When a webpage loads a banner ad, it can broadcast IP addresses, device identifiers, and approximate location to potential buyers in milliseconds. That architecture was built to sell running shoes and streaming subscriptions. Researchers now say it was quietly repurposed to profile Starlink users in conflict zones and restricted states.
That allegation emerges from overlapping investigations by TrendAI and Citizen Lab into Discover-Tech, an Israeli ad-tech firm. The two investigations are related but distinct: TrendAI identified anomalous Starlink-associated bidding, while Citizen Lab documented advertising-based spyware delivery in a separate campaign.
What the Starlink Numbers Actually Say
The statistical anomaly at the center of this story is not subtle.
TrendAI’s analysis found that an entity it coded internally as SHADOW-EARTH-79 was the leading winning bidder for Starlink-associated advertising impressions across 105 countries. The entity captured roughly 12.9% of observed Starlink ad wins, compared with approximately 2.6% across general traffic, a nearly fivefold overrepresentation that TrendAI described as reflecting “implausibly dominant” bidding patterns.
Reuters reported that six people familiar with the investigation identified SHADOW-EARTH-79 as TrendAI’s internal designation for Discover-Tech. TrendAI did not name the company publicly in its own report.
The geographic concentration is where the story sharpens. SHADOW-EARTH-79 was the leading Starlink bidder in Syria, Libya, Yemen, and South Sudan, and ranked second in Afghanistan. TrendAI also reported extreme market shares in Argentina (91.3% of observed Starlink wins), the Philippines (89.1%), and Japan (82.6%).
TrendAI assessed with moderate-to-high confidence that the bidding pattern reflected targeting and tracking infrastructure, not a conventional advertising operation. Satellite connections reach users in places where terrestrial networks are state-controlled, degraded, or closely monitored. That makes Starlink-associated traffic strategically valuable to any operation seeking visibility into populations that are harder to reach through conventional internet infrastructure.
How a Banner Ad Becomes a Tracking Instrument
Real-time bidding exposes sensitive user data to every auction participant, by design.
Real-time bidding works like a stock exchange running at the speed of a page load. A bid request fires the moment a user visits a site or opens an app; it carries device data to potential buyers who have milliseconds to respond. A bidder who repeatedly wins impressions on a specific network can accumulate a growing picture of who is where and when.
Citizen Lab documented Discover-Tech running a related playbook in a separate campaign. According to Citizen Lab, the company operated a platform called Controlium that could fingerprint, de-anonymize, and secretly tracking users through advertising infrastructure. Citizen Lab named the technique “AdFection.” It required only that an advertisement render on the device; no user click or interaction was necessary.
Citizen Lab linked at least 45 Al Jazeera devices targeted in 2024 and 2025 to Candiru spyware, a vendor reportedly associated with Integrity Labs, using network evidence and recovered malicious files. Discover-Tech advertisements appeared across approximately 200,000 websites and apps during the reviewed period, though ad reach does not equal infection: many devices may have contacted profiling infrastructure without being compromised.
What the Research Does Not Claim
The evidence documents suspicious bidding and probable tracking; it does not establish that Starlink terminals were hacked.
The available findings document suspicious bidding patterns and a probable tracking operation. They do not establish that Starlink terminals were compromised or that individual Starlink users were successfully infected with spyware. Confirming device compromise would require separate forensic evidence that is not yet public.
SpaceX and Starlink’s own infrastructure are not alleged to have been breached. The apparent collection point was the advertising ecosystem operating around Starlink-associated traffic, not Starlink’s network itself.
Three Failures the Industry Owns
Reactive deplatforming is a cleanup operation, not a safeguard.
Google reportedly terminated Discover-Tech’s access to its ad-exchange platforms following Citizen Lab’s documentation. IAB Europe reportedly removed the company from its Global Vendor List. Both responses, if confirmed, came after the damage was documented. Removing a vendor after researchers spend months building a case is not a safeguard; it is a crew arriving after the fire.
The deeper problem is structural. RTB bid requests can expose IP addresses and device identifiers to multiple auction participants as a feature of the system’s design. EU data-protection authorities have raised concerns about this architecture repeatedly. Progress from the industry has been slow.
The Discover-Tech case points to a third gap. No meaningful disclosure requirement or audit mechanism currently applies to entities buying advertising at scale in conflict-adjacent or sanctioned markets. An entity can capture more than 91% of observed Starlink impressions in Argentina and face no obligation within the supply chain to explain why.
Who Pays When the Industry Does Nothing
The people most likely targeted by Starlink-focused surveillance are not abstractions in an ad-tech white paper.
In Syria, Yemen, and Libya, Starlink users plausibly include journalists filing from active conflict zones, aid workers coordinating logistics where state networks are restricted, and civilians using satellite connectivity because other options have been shut down. Researchers have not confirmed the identities of those targeted, but the geographic focus of the alleged operation points toward precisely these groups.
Removing a single vendor’s credentials after the fact is the minimum response, not the meaningful one. Structural reform would mean limits on what bid requests can legally transmit, pre-approval scrutiny for entities bidding at anomalous scale in sensitive markets, and audit mechanisms that do not depend on independent researchers doing the work regulators and exchanges have not. The infrastructure for pre-approval review already exists in financial and pharmaceutical advertising. The ad-tech industry has simply never been required to apply it to surveillance risks. That is the obligation the available evidence makes difficult to ignore. To stay safe, individuals operating in high-risk environments should also consider hardware-level attack surfaces beyond the software and advertising layers.
