DecryptAds Exposes the Invisible: The Ad Supply Chain Under the…

DecryptAds parses ads.txt and sellers.json files, revealing hidden links between mainstream sites, data brokers, and geopolitical actors in the programmatic advertising supply chain.

On August 19, 2026, Zach Edwards, chief research officer at DecryptAds and threat researcher at Infoblox, released a free tool that applies security methodology to the traditionally opaque adtech ecosystem. DecryptAds scans and correlates ads.txt, app-ads.txt, buyers.json, and sellers.json files — the technical registries governing programmatic ad space sales — exposing connections between top-tier publishers, data brokers, and entities with geopolitical risk profiles. At stake is individual control over a tracking ecosystem previously accessible only to advertisers and platforms.

Key Takeaways

DecryptAds continuously scrapes ads.txt, app-ads.txt, buyers.json, and sellers.json, making ad supply chain relationships publicly queryable.
ESPN.com lists 143 ad partners and 19 registered data brokers; nearly half of those brokers collect geolocation data, and three handle fingerprinting and sensitive personal data.
Between Digital, listed with a New York address, processes payments through Alfa Bank — a sanctioned institution — and operates as both publisher and reseller across roughly two-thirds of its approximately 55,000 partner sites.
U.S. military sites, including armytimes.com and defensenews.com, allow Between Digital to serve ads, while Opera.com — controlled by China's Kunlun Tech since 2016 — registers 27 data brokers with a majority of partners in the UAE and China.

The Hidden Files Governing Programmatic Advertising

The ads.txt and sellers.json standards were introduced by the Interactive Advertising Bureau to combat domain spoofing, but their implementation created a mass of structured data that few analyze systematically. DecryptAds extracts the relationships between publishers, resellers, and buyers from these files, building a navigable map of the advertising supply chain. The service includes a "Quiet Removals Feed" that tracks silent removals from sellers.json — events that, according to the official site, "only make sense when viewed across exchanges."

A quote from Edwards on the official site sets the methodological principle: "Supply-chain integrity issues rarely live in a single file." The tool cross-references declarations across seemingly unrelated domains and identifies cloned sets of attestations, applying the same correlation techniques used in threat intelligence to programmatic advertising.

"It's an adtech tool but we're trying to approach adtech from a security perspective" — Zach Edwards, chief research officer DecryptAds and threat researcher Infoblox

ESPN and Opera: Two Case Studies, Two Risk Architectures

The DecryptAds dossier on ESPN.com shows 143 ad partners and 19 data brokers. Nearly half of the brokers collect geolocation data; three handle fingerprinting and sensitive personal data. Four advertising entities linked to Russia, China, or the UAE appear in the sports network's supply chain. Among them, Between Digital lists a New York address but the dossier indicates payments processed through Alfa Bank, an institution subject to international sanctions. Krebs on Security requested comment and received no response at the time of publication.

Opera.com presents a different but equally dense profile: 27 data brokers out of a total adtech partner count that the source quantifies such that brokers represent 7% of the total. Fifteen partners are based in the UAE, six in China, three in Cyprus, two in Russia, one in Hong Kong, and one in Ukraine. The Norwegian browser — whose operational headquarters remain in Oslo — has been controlled by China's Kunlun Tech since 2016. The dossier does not document user data transfers to the parent company; it records only the corporate control structure.

Between Digital and the Structural Conflict of Interest

The Between Digital case illustrates a form of opacity that DecryptAds makes quantifiable. The company harvests advertising data across roughly 55,000 partner sites and is listed as both publisher and reseller on approximately two-thirds of that portfolio. Edwards describes the configuration in terms of systemic conflict of interest: "It means they are basically playing both sides of the bidding equation, which creates opportunities to direct client spend at your owned and operated properties or client infrastructure." The dual role theoretically allows influencing ad budget flow toward owned assets, a dynamic the file-by-file format would not reveal.

The presence of Between Digital in the ads.txt files of U.S. military sites — armytimes.com, airforcetimes.com, defensenews.com, navytimes.com, marinecorpstimes.com, federaltimes.com — adds a layer of geopolitical sensitivity. The dossier does not specify whether these sites have since removed the company.

What to Do Now

For website operators using programmatic advertising, DecryptAds offers a concrete method to verify their own supply chain: entering a domain into the service displays the complete list of declared ad partners and data brokers from ads.txt and sellers.json files. This enables identification of brokers collecting geolocation or fingerprinting data without the publisher's awareness.

For researchers and threat intelligence analysts, the "Quiet Removals Feed" provides a continuous monitoring signal on sellers.json modifications — changes that, as the official site documents, "only make sense when viewed across exchanges" and remain invisible in isolation.

For the four U.S. states with active data broker registration laws — California, Oregon, Texas, Vermont — DecryptAds serves as an independent verification source on actual operator declarations, though the brief does not document specific enforcement mechanisms or federal coverage.

DecryptAds' business model remains unspecified by the source. The service is described as free, but no details emerge on funding, economic sustainability, or potential time limits on the offering.

The Regulatory Gap DecryptAds Cannot Fill

Edwards highlights a persistent institutional void: "The problem we have right now is that for years we've had almost no one policing these ads.txt and app-ads.txt files." Four U.S. states — California, Oregon, Texas, Vermont — have enacted laws requiring data broker registration, but the quantitative data and evidence map do not indicate specific enforcement mechanisms or federal coverage.

The brief does not document whether the geolocation data collected by brokers includes precise or approximate location, nor does it quantify the exact number of AI-generated sites detected by the platform.

Why It Matters

The tool's value lies in reproducibility: the data is public, the correlations are verifiable, the methodology is declared. In a sector where opacity is structural, this transparency represents a paradigm shift. It remains to be seen whether visibility will produce accountability — and from whom.

The brief does not clarify whether Between Digital subsequently responded to Krebs on Security's comment request. It is not independently verified that Alfa Bank actually processes the company's transactions: the data derives from the DecryptAds dossier and is presented as such. The publication date — August 19, 2026 — is reported by the source but not confirmed by additional sources, an element requiring caution in temporal placement of the event.

Frequently Asked Questions

Does DecryptAds protect against data collection?

No. It is a forensic analysis tool that makes advertising supply chain relationships visible, not an ad blocker or active privacy solution.

Is DecryptAds data independently verifiable?

Yes. The tool relies on publicly accessible ads.txt, app-ads.txt, buyers.json, and sellers.json files. The same data can be consulted directly on target sites.

Why do U.S. military sites appear in Between Digital's supply chain?

The source does not explain the onboarding process nor whether the military entities are aware of the broker's presence. The data documents exclusively the technical result in advertising configuration files.

Information is based on the cited source and current as of publication.

Sources

Sources and references