A powerful new tool called DecryptAds is making it possible for anyone to see exactly who is tracking them across websites and apps, revealing a complex web of advertising companies, data brokers, and geopolitical risks that were previously hidden from public view. The service scrapes publicly available advertising files that websites are required to disclose, then correlates that data to show users the full picture of who has permission to collect their information.

How Does DecryptAds Work and What Can It Reveal?

DecryptAds analyzes several types of publicly available files that websites and apps must maintain to disclose their advertising partnerships. These files include ads.txt files that list adtech companies and data brokers permitted to run ads or harvest user data, app-ads.txt files for mobile and smart TV applications, and buyers.json and sellers.json files that show which entities are buying, selling, or reselling ad inventory. The service then cross-references this information to build a complete picture of the advertising ecosystem for each website or app.

When you search for a major website on DecryptAds, the results can be staggering. A search for ESPN.com, for example, reveals 143 ad partners and 19 registered data broker domains operating on the site. According to the DecryptAds analysis, nearly half of those data brokers are collecting geolocation data from ESPN visitors who aren't blocking ads, while three others disclose that they collect device fingerprints and sensitive personal information.

"It's an adtech tool but we're trying to approach adtech from a security perspective. It's really built for a lot of privacy and security use cases that have been dramatically underserved," said Zach Edwards, chief research officer for DecryptAds and a threat researcher at the security company Infoblox.

Zach Edwards, Chief Research Officer, DecryptAds

What Security Threats Does the Tool Help Identify?

Beyond simple privacy concerns, DecryptAds helps identify serious cybersecurity risks that would be nearly impossible to spot by examining individual files. Edwards explained that supply-chain integrity issues in advertising rarely appear in a single file. Instead, they show up as broken cross-references between different declaration files, cloned declaration sets across unrelated domains, seller removals that only make sense when viewed across exchanges, and supply paths in bid logs that never actually appear in any publisher's authorized-seller list.

The tool is particularly useful for tracking down the sources of malicious ads that distribute malware, identifying ad networks located in adversarial nations, and detecting the growing problem of AI-generated low-quality websites and apps that exist primarily to display ads.

Which Websites Are Working With High-Risk Ad Partners?

DecryptAds flags advertising partners based on their geographic location, displaying warnings when adtech companies are based in "geo-risk" areas like China and Russia, or in countries with strong financial and political ties to both, such as Cyprus and the United Arab Emirates. The findings reveal surprising connections between major U.S. websites and companies in these regions.

For example, ESPN.com works with four advertising entities based in Russia, China, or the UAE, including a firm called Between Digital that lists a New York address but is flagged as a Russian company. DecryptAds shows that Between Digital's publisher offers are processed through Alfa Bank, Russia's largest private commercial bank, which has been under U.S. sanctions since 2022 following Russia's invasion of Ukraine.

The situation extends to U.S. military news websites as well. Top military publications including Army Times, Air Force Times, Defense News, Navy Times, Marine Corps Times, and Federal Times all allow Between Digital to serve ads and track users, along with two entities in the UAE and another in Panama.

Steps to Check Your Own Online Tracking Profile

• Visit DecryptAds.com: Go to the free DecryptAds service and search for any website or app you use regularly to see which companies have permission to track you.
• Review Geo-Risk Warnings: Pay special attention to any "Geo Risk" warnings that indicate ad partners are based in countries with geopolitical concerns or sanctions.
• Check Data Broker Information: Look for which data brokers are collecting specific types of information about you, such as geolocation data, device fingerprints, or sensitive personal information.
• Use the Legal Dossier Feature: For deeper research, use DecryptAds' Legal Dossier lookup to find information about domain ownership, registration dates, and relationships between adtech companies and websites.

The Opera Web browser case illustrates how widespread these tracking networks can be. Opera has been majority owned and controlled by the Chinese company Kunlun Tech since 2016, though its operational headquarters remain in Oslo, Norway. Opera.com's profile on DecryptAds identifies 27 registered data brokers collecting information, including 15 adtech partners in the UAE, six in China, three in Cyprus, two in Russia, and one each in Hong Kong and Ukraine. These companies represent just seven percent of the total adtech partners specified in Opera's advertising files.

The lack of oversight of these advertising files has been a persistent problem. Edwards noted that "for years we've had almost no one policing these ads.txt and app-ads.txt files," which means conflicts of interest and suspicious arrangements can persist undetected. Between Digital's own declarations show the company is listed as both a publisher and a reseller on approximately two-thirds of their portfolio, meaning they are essentially playing both sides of the bidding equation. This creates opportunities to direct client spending at their own properties or infrastructure, raising serious questions about fair dealing in digital advertising.

Edwards

DecryptAds represents a significant step toward transparency in an advertising ecosystem that has long operated in the shadows. By making this data accessible and understandable to the general public, the tool empowers users to understand the true scope of tracking that occurs every time they visit a website or use an app.