Who’s Tracking You? Use This New Service to Find Out
It can be daunting to determine who’s responsible for showing ads on the websites we visit, or who’s harvesting data from the mobile apps we use every day. That information is already semi-public, but it is not easily parsed and traditionally much of it has remained walled away in the hands of large advertising platforms. Not anymore: A powerful and free new service called DecryptAds scrapes and correlates this adtech data and makes it simple to quickly learn a great deal about the entities that are tracking you. A Decryptads summary of the advertising partnerships declared by espn.com. The newly launched decryptads.com says it is constantly scraping the files that websites and apps make publicly available to disclose the companies that are permitted to run ads or collect user data. These files include: – ads.txt : all of the adtech companies and data brokers that may run ads or harvest data from the site; – app-ads.txt : entities that can harvest data from or display ads on mobile and smart TV apps; – buyers.json/sellers.json : the entities buying, selling or reselling ad inventory for a given site or app. Zach Edwards is chief research officer for DecryptAds and a threat researcher at the security company Infoblox . Edwards said he and two other founders decided the service was needed because the adtech data in these files is generally only useful when it can be cross-referenced to build a more complete picture of the advertising ecosystem for each website or app. “It’s an adtech tool but we’re trying to approach adtech from a security perspective,” Edwards said. “It’s really built for a lot of privacy and security use cases that have been dramatically underserved.” Those use cases, he said, include tracking down the source of malicious ads that try to foist malware on targeted users, identifying ad networks located in adversarial nations, and detecting the fast growing swarms of AI-generated slop websites and apps. And as decryptads.com demonstrates, these potential security and privacy threats are near impossible to detect just by viewing a single apps.txt or app-ads.txt file. “Supply-chain integrity issues rarely live in a single file,” the site explains . “They show up as broken cross-references between ads.txt, app-ads.txt, and sellers.json files; as cloned declaration sets across unrelated domains; as seller removals that only make sense when viewed across exchanges; and even as supply paths in bid logs that never actually appear in any given publisher’s authorized-seller list.” A search in DecryptAds for the hugely popular sports network espn.com reveals 143 ad partners and 19 registered data broker domains are listed within its ads.txt and app-ads.txt files. That data broker information is gradually becoming available because four states — California, Oregon, Texas and Vermont — have recently passed laws requiring data brokers to register if they buy or sell data on consumers from those states. DecryptAds reports that almost half of those data brokers are collecting geolocation data from espn.com visitors who aren’t blocking ads, while another three disclose that they collect device fingerprints and sensitive personal information. A visual representation of the complex ad supply chain declared by espn.com. Image: decryptads.com. HIGH-RISK AD PARTNERS DecryptAds also makes it easy to learn the beneficiaries and national origins of the advertising firms lurking in apps and websites, displaying a conspicuous warning when adtech partners of an app or website are based in “geo-risk” areas like China and Russia, or in countries with strong financial and political ties to both — such as Cyprus and the United Arab Emirates (UAE). According to DecryptAds, espn.com works with four different advertising entities that are based in either Russia, China or the UAE, including the adtech firm Between Digital , which lists a New York address. However, the dossier on Between Digital flags them as a Russian firm, showing that their pub…
AI Analysis
Technical Summary
DecryptAds is a service that continuously scrapes and correlates adtech declaration files (ads.txt, app-ads.txt, buyers.json, sellers.json) from websites and mobile apps to expose the companies authorized to run ads or collect user data. It provides a unified view of the advertising ecosystem, revealing complex supply-chain relationships and potential security risks such as malicious ad sources and ad networks based in countries considered geo-risk areas (e.g., China, Russia, UAE). The service also identifies data brokers collecting sensitive user information, including geolocation and device fingerprints. By aggregating and cross-referencing these files, DecryptAds enables detection of supply-chain integrity issues that are not apparent from individual files alone. The platform supports privacy and security research, including tracking malicious ads and identifying adversarial nation-state actors within the ad ecosystem.
Potential Impact
The service exposes the extensive and complex network of ad partners and data brokers involved in tracking users on websites and apps, highlighting privacy risks such as unauthorized data collection and potential exposure to malicious advertising. It reveals that some ad partners operate from countries with geopolitical risks, which could pose security concerns. The transparency provided by DecryptAds can help identify malicious ad sources and supply-chain vulnerabilities that could be exploited to deliver malware or compromise user privacy. However, the service itself is informational and does not represent a direct vulnerability or exploit.
Mitigation Recommendations
This content describes a transparency and research tool rather than a vulnerability requiring patching or direct remediation. No patch or fix is applicable. Security professionals can use DecryptAds to identify and investigate risky ad partners and data brokers in their environments. Organizations should consider reviewing their ad supply chains and data broker relationships in light of insights from such tools to reduce exposure to malicious or adversarial entities. No urgent action is mandated by the vendor or advisory since this is a security research service.
Who’s Tracking You? Use This New Service to Find Out
Description
It can be daunting to determine who’s responsible for showing ads on the websites we visit, or who’s harvesting data from the mobile apps we use every day. That information is already semi-public, but it is not easily parsed and traditionally much of it has remained walled away in the hands of large advertising platforms. Not anymore: A powerful and free new service called DecryptAds scrapes and correlates this adtech data and makes it simple to quickly learn a great deal about the entities that are tracking you. A Decryptads summary of the advertising partnerships declared by espn.com. The newly launched decryptads.com says it is constantly scraping the files that websites and apps make publicly available to disclose the companies that are permitted to run ads or collect user data. These files include: – ads.txt : all of the adtech companies and data brokers that may run ads or harvest data from the site; – app-ads.txt : entities that can harvest data from or display ads on mobile and smart TV apps; – buyers.json/sellers.json : the entities buying, selling or reselling ad inventory for a given site or app. Zach Edwards is chief research officer for DecryptAds and a threat researcher at the security company Infoblox . Edwards said he and two other founders decided the service was needed because the adtech data in these files is generally only useful when it can be cross-referenced to build a more complete picture of the advertising ecosystem for each website or app. “It’s an adtech tool but we’re trying to approach adtech from a security perspective,” Edwards said. “It’s really built for a lot of privacy and security use cases that have been dramatically underserved.” Those use cases, he said, include tracking down the source of malicious ads that try to foist malware on targeted users, identifying ad networks located in adversarial nations, and detecting the fast growing swarms of AI-generated slop websites and apps. And as decryptads.com demonstrates, these potential security and privacy threats are near impossible to detect just by viewing a single apps.txt or app-ads.txt file. “Supply-chain integrity issues rarely live in a single file,” the site explains . “They show up as broken cross-references between ads.txt, app-ads.txt, and sellers.json files; as cloned declaration sets across unrelated domains; as seller removals that only make sense when viewed across exchanges; and even as supply paths in bid logs that never actually appear in any given publisher’s authorized-seller list.” A search in DecryptAds for the hugely popular sports network espn.com reveals 143 ad partners and 19 registered data broker domains are listed within its ads.txt and app-ads.txt files. That data broker information is gradually becoming available because four states — California, Oregon, Texas and Vermont — have recently passed laws requiring data brokers to register if they buy or sell data on consumers from those states. DecryptAds reports that almost half of those data brokers are collecting geolocation data from espn.com visitors who aren’t blocking ads, while another three disclose that they collect device fingerprints and sensitive personal information. A visual representation of the complex ad supply chain declared by espn.com. Image: decryptads.com. HIGH-RISK AD PARTNERS DecryptAds also makes it easy to learn the beneficiaries and national origins of the advertising firms lurking in apps and websites, displaying a conspicuous warning when adtech partners of an app or website are based in “geo-risk” areas like China and Russia, or in countries with strong financial and political ties to both — such as Cyprus and the United Arab Emirates (UAE). According to DecryptAds, espn.com works with four different advertising entities that are based in either Russia, China or the UAE, including the adtech firm Between Digital , which lists a New York address. However, the dossier on Between Digital flags them as a Russian firm, showing that their pub…
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
DecryptAds is a service that continuously scrapes and correlates adtech declaration files (ads.txt, app-ads.txt, buyers.json, sellers.json) from websites and mobile apps to expose the companies authorized to run ads or collect user data. It provides a unified view of the advertising ecosystem, revealing complex supply-chain relationships and potential security risks such as malicious ad sources and ad networks based in countries considered geo-risk areas (e.g., China, Russia, UAE). The service also identifies data brokers collecting sensitive user information, including geolocation and device fingerprints. By aggregating and cross-referencing these files, DecryptAds enables detection of supply-chain integrity issues that are not apparent from individual files alone. The platform supports privacy and security research, including tracking malicious ads and identifying adversarial nation-state actors within the ad ecosystem.
Potential Impact
The service exposes the extensive and complex network of ad partners and data brokers involved in tracking users on websites and apps, highlighting privacy risks such as unauthorized data collection and potential exposure to malicious advertising. It reveals that some ad partners operate from countries with geopolitical risks, which could pose security concerns. The transparency provided by DecryptAds can help identify malicious ad sources and supply-chain vulnerabilities that could be exploited to deliver malware or compromise user privacy. However, the service itself is informational and does not represent a direct vulnerability or exploit.
Defensive Guidance
This content describes a transparency and research tool rather than a vulnerability requiring patching or direct remediation. No patch or fix is applicable. Security professionals can use DecryptAds to identify and investigate risky ad partners and data brokers in their environments. Organizations should consider reviewing their ad supply chains and data broker relationships in light of insights from such tools to reduce exposure to malicious or adversarial entities. No urgent action is mandated by the vendor or advisory since this is a security research service.
Technical Details
- Classification
- {"confidence":0.3,"severitySource":"default","classifier":"rss-v2"}
- Article Source
- {"url":"https://krebsonsecurity.com/2026/08/whos-tracking-you-use-this-new-service-to-find-out/","fetched":true,"fetchedAt":"2026-08-15T05:06:15.835Z","wordCount":3620}
Threat ID: 6a7ff3c8bf8831d5397cc4cf
Added to database: 08/15/2026, 05:06:16 UTC
Last enriched: 08/15/2026, 05:06:24 UTC
Last updated: 09/05/2026, 09:28:48 UTC
Views: 53
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.