DecryptAds Launches as a Critical Tool for Transparency in the Opaque World of Digital Advertising

Determining the ultimate origin of an online advertisement or identifying exactly which data brokers are harvesting information from a mobile application has long been a task reserved for specialized security researchers. For the average user, and even for many privacy professionals, this information remains obscured behind the complex, walled-garden infrastructure of the global advertising technology (adtech) ecosystem. A newly launched, free service known as DecryptAds is now attempting to dismantle these barriers by scraping, aggregating, and correlating publicly available adtech disclosure files to provide a clear, forensic view of the entities tracking internet users.

The platform, accessible at decryptads.com, functions by continuously monitoring the files that websites and mobile applications are required to maintain for transparency purposes. These files, specifically ads.txt, app-ads.txt, and the associated buyers.json and sellers.json schemas, serve as the digital ledger for ad inventory. While these files are technically public, they are rarely indexed in a way that allows for meaningful analysis. DecryptAds transforms these fragmented text files into a searchable database, enabling users to identify who is buying, selling, and reselling ad space on any given domain.

The Security Perspective on Adtech

Zach Edwards, the Chief Research Officer for DecryptAds and a veteran threat researcher at the security firm Infoblox, conceptualized the tool as a bridge between marketing technology and cybersecurity. Edwards argues that traditional adtech monitoring is insufficient for modern security needs. By cross-referencing disparate files, DecryptAds allows researchers to build a comprehensive picture of the advertising supply chain—an essential step in identifying malicious activity.

"It is an adtech tool, but we are approaching the industry from a security perspective," Edwards stated. "The ecosystem is built for privacy and security use cases that have been dramatically underserved by current market solutions."

The implications for this data are significant. Cybersecurity professionals can use the tool to trace the origins of "malvertising"—ads designed to deliver malware—or to identify ad networks operating from adversarial nations. Furthermore, the platform serves as a sentinel against the rising tide of AI-generated "slop" websites, which are increasingly used as conduits for deceptive advertising. The service highlights that supply-chain integrity issues rarely manifest within a single file; instead, they emerge as broken cross-references, cloned declaration sets, or unauthorized paths in bid logs that indicate potential fraud.

Regulatory Context and Data Brokerage

The emergence of DecryptAds arrives at a pivotal moment in the legislative landscape. Recent data privacy laws in California, Oregon, Texas, and Vermont have begun to mandate that data brokers register their activities if they buy or sell consumer data. This has forced a greater level of disclosure, which DecryptAds is now leveraging to expose the extent of third-party tracking.

A search of the popular sports network espn.com on the platform reveals 143 ad partners and 19 registered data brokers. Analysis of these declarations suggests that nearly half of these entities are collecting geolocation data from visitors, while others are harvesting device fingerprints and sensitive personal identifiers. This level of granular visibility was previously unavailable to the public, effectively demystifying how major digital properties monetize user activity.

Geographic Risk and Financial Ties

A core feature of the DecryptAds platform is its "Geo-Risk" alert system, which flags advertising partners based in jurisdictions that present elevated security or geopolitical concerns. This includes nations such as Russia and China, as well as countries with deep financial and political ties to these regions, such as Cyprus and the United Arab Emirates.

The platform’s dossier on Between Digital, a firm that claims a New York presence but is identified by DecryptAds as a Russian entity, illustrates the necessity of this scrutiny. DecryptAds documents that Between Digital’s publisher offers are processed through Alfa Bank, Russia’s largest private commercial bank, which was sanctioned by the U.S. government following the 2022 invasion of Ukraine. Despite these connections, the firm remains a player in the U.S. adtech market, with research indicating that Between Digital is integrated into approximately 55,000 partner websites, including several military-focused news outlets like armytimes.com and defensenews.com.

The platform further highlights how companies can play both sides of the ad bidding process. According to Edwards, firms like Between Digital often act as both publishers and resellers. This dual role creates inherent conflicts of interest, allowing companies to prioritize their own infrastructure or owned-and-operated properties over those of their clients. The lack of oversight for these files has, for years, allowed such practices to continue unchecked.

Investigative Capabilities: The Legal Dossier

Beyond simple ad-tracking, DecryptAds offers a "Legal Dossier" lookup tool. This feature enables users to investigate the ownership structure of a domain or app, revealing connections between shell companies and adtech networks.

This functionality was recently validated by investigations into H96 streaming sticks, which were found to be renting out users’ internet connections while simultaneously spoofing mobile devices to click on ads hosted by the Fengwo Group. DecryptAds allowed researchers to pivot through shared seller IDs, linking the malicious activity on streaming sticks to a vast network of low-quality, AI-generated websites operating within the Yandex ad system. By exposing these connections, the tool provides a blueprint for investigators to trace the lifecycle of a fraudulent campaign from the device level to the final payment processor.

Addressing the Accountability Gap

A recurring theme in the discourse surrounding adtech is the phenomenon of "quiet removals." When an ad exchange detects fraudulent behavior, it may quietly remove the offending entity from its sellers.json file without public notice. This opacity allows bad actors to shift their operations to other exchanges without facing broader industry consequences.

To address this, DecryptAds has introduced a "Quiet Removals" feed. This tool correlates removals across multiple exchanges, creating a "blacklist" that keeps pace with the industry’s internal, often secretive, policing efforts. By making these removals visible, the platform prevents deceptive firms from continuing to exploit gaps in communication between different ad exchanges.

The Malvertising Threat and Supply Chain Objects

As the digital landscape becomes increasingly saturated with AI-generated content, the risk of malvertising has shifted. High-traffic, reputable websites typically employ sophisticated defenses, but low-quality "content farms" often lack such protections. These sites serve as "greased rails" for malicious actors to deploy zero-click payloads, targeting unsuspecting users who arrive at these pages via search engine results.

Edwards advocates for the industry-wide adoption of the "Supply Chain Object" (SCO). The SCO is structured data attached to ad bid requests that provides transparency into every intermediary between the publisher and the final buyer. Without this data—which is currently processed server-side and rarely disclosed—it is nearly impossible for organizations to identify the specific entity responsible for delivering a malicious payload. Promoting the disclosure of SCOs is a central tenet of the advocacy work currently being performed by the team behind DecryptAds.

Practical Mitigation for End-Users

While tools like DecryptAds provide visibility for researchers, they also underscore the reality that for the average consumer, the internet is fundamentally hostile to privacy. Experts suggest that the only robust defense against these tracking and malvertising threats is the systematic blocking of ads.

For desktop users, open-source extensions such as uBlock Origin remain the gold standard. For those seeking a more comprehensive, network-wide solution, the use of a Raspberry Pi running Pi-hole is recommended. By intercepting DNS requests at the local network level, a Pi-hole can block ad-delivery domains before they ever reach a device.

Mobile users face a more complex landscape, as mobile apps often bypass browser-based blockers. Because many large platforms incentivize app usage to facilitate more invasive data collection—often under the guise of an improved user experience—security experts advise caution. Users should be wary of the permissions granted to mobile applications and should favor browser-based access whenever possible.

As digital surveillance continues to evolve, the importance of transparency tools cannot be overstated. By democratizing access to the technical metadata that powers the advertising web, DecryptAds is providing the public with the information necessary to navigate an increasingly opaque digital environment. Whether through individual browser configuration or the scrutiny of supply-chain relationships, the shift toward a more transparent adtech ecosystem is a critical development for both consumer privacy and global digital security.