A New Free Tool Lets You See Who's Actually Tracking You Online
DecryptAds pulls back the curtain on the ad partners and data brokers hiding inside popular websites and apps, including some based in Russia and China.
Key points
- DecryptAds launched as a free service that maps the ad partners and data brokers declared by websites and mobile apps.
- A search of espn.com turned up 143 ad partners and 19 registered data brokers, nearly half of which collect location data.
- Popular US military news sites, including armytimes.com and defensenews.com, allow a Russian-linked ad firm called Between Digital to serve ads and track visitors.
- Between Digital collects ad data across roughly 55,000 partner websites, according to DecryptAds.
- The tool flags ad partners based in what it calls "geo-risk" countries such as Russia, China, Cyprus and the UAE.
A new free service called DecryptAds has quietly made it much easier to see who is watching you when you visit a news site or use a free app. First reported by KrebsOnSecurity, it scrapes the public files that websites and apps use to declare their ad partners, then cross-references them into a picture of who is selling your attention and to whom.
Think of it as a receipts drawer for the ad industry. The receipts have always been public. Nobody had bothered to organise them.
What does DecryptAds actually show?
It shows every advertising company and data broker a website or app has given permission to run ads or collect information about visitors. That includes where those companies are based, who owns them, and what other ad firms they connect to.
Websites publish a plain text file called ads.txt, which lists the ad companies allowed to sell space on the site. Mobile and smart TV apps use a similar file called app-ads.txt. Two other files, buyers.json and sellers.json, list who is buying and reselling that ad space. Each file on its own is dull; cross-referenced, they reveal quite a lot.
Zach Edwards, chief research officer at DecryptAds and a threat researcher at security firm Infoblox, told KrebsOnSecurity the tool was built to approach ad technology from a security angle. Uses include tracing malicious ads that push malware (harmful software installed without your knowledge), spotting ad networks based in hostile countries, and detecting AI-generated junk websites built purely to farm ad clicks.
What did it find on well-known sites?
On espn.com, DecryptAds counted 143 ad partners and 19 data brokers. Almost half of those brokers collect geolocation data from visitors who are not blocking ads. Three collect device fingerprints, unique signatures your phone or laptop gives off that let companies recognise you even without cookies.
Here is a quick snapshot of what the tool surfaced on some familiar names.
| Site | Ad partners | Notable finding |
|---|---|---|
| espn.com | 143 | 19 registered data brokers, many collecting location |
| opera.com | Not specified | 27 data brokers, partners in UAE, China, Cyprus, Russia, Hong Kong, Ukraine |
| US military news sites | Multiple | Allow Russian-linked Between Digital to serve ads |
The Opera browser has been majority-owned by Chinese firm Kunlun Tech since 2016, though its main office remains in Oslo. DecryptAds found 27 registered data brokers on opera.com, representing just seven percent of the ad partners in Opera's declared files.
Why should ordinary readers care?
Because the pipes that deliver ads are the same pipes that deliver scams and malware. If an ad network based in a sanctioned country can serve you an ad on a mainstream news site, it can also, in theory, serve you a malicious one.
One firm called Between Digital lists a New York address but processes publisher payments through Alfa Bank, Russia's largest private commercial bank, which was placed under US sanctions in 2022. DecryptAds says Between Digital is present on roughly 55,000 partner websites, including US military news outlets such as armytimes.com, airforcetimes.com, navytimes.com and defensenews.com.
Edwards told KrebsOnSecurity that Between Digital's own declarations show the company listed as both publisher and reseller on roughly two-thirds of its portfolio. The same company is often, in effect, selling ads to itself. That's the conflict of interest this tool surfaces that no single ads.txt file would ever show you.
"The problem we have right now is that for years we've had almost no one policing these ads.txt and app-ads.txt files," Edwards said.
We covered the broader gap between what privacy tools promise and what they deliver in our 14 August piece on Meta's AI glasses, which looked at how data collection happens in ways most people simply don't see.
Common questions
Do I need to install anything to use DecryptAds?
No. It runs in a web browser at decryptads.com. You type in a website or app name and it returns the ad partners and data brokers linked to it.
Should you worry about your device fingerprint?
Yes, more than cookies. Resetting your advertising ID and enabling ad blocking cuts most behavioural tracking. Device fingerprinting, however, persists across resets because it is derived from your hardware, not a stored identifier. A fingerprint-blocking browser extension is the most direct countermeasure available to ordinary users right now.
