DecryptAds Launches Transparency Platform to Unmask the Complex and Often Risky Adtech Ecosystem
Determining who is responsible for serving advertisements on a given website or harvesting personal data from a mobile application has long been a daunting task for the average user and even for experienced cybersecurity professionals. While this information is technically public, it has historically remained siloed within proprietary databases held by major advertising platforms, effectively walled off from public scrutiny. A new, free-to-use service called DecryptAds is attempting to dismantle these barriers by scraping, correlating, and simplifying the complex web of adtech data, providing unprecedented insight into the entities tracking online activity.
The launch of decryptads.com represents a significant shift in digital transparency. By continuously monitoring the files that websites and mobile applications are required to make public—specifically ads.txt, app-ads.txt, and the buyers.json/sellers.json files—the service offers a bird’s-eye view of the advertising supply chain. These files were originally designed by the Interactive Advertising Bureau (IAB) to prevent ad fraud by identifying authorized sellers of digital inventory. However, DecryptAds elevates these files from simple verification tools to critical components of cybersecurity and privacy research.
The Anatomy of the Adtech Supply Chain
At the core of the DecryptAds mission is the recognition that the advertising ecosystem is not a single, transparent entity, but a labyrinth of intermediaries. The service categorizes the data it scrapes into three primary buckets:
- ads.txt: A list of authorized digital sellers for a specific website, which helps buyers identify who is allowed to sell advertising space on that domain.
- app-ads.txt: The mobile and smart TV equivalent of the ads.txt file, intended to prevent unauthorized inventory sales within applications.
- buyers.json/sellers.json: Detailed files that disclose the identities of companies buying, selling, or reselling ad space, providing a map of the financial flows behind an ad impression.
Zach Edwards, the Chief Research Officer for DecryptAds and a threat researcher at Infoblox, emphasizes that while these files exist, they are nearly useless in isolation. The value of DecryptAds lies in its ability to cross-reference this information. "It’s an adtech tool, but we are trying to approach the industry from a security perspective," Edwards stated. "It is built for privacy and security use cases that have been dramatically underserved."
Beyond Transparency: The Security Implications
The implications of this tool extend far beyond simple consumer awareness. Security researchers can now use the platform to identify the origins of malicious advertising, often referred to as "malvertising," which frequently delivers malware or phishing payloads to unsuspecting users. Furthermore, the tool provides a method to detect the rapid proliferation of "AI-slop"—low-quality, machine-generated websites designed solely to host advertisements and harvest data.
Supply-chain integrity issues often manifest as discrepancies that are impossible to see without a bird’s-eye view. DecryptAds highlights that malicious activity often reveals itself through broken cross-references between different declaration files, cloned ad sets across unrelated domains, or supply paths that appear in bid logs but are absent from a publisher’s authorized seller list.
For instance, a search for a major entity like espn.com reveals 143 ad partners and 19 registered data brokers. While this is a high-traffic site, the data shows that nearly half of these brokers are actively collecting geolocation data from visitors. This transparency is bolstered by recent legislative efforts in California, Oregon, Texas, and Vermont, which now require data brokers to register if they handle consumer information, providing a new layer of data that DecryptAds integrates into its search results.
Identifying Geo-Risk and Financial Ties
Perhaps the most striking feature of DecryptAds is its "Geo-Risk" alert system. The platform flags advertising partners based in high-risk jurisdictions, including Russia, China, and nations with significant political or financial ties to those regions, such as the United Arab Emirates or Cyprus.
A case study provided by the service involves "Between Digital," an adtech firm that lists a New York address but is identified by DecryptAds as a Russian entity. The service’s dossier links the company’s financial activities to Alfa Bank, Russia’s largest private commercial bank, which has been under U.S. sanctions since the 2022 invasion of Ukraine. Despite these geopolitical risks, DecryptAds shows that several prominent U.S. military-focused news outlets, including Armytimes.com and Navytimes.com, allow Between Digital to serve ads on their platforms.
The platform also tracks "quiet removals," a phenomenon where ad networks blacklist or remove an advertiser for suspected fraud without public disclosure. By maintaining a feed of these removals across various exchanges, DecryptAds allows researchers to track patterns of bad actors as they jump from one network to another, a behavior that previously allowed them to avoid accountability.
The Intersection of Hardware and Malvertising
The utility of the platform was recently highlighted in the context of the H96 streaming stick incident. Security researchers from Bitsight discovered that these devices were being used as part of a botnet, renting out user bandwidth to facilitate ad fraud. By using the DecryptAds legal dossier lookup, researchers were able to connect the malicious apps on these sticks to the "Fengwo Group," a Chinese entity that also managed the network of AI-slop websites where the ads were being served.
This level of correlation is vital for identifying the "supply chain object" (SCO). The SCO is a piece of structured data attached to advertising bid requests that contains the entire path of an ad from the publisher to the buyer. Currently, this data is kept server-side by major ad networks. Edwards argues that if the industry were to adopt greater transparency regarding the SCO, it would be significantly easier to identify and block the specific actors responsible for zero-click malware payloads.
Recommendations for Consumer Protection
While tools like DecryptAds provide researchers with the power to map these threats, the average consumer remains at risk. Industry experts continue to recommend a multi-layered approach to online privacy:
- Ad Blocking at the Browser Level: Tools such as uBlock Origin Lite and Adblock Plus are essential for modern web browsing. For users seeking more granular control, extensions like NoScript can prevent unauthorized JavaScript execution, though this often requires manual configuration to ensure websites remain functional.
- Network-Level Blocking: For a more comprehensive solution, power users are encouraged to implement a Raspberry Pi running Pi-hole. By routing all local network traffic through a DNS sinkhole, users can block advertisements and trackers for every device on their home network, including smart TVs and IoT devices that cannot host traditional browser extensions.
- App Skepticism: Consumers are urged to exercise extreme caution regarding mobile apps. Many companies aggressively push users to download their apps, not to improve the user experience, but to gain deeper access to device-level data and to circumvent browser-based ad blockers. Where possible, interacting with a service via a secure, ad-blocked web browser remains the most privacy-conscious choice.
Future Implications
The launch of DecryptAds arrives at a critical juncture in the history of the internet. As AI-generated content continues to saturate the web, the "greased rail" of low-quality ad networks provides a lucrative path for malicious actors to reach vulnerable populations. The ability to see who is funding these sites—and where that money is flowing—is a prerequisite for any serious attempt at cleaning up the digital ecosystem.
As regulatory bodies continue to grapple with the complexities of data privacy, tools that prioritize transparency and data-sharing, such as the DecryptAds API, are likely to become standard assets in the arsenals of security professionals and privacy advocates alike. The era of the "walled-off" adtech ecosystem is being challenged, and the newfound visibility into the supply chain may force a long-overdue reckoning for an industry that has operated in the shadows for far too long.
