Inside the Black Box: How ‘DecryptAds’ is Exposing the Hidden Plumbing of the Global Adtech Industry

For the average internet user, the digital experience is defined by convenience: clicking a link, opening an app, or streaming a video. Yet, beneath this seamless veneer lies a labyrinthine, often opaque infrastructure known as "adtech." For years, the entities responsible for harvesting personal data, tracking user behavior, and serving ads—both benign and malicious—have operated behind a "walled garden." This data, while technically public, has remained inaccessible to the layperson, buried within cryptic text files and complex JSON structures.

That paradigm is shifting with the launch of DecryptAds, a powerful, free service designed to scrape, correlate, and demystify the advertising ecosystems that power the modern web and mobile landscape. By turning a security lens on the advertising supply chain, the platform is pulling back the curtain on who is tracking you, where your data is flowing, and which entities are playing by the rules.

The Mechanics of Transparency: Decoding the Adtech Stack

At the heart of the digital ad industry are three primary "declaration" files that websites and apps use to signal their authorized business partners. DecryptAds systematically crawls these files to provide a holistic view of a platform’s digital footprint:

• ads.txt: A file listing the authorized digital sellers and data brokers permitted to run ads or harvest data on a specific website.
• app-ads.txt: The mobile and Smart TV equivalent, identifying the entities authorized to interface with apps.
• buyers.json/sellers.json: Technical manifests that detail the entities buying, selling, or reselling ad inventory, offering a map of the financial intermediaries.

"It’s an adtech tool, but we’re trying to approach it from a security perspective," says Zach Edwards, Chief Research Officer at DecryptAds and a veteran threat researcher at Infoblox. "It’s built for privacy and security use cases that have been dramatically underserved."

A Chronology of Discovery: From Obscurity to Insight

The necessity for DecryptAds was born out of a realization that adtech data is only useful when cross-referenced. In the past, security researchers and privacy advocates had to manually hunt through disparate files to piece together a "supply chain."

The project founders noted that security issues—such as malicious advertisements ("malvertising") or data-broker overreach—rarely exist within a single isolated file. Instead, they manifest as broken cross-references, cloned declaration sets across unrelated domains, and supply paths in bid logs that appear nowhere in an official publisher’s authorized-seller list.

By automating the correlation of this data, DecryptAds allows researchers to track the lineage of an ad impression from the publisher to the final buyer. This capability has already revealed troubling patterns, such as "quiet removals"—where ad networks purge suspicious partners without public disclosure—and the proliferation of "AI-generated slop" websites that exist solely to host low-quality ads and malicious payloads.

Supporting Data: The Case of the Sports Giant

To understand the depth of this surveillance, one need only look at the data provided for a high-traffic site like espn.com. A DecryptAds query reveals a staggering 143 ad partners and 19 registered data brokers embedded within the site’s ads.txt and app-ads.txt files.

Thanks to new privacy laws in California, Oregon, Texas, and Vermont, data brokers are increasingly required to register their activities. DecryptAds’ analysis suggests that nearly half of these brokers are actively collecting geolocation data from visitors who have not enabled ad-blocking software. Furthermore, three of these entities explicitly disclose the collection of "device fingerprints"—a sophisticated method of tracking users even when cookies are cleared or disabled.

The visual mapping provided by DecryptAds illustrates a "supply chain" that is less like a direct transaction and more like a massive, interconnected spiderweb of middlemen, many of whom have no direct relationship with the user.

The Geopolitical Risk Factor

One of the most concerning features of the new platform is its "Geo-Risk" indicator. DecryptAds flags advertising partners based in high-risk jurisdictions, including Russia, China, and countries with deep financial ties to those nations, such as the United Arab Emirates (UAE) and Cyprus.

In a search for espn.com ad partners, DecryptAds identifies four entities based in these high-risk regions. Among them is Between Digital, a firm that lists a New York address but is categorized by DecryptAds as a Russian company. The dossier reveals that Between Digital’s publisher offers are processed through Alfa Bank, Russia’s largest private commercial bank, which has been subject to U.S. sanctions since the 2022 invasion of Ukraine.

This is not an isolated incident. A survey of U.S. military news websites—including armytimes.com and defensenews.com—reveals that they, too, allow Between Digital to serve ads and track their users. According to DecryptAds, Between Digital currently collects data on roughly 55,000 partner websites.

Implications for Security: Malvertising and AI Slop

The implications for digital hygiene are severe. Malvertising, the practice of using legitimate ad networks to distribute malware or redirect users to phishing sites, is finding a new home in the rapidly expanding ecosystem of "AI slop."

These websites, populated by machine-generated, low-value content, often bypass the rigorous safety standards found on major media platforms. Because these sites are focused on quantity over quality, they frequently contract with the lowest-tier ad brokers, creating "greased rails" for malicious actors.

"None of these slop AI content farms are paying for that kind of protection," Edwards explains. "They’re just signing up the lowest quality partners, and it becomes a target for malicious ads."

Furthermore, the lack of transparency regarding the "supply chain object" (SCO)—structured data that identifies every intermediary involved in an ad bid—prevents organizations from identifying the origin of zero-click payloads that threaten high-value targets, including government officials and corporate executives.

Official Responses and Industry Accountability

While the adtech industry has traditionally relied on "security by obscurity," the rise of tools like DecryptAds is forcing a conversation about accountability. When ad networks quietly remove an offender from their sellers.json list, they rarely alert the public or their clients. This lack of transparency allows malicious actors to recycle their tactics elsewhere.

DecryptAds’ "Quiet Removals Feed" aims to eliminate this silence by documenting when, where, and how often specific seller domains are purged from exchange lists. By making these patterns visible, researchers can finally begin to map the lifecycle of fraud in real-time.

Conclusion: How to Reclaim Your Privacy

The findings from DecryptAds serve as a stark reminder that the modern internet is designed to track, categorize, and monetize every interaction. For the average user, the most effective defense remains the aggressive blocking of advertisements.

• For Desktop: Extensions like uBlock Origin Lite are highly recommended for their efficiency and commitment to open-source transparency.
• For Power Users: Configuring a Pi-hole on a Raspberry Pi remains the "gold standard" for network-level blocking, effectively filtering ads before they reach any device on a home network.
• For Mobile: Users are encouraged to avoid unnecessary mobile apps. When given the choice, browsing via a secure mobile browser is almost always preferable to installing a proprietary app, which often grants developers deeper access to geolocation, device sensors, and personal data.

As the digital landscape becomes increasingly cluttered with AI-generated content and shadow-economy data brokers, tools like DecryptAds provide the visibility necessary to make informed decisions. We are no longer operating in a vacuum; the data is out there, and for the first time, it is being brought into the light.