Israeli ad firm suspected of tracking Starlink users in 105 countries

An Israeli advertising company was buying ad space aimed at Starlink users in a pattern that researchers say looks like tracking rather than advertising. TrendAI, the research arm of Japanese security firm Trend Micro, found that a bidder it calls SHADOW-EARTH-79 won about 13% of all ad auctions on Starlink traffic it observed, against roughly 3% for an average bidder, and was the top winning bidder on that traffic in 105 countries. Six sources told Reuters on 27 October that the codename stands for Discover-Tech, a company that Citizen Lab separately accuses of delivering spyware through ads.

How an ad auction exposes a Starlink user

When an app or website shows an ad, it first runs a split-second auction. The bid request sent to buyers can contain the user's IP address, approximate location, the network the address belongs to and device details such as model and screen size. Starlink addresses sit in SpaceX's own network block, AS14593, so any bidder can tell that a connection comes through a satellite dish. The winner also gets to run its own code inside the ad, which can collect more.

TrendAI worked from the telemetry of one ad-buying platform and isolated traffic from Starlink's address space. The bidder's activity was skewed toward that traffic, including in countries where Starlink is banned or restricted, such as Syria, Sudan, Myanmar and Libya. Reuters, citing the sources, adds that it was the top buyer of ads in Syria, Libya, Yemen and South Sudan. The report says Starlink is widely used in conflict zones where ground networks are damaged, and concludes with moderate to high confidence that the activity "functions as targeting and tracking infrastructure" rather than advertising.

Discover-Tech, the company behind the codename

TrendAI did not name the company. According to Reuters, five sources said executives raised legal concerns, and the researchers dropped the idea. On the same day, 15 October, Citizen Lab at the University of Toronto and ad-security firm Confiant named Discover-Tech in a separate report. Citizen Lab says the Israeli company, registered in 2020, runs a platform called Controlium that lets clients target individual users by advertising ID, cookie or IP address and push code to them inside ads. It links the platform to the spyware maker Candiru and says at least 45 devices at Al Jazeera were targeted with Candiru spyware delivered through Discover-Tech ads in 2024 and 2025.

Google cut Discover-Tech off from its ad exchanges, and Google and IAB Europe removed it from their vendor lists in early October. Comcast and other ad platforms have also dropped it, Reuters reports. At least one large US tech company and one international organisation have opened internal inquiries into whether the ads targeted their staff. Discover-Tech and SpaceX did not respond to requests for comment.

What is proven and what is not

The Starlink findings show unusual bidding, not confirmed tracking of specific people. TrendAI notes that IP-based location can be wrong, and its data comes from a single ad platform. The link between SHADOW-EARTH-79 and Discover-Tech rests on anonymous sources. The Al Jazeera infections are the part Citizen Lab documents with network logs and code overlaps.

What reduces the exposure

Both reports give similar advice: reset the phone's advertising ID regularly, turn off ad personalisation, use ad blockers and limit ad-supported apps. TrendAI also recommends iPhone's Lockdown Mode for people at risk. A VPN changes the IP address and network that bidders see, so the auction no longer shows a Starlink connection, but it does not remove the advertising ID or device details that apps put into bid requests. Citizen Lab's list mentions a VPN only as a service with built-in ad blocking, where the protection comes from the blocking.