On October 15, 2026, TrendAI published research showing an advertising entity it coded as SHADOW-EARTH-79 was the leading bidder for Starlink-associated ad impressions in 105 countries. Six sources familiar with the research identified the entity to Reuters as Discover-Tech, an Israeli firm. The same day, Citizen Lab released separate findings linking Discover-Tech to zero-click spyware infections at Al Jazeera. What follows is not a summary of those reports but an examination of what the bidding data reveals about advertising infrastructure as a reconnaissance layer.
In this article
What TrendAI Observed
TrendAI found that SHADOW-EARTH-79 was the number-one bidder in 105 countries for Starlink traffic it observed, capturing 12.9% of Starlink ad impressions against a 2.6% baseline across general traffic – a fivefold overrepresentation. In Argentina the entity captured 91.3% of observed Starlink wins, 89.1% in the Philippines, and 82.6% in Japan.
The entity was also the top bidder in Syria, Libya, Yemen, and South Sudan, and the number-two ad buyer in Afghanistan, despite the fact that demand for legitimate Western advertising in sanctioned or active-conflict states is effectively zero. TrendAI assessed with moderate-to-high confidence that the bidding patterns were consistent with targeting and tracking infrastructure rather than a commercial advertising operation.
Six sources told Reuters that SHADOW-EARTH-79 was TrendAI’s internal codename for Discover-Tech. TrendAI executives dropped the idea of publicly attributing the activity to a named company after raising legal concerns. The report was published without attribution. Reuters supplied it twelve days later.
The Citizen Lab Thread
Citizen Lab released findings on October 15 showing Discover-Tech facilitated the targeting of at least 45 Al Jazeera devices with spyware from Candiru, now rebranded as Integrity Labs, in 2024 and 2025. The attacks required no click or user action. The ads were placed by Discover-Tech, an Israeli company that presents itself as a normal digital advertising firm.
On infected devices, logs showed the same sequence: first contact with a Discover-Tech ad server, then a Candiru server that screens the device, then a command-and-control server that runs the spyware. The code used the same distinctive techniques as a Candiru tool Citizen Lab analyzed in 2021, forming the basis for high-confidence attribution.
Discover-Tech ads also appeared on networks at NATO, the UN, EU institutions, and the US Department of Defense. No infections outside Al Jazeera have been publicly confirmed, but the ad impressions document exposure.
Alphabet removed Discover-Tech from Google’s advertising vendor registries during the first week of October. IAB Europe removed it from its approved-vendor list on October 8. Comcast’s Beeswax severed access. All three actions occurred before the reports were published.
What Real-Time Bidding Leaks by Design
Real-time bidding auctions run in milliseconds. When a user loads a page, the ad exchange broadcasts a bid request containing device identifiers, IP address, approximate location, browser fingerprint, and the URL being visited. Bidders see this data whether they win the auction or not. A bidder submitting consistent bids for specific traffic can map device movements, correlate identities, and build targeting profiles without ever serving an ad, much less delivering an exploit.
Over time, a bidder can collect, collate, and merge leaked data with other information, not only deanonymizing users but also following them and potentially targeting them with surveillance software. The Starlink data is particularly valuable in this context. Starlink-associated traffic is strategically valuable to any operation seeking visibility into populations that are harder to reach through conventional internet infrastructure.
Starlink terminals are used in war zones, by aid organizations, journalists in restricted states, and individuals in countries where the service is banned. Some of the 105 countries where SHADOW-EARTH-79 led Starlink bidding are places where Starlink is officially banned or restricted, including Cameroon, Syria, Sudan, Myanmar, and Libya. The use of smuggled terminals in these environments makes the user population high-value for intelligence purposes and simultaneously harder to track through conventional telco partnerships or legal intercept frameworks.
TrendAI concluded that the firm’s bidding behavior reflected a dedicated tracking operation rather than commercial marketing, noting that legitimate Western advertising demand in heavily sanctioned states is virtually non-existent. The pattern is not compatible with profit-seeking advertising. It is compatible with reconnaissance.
Implications for Email and Encrypted Communication
The structural issue is not specific to Starlink. Email accessed through webmail – whether Proton Mail, Gmail, Tutanota, or any provider loaded in a browser – passes through the same advertising ecosystem. An encrypted email service protects message content and, in some architectures, metadata between correspondents. It does not protect the user from being profiled by the ad exchanges that broker impressions on the page where the inbox is displayed.
The threat is not hypothetical. If an adversary knows a target uses a specific email provider and can identify the device, bidding for impressions on that provider’s domain becomes a geolocation tool. The bid request reveals IP address and, depending on the exchange, GPS coordinates if the device grants location permissions to the browser. Even without winning the auction, the request-response cycle provides visibility. Winning the auction enables delivery, whether that is spyware or simply a beacon for confirmation.
This is why webmail, regardless of the provider’s encryption guarantees, sits downstream of an uncontrollable and largely unaudited surveillance surface. The advertising infrastructure was not designed for confidentiality. It was designed for addressability, which is the polite word for tracking.
Tor Browser disables much of this by default – no persistent identifiers, no third-party requests to ad exchanges, no JavaScript from untrusted origins unless the user permits it. Services accessed as onion services remove the ad layer entirely. There is no advertiser bidding on traffic that never touches an IP address advertisers can see. Open-source post-quantum infrastructure – such as PQCServer, released under AGPL-3.0 at github.com/onion-search-engine/pqcserver – extends that principle to encrypted key exchange resistant to future cryptanalysis.
These are architectural choices, not marketing positions. The question is whether the infrastructure relied upon is designed to be legible to surveillance buyers.
The Pattern This Fits Into
The use of advertising infrastructure for intelligence collection is not new. The innovation here is scale and specificity. John Scott-Railton of Citizen Lab pointed to earlier Haaretz reporting on Israeli companies marketing tools designed to locate Starlink terminals and, in some cases, identify their users. TrendAI’s data provides quantitative confirmation that such tools were deployed at global scale, with consistent presence across more than 100 countries.
What makes this a leading indicator is the target set. Starlink users in conflict zones are not mass-market. They are aid workers, military units, journalists, and activists operating in places where terrestrial connectivity is degraded or controlled. Profiling this population is a strategic intelligence function, not an advertising function. That an advertising firm performed this function using the routine mechanics of real-time bidding demonstrates that the framework is ready-made for repurposing.
The implications extend beyond Starlink. If advertising auctions can be used to track satellite internet users at this scale, they can be used to track users of any service where ads are served: encrypted messengers with ad-supported tiers, privacy-oriented browsers with default search deals, email providers that monetize through display ads. The data leak occurs at the auction, not at the point of content delivery. Winning the ad slot is optional. Seeing the bid request is enough.
What this reveals is that the ad tech ecosystem functions as a parallel surveillance network, running in real time, accessible to any bidder with capital and a seller account, and largely exempt from the legal frameworks that constrain government intercept. It is not a hack. It is a purchase.
Where This Leads
Advertising markets were built to be open, liquid, and real-time. Those properties make them useful for commerce. They also make them useful for intelligence work. The Discover-Tech case shows that a single entity, operating through standard programmatic channels, can position itself as the leading ad buyer for specific high-value traffic across more than 100 jurisdictions simultaneously. That is not an oversight. It is how the system is designed to work.
The removal of Discover-Tech from Google, Comcast, and IAB Europe vendor lists represents mitigation, not remedy. The structural exposure persists. Any bidder can submit requests for any traffic the exchanges offer. Attribution depends on voluntary disclosure by researchers, platforms acting on reputational risk, or sources willing to speak to reporters. None of these mechanisms are systematic.
The architecture determines exposure. An encrypted email protocol does not secure users if the session is wrapped in a webpage that auctions location data to surveillance buyers in real time. A satellite terminal designed to bypass censorship does not protect users from being cataloged by entities bidding for visibility into that bypass traffic. Privacy does not compose across infrastructural boundaries.
The trajectory is clear. Surveillance will continue to use the most efficient available infrastructure. Currently, that infrastructure is advertising.