Exposing the Adtech Supply Chain: How a New Tool Is Unmasking Trackers, State-Sponsored Entities, and AI "Slop" Networks

By Investigative Tech Desk

For decades, the digital advertising ecosystem has operated like a black box. Ordinary internet users and enterprise security teams alike have struggled to answer a fundamental question: Who is actually tracking us, and who profits from the ads displayed across our favorite websites and mobile applications? While much of this underlying data has technically been semi-public, it has historically remained locked away in the silos of massive adtech platforms, fragmented across obscure text files, or obfuscated by complex corporate layering.

Now, a powerful and free new intelligence service called DecryptAds aims to change that. By automatically scraping, parsing, and cross-referencing public advertising disclosures, DecryptAds is lifting the veil on the hidden architecture of the internet, revealing an intricate web of data brokers, sanctions-evading entities, and low-quality artificial intelligence content farms.

Main Facts: Decoding the Adtech Ecosystem

At its core, DecryptAds (accessible via decryptads.com) serves as a centralized aggregator for the transparency files that websites, mobile applications, and smart TV networks are expected to maintain. Launched by a trio of cybersecurity and adtech researchers—including Zach Edwards, chief research officer for DecryptAds and a threat researcher at Infoblox—the platform approaches the advertising industry through a rigorous security and privacy lens.

The platform continuously harvests and correlates data from several critical industry mechanisms:

• ads.txt (Authorized Digital Sellers): Public files published by website operators that list all authorized adtech vendors and data brokers permitted to sell or monetize their ad inventory.
• app-ads.txt: The equivalent of ads.txt, specifically designed for mobile applications and smart TV platforms to declare authorized monetization partners.
• buyers.json and sellers.json: Structured directories published by ad exchanges that identify the actual legal entities buying, selling, or reselling ad space.

By mapping these disparate data points together, DecryptAds allows security professionals, privacy advocates, and journalists to audit supply chains, identify high-risk jurisdictions, and trace the flow of ad revenue down to individual corporate entities.

Chronology and Evolution: From Obscurity to Open Source Intelligence

The journey toward adtech transparency has been long and fraught with institutional resistance.

• The Pre-2020 Era: For years, ads.txt and app-ads.txt were viewed primarily as compliance checkboxes meant to combat ad fraud, such as domain spoofing. While these files were publicly accessible, they existed in isolation. Analyzing them required custom scraping scripts and immense manual effort, rendering them virtually useless for holistic threat intelligence.
• The Rise of Privacy Legislation (2020–2025): Pressure began to mount as several U.S. states—pioneered by California, Oregon, Texas, and Vermont—enacted legislation requiring data brokers to formally register if they collect, buy, or sell consumer data originating within their borders. This regulatory shift forced a subset of shadowy brokers into the open, expanding the raw material available for public analysis.
• The Launch of DecryptAds (2026): Recognizing that supply-chain integrity issues cannot be diagnosed by looking at a single file in isolation, Edwards and his co-founders built DecryptAds to solve the cross-referencing problem. By automating the collection of ads.txt, app-ads.txt, and sellers.json files globally, the platform transformed fragmented data into actionable, searchable threat intelligence dossiers.

Supporting Data: Uncovering Complex Networks and High-Risk Partners

To understand the scale of modern digital tracking, one need only look at how mainstream platforms integrate into the global adtech market.

The ESPN Case Study

A search on DecryptAds for the major sports network espn.com reveals an astonishing 143 ad partners and 19 registered data broker domains declared within its ads.txt and app-ads.txt files. Furthermore, DecryptAds’ analytics show that nearly half of those data brokers are actively collecting precise geolocation data from visitors who do not employ ad blockers. Another three partners explicitly disclose the collection of device fingerprints and sensitive personal attributes.

High-Risk Jurisdictions and Geopolitical Exposure

One of DecryptAds’ most striking features is its "Geo Risk" classification, which flags advertising partners based in high-risk foreign jurisdictions—such as China and Russia—or in strategic financial hubs with close ties to both, including Cyprus and the United Arab Emirates (UAE).

For example, DecryptAds maps how major U.S. military-focused news outlets—including Army Times, Air Force Times, Defense News, Navy Times, Marine Corps Times, and Federal Times—permit ad networks tied to adversarial nations to operate on their platforms.

A prominent case highlighted by the platform involves Between Digital, an adtech firm listing a New York corporate address. DecryptAds dossiers reveal that Between Digital is fundamentally a Russian firm, with publisher payouts processed through Alfa Bank, Russia’s largest private commercial bank, which was placed under sweeping U.S. sanctions following the 2022 invasion of Ukraine. Despite these ties, Between Digital’s infrastructure is embedded across roughly 55,000 partner websites globally, including mobile mini-games and major media properties.

Furthermore, audits of mainstream software—such as the Opera web browser, which has been majority-owned by Chinese firm Kunlun Tech since 2016—reveal extensive international data-broker footprints. Opera.com’s DecryptAds profile identifies 27 registered data brokers, including partners located in the UAE, China, Cyprus, Russia, Hong Kong, and Ukraine.

Official Responses and Industry Dynamics

As DecryptAds exposes these sprawling supply chains, industry reactions have highlighted systemic opacity within the adtech market.

When queried regarding its ties to sanctioned Russian financial channels and its operational footprint across U.S. military publications, representatives for Between Digital did not immediately provide comment to security researchers.

According to Zach Edwards, the structural flaws in the ad ecosystem are exacerbated by how ad networks handle internal policing. When major ad exchanges suspect a partner of generating fraudulent engagement or serving malicious advertisements, they frequently execute "quiet removals."

• The Quiet Removals Problem: Rather than publishing transparency reports or notifying affected publishers, exchanges quietly delete offending entities from their sellers.json files.
• The Solution: DecryptAds introduced a dedicated Quiet Removals Feed to track these abrupt disappearances across multiple exchanges, enabling researchers to spot patterns of bad behavior that ad networks attempt to sweep under the rug.

Implications: Malvertising, AI "Slop," and the Supply Chain Crisis

The implications of DecryptAds’ intelligence gathering extend far beyond privacy concerns, striking directly at national security and enterprise defense.

AI "Slop" and Malvertising

Modern cyber threat actors increasingly rely on automated, AI-generated content farms—often referred to as AI "slop"—to host malicious advertisements (malvertising). These low-quality blogs, recipe sites, and tech forums rarely invest in brand-safety tools or premium security filters. Instead, they act as "greased rails" where threat actors can push malicious payloads, phishing campaigns, and zero-click exploits directly to unsuspecting visitors.

In recent investigations by security firm Bitsight regarding compromised streaming sticks (such as H96 devices), researchers discovered that malicious actors were spoofing mobile device signatures to click on ads hosted across networks of low-tier AI-generated content sites. DecryptAds legal dossiers successfully traced these operations by pivoting on shared seller IDs—such as seller ID 1674071 and 103488000—connecting seemingly unrelated web properties directly back to Russian and Chinese ad distribution systems, including Yandex.

The Need for Supply Chain Object (SCO) Visibility

Edwards emphasizes that solving the malvertising crisis requires regulatory and industry pressure on major ad networks to expose the Supply Chain Object (SCO). The SCO is structured, server-side data attached to bid requests that reveals every single intermediary, reseller, and buyer involved in an ad impression. Without broad access to SCO logs, defenders remain blind to the exact conduits through which threat actors target high-profile individuals—such as government and military personnel—with malicious payloads.

Mitigation: What Can Users Do?

Given the pervasive tracking and security risks inherent in modern programmatic advertising, security experts agree that manual navigation is insufficient. Protecting oneself requires a multi-layered defense strategy:

1. Browser-Level Ad Blocking: For desktop and laptop users, open-source extensions like uBlock Origin Lite provide robust protection against ads, trackers, and known malicious domains. On mobile devices, users can utilize Adblock Plus or leverage custom filter lists from repositories like easylist.to.
2. Network-Level Defense: Power users and privacy advocates can implement hardware-based ad blocking at the local router level. By utilizing a low-cost Raspberry Pi running Pi-hole, households and small offices can establish a local DNS sinkhole that blocks ads and telemetry across all connected devices—including smart TVs and IoT appliances.
3. App Minimization: Mobile applications represent a primary vector for invasive tracking and precise geolocation harvesting. Security professionals advise interacting with web services directly via secure mobile browsers rather than downloading dedicated native apps, which frequently harvest extensive device metadata and may opt user data into artificial intelligence training sets without explicit, informed consent.

As tools like DecryptAds continue to illuminate the darkest corners of the digital advertising supply chain, the myth of anonymous, harmless programmatic ad delivery is rapidly dissolving, replaced by an urgent demand for structural transparency and user-controlled defense.