Reuters today reported that the unnamed ad buyer a Trend Micro research unit tied to the tracking of Starlink users is Discover-Tech, the Israeli company the Citizen Lab accused on October 15 of turning targeted ads into a delivery route for spyware. The agency cited six people familiar with the matter.

In Short

A security company found that one advertising buyer paid to show ads to people on Starlink satellite internet far more often than its normal habits would explain, and said the buyer looked like a tracking operation rather than an advertiser. The company did not say who the buyer was, but six people told Reuters it was Discover-Tech, an Israeli firm that other researchers had already accused of using ads to spread spyware. This matters because every ad auction sends bidders details such as a device's IP address and network, and Starlink is used heavily in war zones and in countries that ban it. Several ad platforms have already cut Discover-Tech off, and Reuters says at least one large US tech company and one international organisation are checking whether its ads reached their staff.

What Reuters reported

The story, by Reuters reporter Raphael Satter, who covers cybersecurity and surveillance, rests on six people familiar with the matter. According to Reuters, researchers at TrendAI, a unit of Tokyo-based cybersecurity company Trend Micro, concluded that Discover-Tech was one of the biggest sources of digital ads shown to users of SpaceX's Starlink satellite internet service. The same sources said the researchers believed the ads were likely being used to geolocate or otherwise surveil those users.

The researchers drew on digital advertising data in TrendAI's telemetry, according to Reuters. They found that Discover-Tech had become one of the world's leading bidders for ads aimed at Starlink users, and that it was the No. 1 bidder on Starlink traffic in more than 100 countries, including several where Starlink itself was banned or restricted.

SpaceX did not respond to requests for comment, according to Reuters. Discover-Tech and its chief executive did not respond to requests made over the past two weeks.

There is a second claim in the piece, with thinner sourcing. At least one big US technology company and one international organisation recently opened internal inquiries into whether Discover-Tech's ads targeted their employees, according to one of the six people and a seventh person familiar with the matter. Neither organisation is named.

The commercial fallout had started before today. In response to the earlier investigations, Google, Comcast and other companies said they had removed Discover-Tech from their ad platforms, according to Reuters. PPC Land reported on October 18 that Google and IAB Europe had removed the company from their vendor registries, and that Comcast's Beeswax had taken it off Buyer Cloud.

A codename instead of a company

TrendAI published its research on October 15 under the title "Invasive Ads: The Unconventional Cyber Surveillance Attack Surface." The piece, credited to TrendAI Research and filed under APTs, the security industry's shorthand for advanced persistent threats, never names the company behind the activity. It describes "an ad-tech entity" tracked as SHADOW-EARTH-79, a group "observed to exploit the rich set of information that becomes available during the RTB process when advertisements are placed on digital platforms in their cyber operations."

The six sources told Reuters that SHADOW-EARTH-79 is TrendAI's codename for Discover-Tech. According to Reuters, TrendAI's researchers were convinced Discover-Tech was behind the bidding activity and discussed naming it in the report. Five of the six said the idea was dropped after TrendAI executives raised legal concerns.

TrendAI did not directly address why the report withheld the name. In a statement quoted by Reuters, the company said its approach to attribution was aimed at reducing the risk of mistakes and avoiding "hype-driven labels" or "unstable actor names that can mislead defenders, distort risk prioritization, and trigger inappropriate response actions."

The anonymisation goes beyond one buyer. A note under one of the report's tables says the buyers listed are identifier names used in the research, "except for SHADOW-EARTH-79 and BUYER2, which have been renamed." A third placeholder, BUYER3, appears as the top bidder in Afghanistan. The report does not say who BUYER2 or BUYER3 are, or why they were renamed. Nor does it name the demand-side platform whose traffic it analysed. What it does say is that tracking of SHADOW-EARTH-79's infrastructure is available in TrendAI Vision One, the company's commercial security platform, and that additional details are shared "with trusted contacts through established industry trust communities."

Others did the naming. On the same day TrendAI published, the Citizen Lab at the University of Toronto and New York advertising technology firm Confiant named Discover-Tech, according to Reuters. Both groups said the company abused the ad bidding process, which can leak data about internet users back to the bidder. The Citizen Lab's report described ads that delivered Candiru spyware to at least 45 devices at Al Jazeera, and both groups said the ads had been shown inside dozens of sensitive networks belonging to media organisations, governments and technology companies, according to Reuters.

Reuters placed TrendAI's choice in a wider pattern. Self-censorship is common in the cybersecurity industry, especially when executives fear that exposing surveillance operations could draw retribution, according to industry experts cited by the agency. Earlier this year, Reuters reported that US cybersecurity company Palo Alto stripped explicit references to China from a report on a global cyberespionage campaign, even though its researchers were confident the hacking could be pinned on Beijing. Palo Alto said the lack of attribution was not correlated with "procurement regulations in China" and that any suggestion otherwise was "speculative and false."

What a bid request hands to a buyer

TrendAI's argument starts with the plumbing of real-time bidding. The process auctions a device's ad impressions "by the millisecond," according to the report. To run each auction, information from the device goes to every bidder competing for the slot, including bidders the device owner never interacts with directly. That information can include the device's geolocation, its IP address, the autonomous system number (ASN) identifying the network it connects through, and device details such as type, model and screen size.

Combined with an advertising ID, click tracking and location history, the report says, that information can be used to build "an extensive behavioral profile of users." The winning bidder then delivers creative materials. These are normally image files, according to TrendAI, but they can also be manipulated to deliver JavaScript capable of further data collection. The report lists three uses: profiling movement from location data; profiling by user agent, language, carrier and device vendor; and profiling by interests gathered on the site or app that serves the ad.

None of the first stage requires a click, or even a winning bid. Every bidder in the auction receives the request.

The report acknowledges that malvertising has been a threat for at least two decades, and that the industry has built defences against ad fraud, notably transparency on the supply side, where the parties selling inventory are documented. IAB Europe found in 2025 that at least 72.64% of 2,054 European news publishers hosted ads.txt files. "However, there remains space for abuse on the demand side," TrendAI writes. The buy-side mirror of those supply-side files exists on paper: IAB Tech Lab dates version 1.0 of buyers.json and the DemandChain Object to June 2021, but adoption has remained weak.

Inside the TrendAI dataset

The findings come from advertising network telemetry logs captured by TrendAI's own systems. The analysis covers a single demand-side platform, which TrendAI puts down to "technical limitations faced while analyzing other DSP data." The researchers parsed each bid request URL to extract the bidder identifier, the destination IP address, the geolocated country and the originating network, then aggregated events by country and by ASN. A subset of the traffic came from SpaceX's Starlink address space, AS14593, registered as "SPACEX-STARLINK."

The main series runs for 228 days, from December 31, 2025, to August 15, 2026, with row-level detail for the final 18 days, starting July 29. Over that window TrendAI captured 84,710,348 requests, or 371,537 a day. Of those, 8,442,507 events were attributed to a buyer. Impressions accounted for 6,368,517 of them (75.4%), conversions for 1,518,112 (18.0%), and other events, including clicks, wins, renders and Video Ad Serving Template errors, for 555,878 (6.6%). The data spans 154 distinct buyer seats, 232 countries and 1,045,818 IP addresses that received ads. On an average day, 92.5 buyer seats were active.

TrendAI is explicit about the ceiling on what it can see. "It is important to note that the analysis and observations in this research are solely based on and limited by our own telemetry data and visibility," the report states. "This means that the actual size and scope of the campaign is likely to be significantly larger."

Lift is the report's central measure. TrendAI defines it as a buyer's share of a given slice of traffic divided by its share of overall traffic. A lift above 1.0 means the buyer bids on that slice more often than its overall footprint would predict.

Three windows, not one

The tables do not all describe the same period. Table 1 covers the 228-day window. The Starlink lift table is described as covering "a test period of 90 days," with no dates given. The Starlink country table draws on telemetry "from June 2024 through June 2026," a two-year span that starts some 18 months before the main collection window opens.

The units shift too. The 90-day table counts ads served; the two-year table counts winning bids. By PPC Land's calculation, the 45 countries in the two-year table add up to 53,821 SHADOW-EARTH-79 Starlink bids, fewer than the 66,208 Starlink ads attributed to it in the 90-day table. The report does not explain how the windows relate to one another.

In the Starlink traffic TrendAI observed, SHADOW-EARTH-79 ranks second among winning bidders by raw volume. The report argues that the raw rank understates the pattern, pointing to "an obvious skew towards buying ad impressions on Starlink addresses, compared with its overall footprint."

Over the 90-day test period, SHADOW-EARTH-79 accounted for 66,208 ads served to Starlink IP ranges, or 12.9% of all Starlink ads in the data. Its share of all ads served, on every network, was 2.6%. That gives a lift of 4.9.

The rest of the table shows what ordinary buying looks like. The largest buyer by volume, an identifier listed as steelhouse, served 196,791 Starlink ads, 38.4% of the total, against a 17.9% baseline: a lift of 2.2. An identifier listed as inmobi posted the highest lift, 5.0, but on just 2,542 ads. Among the 15 buyers with 500 or more Starlink events, SHADOW-EARTH-79 combines the second-largest volume with the second-highest lift.

The key takeaways at the top of the report frame the comparison differently. They describe roughly 13% of winning bid events in Starlink traffic as "five times higher than average (approximately 3%) bids for other bidders." The table, by contrast, defines the 2.6% as SHADOW-EARTH-79's own baseline share of all ads served, which compares the buyer with its own footprint rather than with other bidders. The table's definition is the one the lift calculation uses.

Number one in 105 countries

SHADOW-EARTH-79 is the top winning bidder on Starlink traffic in 105 countries, according to TrendAI. The published table lists 45 countries where it either ranks first or sits in the top five, sorted by its winning bids.

Australia produced the most activity: 21,551 SHADOW-EARTH-79 bids out of 38,066 on Starlink connections, a 56.6% share, with 33 buyers present. In Argentina it took 91.3% (4,244 of 4,650), in the Philippines 89.1%, in Malaysia 88.2%, in Spain 87.7% and in Japan 82.6%. Singapore came close to total, at 958 of 989 bids, or 96.9%. It also ranked first in France (64.6%) and Germany (32.7%). Its weakest position in the table was in the United Kingdom, where it ranked fourth with 314 of 3,338 bids, or 9.4%.

In five countries in the table, SHADOW-EARTH-79 was the only buyer present at all: Eswatini, Cameroon, Niger, Burundi and Sierra Leone. Across all 45 listed countries, its bids come to 53,821 of 89,459, or 60.2%, by PPC Land's calculation.

Some of the 105 countries are places where Starlink is officially banned or restricted by regulation, according to TrendAI, which names Cameroon, Syria, Sudan, Myanmar and Libya. Here the report adds a caveat that carries weight. TrendAI geolocated the IP addresses using several techniques, including cross-referencing Starlink's official geofeed, and found two conflicts. The IP range TrendAI places in Myanmar appears as Canada in Starlink's geofeed. The range it places in Sudan is listed under Niger. Two of the five restricted-country examples therefore rest on TrendAI's own IP geolocation rather than on the locations SpaceX publishes. "As with all IP geolocation there will be some margin for error," the report states.

The report also says the ASNs where ads were served show "a skew toward ASNs belonging to government networks in some countries." It does not list the networks or the countries.

Reuters described the tracking of Starlink users as a cottage industry, as governments try to get a grip on the spread of satellite internet terminals. Because the terminals route data through SpaceX-operated satellites rather than nationally regulated telecommunications firms, they can sidestep local internet restrictions, communicate in hostile areas or coordinate action across battlefields, according to Reuters. Ukraine's military relies on the service for frontline communications and for directing drone strikes. TrendAI's framing is narrower: Starlink "is widely used in conflict zones where terrestrial networks are degraded."

The ad-data route to Starlink users was already on the record. In May, Haaretz and Intelligence Online separately reported that Israeli-owned businesses were pitching clients on ways to identify and track Starlink users, and Haaretz said exploiting ad data appeared to play a key role. PPC Land's coverage at the time described two Israeli firms, TargetTeam and Rayzone, offering tools that could locate and in some cases identify Starlink users, with Haaretz reporting that about 200,000 terminals had been deanonymized. Neither TrendAI nor Reuters connects those firms to Discover-Tech.

Top bidder in 49 countries

Beyond Starlink, TrendAI found SHADOW-EARTH-79 to be the single largest bidder for ad impressions in 49 countries across all traffic. Many of those countries appear on government travel advisory or dangerous-country lists, according to the report, and others "had critical events such as elections close to the time of the activities observed." The report does not say which elections.

"In several cases, it captures an implausibly dominant share of all bidding activity, which is inconsistent with normal competitive ad buying," TrendAI writes. The published table ranks the top 25 countries by share. The largest volumes are in Israel, where SHADOW-EARTH-79 accounted for 123,396 of 136,917 bid events (90.1%) from 13,828 unique IP addresses, and in Hungary, with 64,218 of 70,500 (91.1%) from 8,920 addresses. Egypt (77.2% of 21,511 events), Azerbaijan (75.2% of 10,346) and Venezuela (72.2% of 24,517) complete what the report calls "near-monopoly shares." Qatar came in at 61.2% of 36,022 events. The report also cites high shares in Thailand, Malaysia, Saudi Arabia and the United Arab Emirates, without figures.

Several percentages in the table rest on very small counts. Tuvalu's 95.5% reflects 21 of 22 bid events. The Central African Republic's 83.3% is five of six. Svalbard and Jan Mayen is four of five, and Nauru two of three. Those shares say more about how thin the data is in some places than about dominance of a market.

Sanctioned and conflict states

The same caution applies to the conflict-zone figures Reuters highlighted. "It is obvious that the demand for legitimate Western advertising in sanctioned or active-conflict states is effectively zero, so activity in these regions is worth monitoring," the report states. SHADOW-EARTH-79 ranked first in Syria (27 of 47 events), Libya (108 of 266), South Sudan (71 of 123) and Yemen (17 of 44), and second in Afghanistan (17 of 72), behind the renamed BUYER3. Azerbaijan, at 7,776 of 10,346, is the only country in that table with volume in the thousands.

Small numbers here reflect a narrow vantage point, not necessarily small activity. The Citizen Lab, working from Discover-Tech's own exposed bidding database rather than one DSP's traffic, counted 457,283,658 bids on IP addresses in Yemen for ads carrying the script tags it linked to targeting, between March and June 2026, more than in any other country. The two datasets measure different things over different periods and cannot be compared directly.

What the back end exposed

TrendAI's strongest claim rests on code rather than bidding patterns. The researchers say they identified and reconstructed SHADOW-EARTH-79's back-end systems through AI-assisted analysis of JavaScript bundles. Web applications built on frameworks such as React, Vue and Angular package the whole application into a bundle that, according to TrendAI, "is often available in an open assets folder, regardless of whether the user is currently logged in to the platform." The report calls the method "a relatively simple but effective technique."

The reconstructed source tree, published as the report's first figure, includes TOTP two-factor authentication management, a creative upload view with an S3 file browser, CSV and PNG file uploaders, and Redux actions for authentication, login and event logging. Two further figures list configuration fields:

  • IP collection modes: collect an IP address, an ID plus IP, an IP without an ID, multiple IPs with IDs, multiple IPs without IDs, and an "infinite FIFO queue."
  • Operational security settings: a "concat IP" option that, switched to v2, requires an "opsec_key," and a "disrupt opsec v2" option that exposes IP-based, time-based and user-agent-based disruption.
  • Network options: truncated IPs, ignoring a user's proxy, automatic IP detection, pre-filtering by IP, destination port, connection logging, "show hash to operator," frequency capping and a monitor mode.
  • Collection and injection: a field named "panda" labelled "De-anon" mode, a field named "cjsc_script" labelled manual script injection, and user-agent collection.

"Functions like manual script injection, de-anonymization, and other features available in the interface are consistent with a tool designed for surveillance and intelligence gathering," TrendAI writes.

The labels resemble those the Citizen Lab reported in Controlium, a Discover-Tech platform whose campaign module offered URL types labelled "Script," "User Agent," "Monitor" and "De-anon" alongside "OpSec" settings. TrendAI does not name Controlium or any other product, and neither research group compares the two interfaces. The overlap fits what Reuters' sources say, but it is PPC Land's observation, not a finding in either report.

The report's conclusion is hedged. "The collected evidence indicates with moderate-to-high confidence that SHADOW-EARTH-79's advertising presence functions as targeting and tracking infrastructure rather than a commercial advertising operation," it states. Its final analytical sentence goes further: "The anomalous bidding behavior, heavy dominance in sanctioned and conflict states, and pronounced over-bidding for Starlink address space establish intent to reach specific audiences in sensitive geographies."

Intent to reach audiences is not the same as surveillance of particular people. TrendAI reports no confirmed case of a Starlink user being located, identified or infected through these ads. Reuters' sources say the ads were likely used to geolocate or otherwise surveil users, which is an assessment rather than a documented case.

What TrendAI recommends

The report's single recommendation to the advertising industry is to "investigate the activities of advertisers with similar bidding profiles to those that we have identified here and assess their legitimacy as part of the commercial advertisement ecosystem." It does not say whether the DSP in its data was told about the findings, or whether it acted on them.

Its list for governments, enterprises and high-risk individuals is longer. It includes filtering ad traffic in highly sensitive locations and on devices belonging to likely targets; resetting advertising IDs, disabling ad personalisation and limiting ad-supported apps for staff in conflict zones or sanctioned states; device modes such as Lockdown Mode on iPhone; restricting app permissions, given the risk from ad software development kits built into free apps; and blocking traffic to the back-ends of known suspicious operators. On ad blockers, TrendAI cautions that if software only stops an ad from being displayed, "the tracking event is likely still occurring." It favours tools that remove ad tags from web content and stop ad-supported apps from reaching ad back-ends.

The direction matches the Citizen Lab's. That group judged that the most feasible protection is for defenders to block targeted ads at the gateway and called for mandatory ad blocking on government devices.

Why this matters for advertising

Two research groups, working from different data, have now described ad buying that looks like surveillance. The Citizen Lab read Discover-Tech's exposed databases and Al Jazeera's network logs. TrendAI watched one DSP's traffic from the outside. If Reuters' sources are right, both were looking at the same company. That link rests on anonymous sourcing. TrendAI has not confirmed it, and Discover-Tech has not commented.

The security exposure of the bidstream is a long-running thread in PPC Land's coverage. In January 2025, EPIC and the Irish Council for Civil Liberties filed an FTC complaint alleging Google's real-time bidding system shared Americans' data with entities tied to China, Russia and Iran. A class action filed in February 2026 accused Google of sending browsing data through RTB and cookie syncing to ByteDance, Baidu and Temu. Both cases rest on the same premise as TrendAI's report: any participant in an auction receives the data, whether or not it buys anything. What the TrendAI figures add is an attempt to show what such a participant's bidding looks like in practice.

Location data has drawn regulatory action on the broker side as well. In May 2026, the FTC closed its case against Kochava with an order barring the sale of precise location data tied to sensitive places without opt-in consent. The behaviour TrendAI describes would not need a broker. The buyer collects what the auction sends.

For DSPs, exchanges and publishers, the more uncomfortable detail may be how visible the pattern was. A single buyer winning 90.1% of bid events in Israel, 91.1% in Hungary or 96.9% of Starlink bids in Singapore is not hidden in noise, and TrendAI flagged it from aggregate auction statistics before turning to the code. That contrasts with the creative layer, where, according to Eskimi's response to the Citizen Lab, Discover-Tech's tags were built to evade automated scanning. Scanners may miss a payload served to one target. Country-level win rates are harder to disguise.

The naming question has practical consequences too. A codename helps defenders only if they hold the matching indicators, and TrendAI says those sit in its commercial product and in private trust communities. The ad platforms that cut Discover-Tech off did so after research that named it. Reuters' account shows legal and commercial risk shaping what security research publishes. Earlier this year the agency reported a similar pattern at Palo Alto, which denied it.

There is also an inventory question that neither report quantifies. If government and enterprise networks follow either group's line on filtering ads, the reachable audience on those networks shrinks. How much ad traffic flows through government ASNs, the networks TrendAI says SHADOW-EARTH-79 skewed toward, is not stated in either document.

Timeline

Summary

Who: TrendAI, a research unit of Tokyo-based Trend Micro, tracked an ad buyer it called SHADOW-EARTH-79. Reuters, citing six people familiar with the matter, reported that the codename refers to Israeli company Discover-Tech, which the Citizen Lab and Confiant had named on October 15. SpaceX and Discover-Tech did not respond to Reuters.

What: According to TrendAI, SHADOW-EARTH-79 was the top winning bidder on Starlink traffic in 105 countries and the top bidder overall in 49, took 12.9% of Starlink ads in its data against a 2.6% baseline, and ran a back end with fields for IP collection, "De-anon" mode and manual script injection. TrendAI assessed with moderate-to-high confidence that it functions as tracking infrastructure. Reuters reported that TrendAI dropped plans to name the company after executives raised legal concerns.

When: TrendAI published its report on October 15, 2026, using data collected from December 31, 2025, to August 15, 2026, with a Starlink country table covering June 2024 to June 2026. Reuters published its report today.

Where: The data comes from one unnamed demand-side platform. The bidding covered Starlink address space (AS14593) in 105 countries, including Australia, Argentina, Singapore and countries where Starlink is banned or restricted, and conflict states such as Syria, Libya, Yemen and South Sudan.

Why: Every ad auction passes device location, IP, network and device details to each bidder, and Starlink terminals are used in conflict zones and places that restrict them. The findings add a second dataset, after the Citizen Lab's, describing ad buying that looks like surveillance, and they show a concentration pattern visible in ordinary auction statistics.