A new, free online service called DecryptAds aims to demystify the complex world of online advertising and data tracking by making it easier to identify the entities collecting user data and serving ads on websites and mobile applications. Launched recently, decryptads.com scrapes and correlates publicly available ad technology (adtech) data, presenting it in an accessible format for privacy and security analysis.
The service compiles information from various files that websites and apps publish to disclose their ad partners and data collectors. These include `ads.txt` and `app-ads.txt` files, which list authorized adtech companies and data brokers for websites and mobile/smart TV apps, respectively. It also processes `buyers.json` and `sellers.json` files, detailing entities involved in buying, selling, or reselling ad inventory.
Zach Edwards, chief research officer for DecryptAds and a threat researcher at Infoblox, stated that the service was developed because the raw data in these files is often only useful when cross-referenced to build a comprehensive picture of the advertising ecosystem. He emphasized that DecryptAds approaches adtech from a security perspective, aiming to serve privacy and security use cases that have been historically neglected. These applications include tracing malicious ads, identifying ad networks based in adversarial nations, and detecting "AI-generated slop" websites and apps.
DecryptAds highlights that supply-chain integrity issues in adtech are rarely evident in a single file. Instead, they manifest as broken cross-references, cloned declarations across unrelated domains, seller removals that only make sense when viewed across exchanges, or supply paths in bid logs that don't appear in a publisher's authorized-seller list.
For example, a DecryptAds search for espn.com reveals 143 ad partners and 19 registered data broker domains listed in its `ads.txt` and `app-ads.txt` files. The data broker information is becoming more available due to recent laws in California, Oregon, Texas, and Vermont requiring data brokers to register if they buy or sell consumer data from those states. DecryptAds reports that nearly half of espn.com's listed data brokers collect geolocation data, while three others disclose collecting device fingerprints and sensitive personal information.
The service also flags adtech partners located in "geo-risk" areas such as China, Russia, Cyprus, and the United Arab Emirates (UAE). For espn.com, DecryptAds identified four ad entities based in Russia, China, or the UAE. Among these is Between Digital, an adtech firm with a New York address but flagged as Russian due to its publisher offers being processed through Alfa Bank, a Russian financial institution under U.S. sanctions since 2022.
Further investigation using DecryptAds showed that several top U.S. military news websites, including armytimes.com, airforcetimes.com, defensenews.com, navytimes.com, marinecorpstimes.com, and federaltimes.com, permit Between Digital to serve ads and track users. These sites also partner with two entities in the UAE and one in Panama. DecryptAds indicates that Between Digital collects ad data from approximately 55,000 partner websites.
Analysis of Between Digital's `app-ads.txt` file revealed hundreds of domains hosting simple web-based games frequently interrupted by ads. Edwards noted that Between Digital's own declarations show it listed as both a publisher and a reseller for about two-thirds of its portfolio, which could create conflicts of interest by allowing the company to direct client spending toward its owned and operated properties.
Another example highlighted by DecryptAds is the Opera web browser, which has been majority-owned by the Chinese company Kunlun Tech since 2016, though its operational headquarters remain in Norway. Opera.com's DecryptAds profile identifies 27 registered data brokers collecting information, including 15 adtech partners in the UAE, six in China, three in Cyprus, two in Russia, and one each in Hong Kong and Ukraine. These companies, however, represent only seven percent of the adtech partners specified in Opera.com's `ads.txt` and `app-ads.txt` files.
A "Legal Dossier" lookup feature within DecryptAds provides detailed information about domain and app ownership, registration dates, and aliases or relationships to adtech companies and other digital properties. This feature can take several minutes to process but yields extensive data. For instance, a DecryptAds legal dossier on the now-dormant Fengwo Group domain `medicalbeautyhub.com`, previously linked to AI-generated "slop" websites and malicious TV streaming sticks, showed it shared a seller ID with a gaming website, `giacoloredstones.com`. Pivoting on the latter's seller ID revealed hundreds of active, low-quality gaming or utility websites within Russia's Yandex ad system, all heavily laden with ads.
