New DecryptAds Service Maps the Companies Behind Online Tracking

A new free service is attempting to make the advertising and data-collection ecosystem easier to investigate. DecryptAds analyzes publicly available industry files to show which companies may serve advertisements, collect information or resell ad inventory across websites, mobile applications and connected-TV services.

The service continuously examines files including ads.txt, app-ads.txt, buyers.json and sellers.json. These records are intended to identify authorized advertising and supply-chain partners, but their usefulness is often limited when each file is viewed in isolation. DecryptAds correlates the records to identify relationships, inconsistencies and possible supply-chain risks.

Zach Edwards, the service’s chief research officer and a threat researcher at Infoblox, said the project is designed to support privacy and security investigations. Potential uses include tracing malicious advertising, identifying adtech firms operating from higher-risk jurisdictions and examining networks of low-quality, AI-generated websites and applications.

Examples of the data revealed

A DecryptAds review of ESPN.com identified 143 advertising partners and 19 registered data-broker domains in the site’s declarations. The service reported that many of those brokers disclose collecting location information, while others list device fingerprinting or sensitive personal data among their activities.

DecryptAds also highlights partners connected to countries it categorizes as “geo-risk” locations, including China and Russia, as well as countries with significant ties to them. Its profile of ESPN.com identified several such entities, including Between Digital, a company that lists a New York address but was categorized by the service as Russian-linked. The article reported that the company’s publisher offers reference processing through Alfa Bank, which has been sanctioned by the United States. Between Digital did not respond to requests for comment cited in the report.

Profiles for several U.S. military-focused news sites likewise listed Between Digital among their advertising and tracking partners. The service says the company’s declarations cover roughly 55,000 websites and, in many cases, identify it as both publisher and reseller—an arrangement that could create conflicts of interest, according to Edwards.

Investigative records

DecryptAds’ “Legal Dossier” feature can take several minutes to produce information on domain ownership, registration history, aliases and links to other advertising entities. Such records may help researchers connect seemingly unrelated websites and applications, although the service’s findings still require independent verification.