Who’s Tracking You? Use This New Service to Find Out – Krebs on Security
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
A new free service called DecryptAds scrapes and cross-references ads.txt, app-ads.txt, sellers.json and buyers.json files to reveal which adtech companies and data brokers track users across websites and apps. Built by threat researcher Zach Edwards, the tool flags 'geo-risk' ad partners based in China, Russia, Cyprus and the UAE, tracks quiet removals of sellers from ad exchanges, and helps identify sources of malvertising and AI-generated slop sites. Examples cited include espn.com's 143 ad partners, Between Digital's Russian ties via Alfa Bank, and Opera's Chinese-linked ad partners. The piece also recommends ad-blocking tools like uBlock Origin Lite, Adblock Plus, NoScript, and Pi-hole for reducing tracking exposure.
Table of contents
HIGH-RISK AD PARTNERSLEGAL DOSSIERSQUIET REMOVALSMALVERTISING AND AI SLOPWHAT CAN YOU DO?Questions this post answers
What is DecryptAds and how does it identify who is tracking me online?
DecryptAds is a free service that scrapes and cross-references ads.txt, app-ads.txt, sellers.json, and buyers.json files published by websites and apps to reveal which adtech companies and data brokers are permitted to collect data or run ads. Built by Zach Edwards, chief research officer at DecryptAds and a threat researcher at Infoblox, it also flags partners based in high-risk countries like China, Russia, Cyprus, and the UAE. daily.dev surfaces security research like adtech transparency tools for developers tracking privacy risks.
How can I block ads and tracking at the network level for all my devices?
Setting up a Raspberry Pi with the free Pi-hole software creates a DNS sinkhole that blocks ads across every device on a home network once the router's DNS and DHCP settings point to it. This is considered a cheap, secure, and scalable alternative to per-browser extensions like uBlock Origin Lite or Adblock Plus, though it won't stop tracking that happens inside standalone mobile apps. developers weighing ad-blocking approaches can track tool comparisons like this on daily.dev.
What is a supply chain object (SCO) in adtech and why does it matter for stopping malvertising?
A supply chain object is structured data attached to each advertising bid request that shows every seller, reseller, and intermediary involved in passing an ad impression from publisher to final buyer. Because it is only served server-side and rarely shared broadly by ad networks, its absence makes it hard to trace who served a malicious zero-click ad payload, according to DecryptAds researcher Zach Edwards. security teams investigating malvertising incidents can follow adtech research like this on daily.dev.