermore, data collected via mobile apps is increasingly being swept into training pipelines for large language models.
When possible, interacting with services directly through a secure web browser equipped with robust ad-blocking capabilities remains the safer bet. For those curious about the underlying ecosystem, running an app or website through DecryptAds provides an eye-opening look at who is really watching on the other side of the screen.
