Israeli Ad Firm Outbid Everyone for Starlink Users in 100 Countries, and Researchers Think It Was Hunting Them

Somebody was paying a lot of money to put ads in front of Starlink users, in more than 100 countries, including several where Starlink is banned. Security researchers now believe that buyer was the Israeli company Discover-Tech, and that it was not trying to sell anyone anything. The likelier goal, they concluded, was to find those people and watch them.

The finding comes from researchers at TrendAI, a unit of Tokyo-based Trend Micro, according to six people familiar with the matter who spoke to Reuters. Working from ad data in TrendAI's telemetry, they found Discover-Tech was the number one bidder on Starlink traffic across that whole footprint.

How an ad auction becomes a tracking tool

Every time a page or app loads, advertisers bid in real time for the slot. Those auctions can leak details about the person about to see the ad, such as location and device. Collect enough of it over time and a bidder can de-anonymize people, follow them around the web and, in some cases, target them with surveillance software.

TrendAI's own report, published October 15, said the pattern pointed to "targeting and tracking infrastructure rather than a commercial advertising operation." Beyond the "obvious skew" toward Starlink, the entity was the top ad buyer in Syria, Libya, Yemen and South Sudan and the second largest in Afghanistan. "The demand for legitimate Western advertising in sanctioned or active-conflict states is effectively zero," the report noted. It also won "an implausibly dominant share" of bids in Hungary, Israel, Egypt, Azerbaijan and Venezuela.

The name nobody printed

Here is the strange part. TrendAI's report never named the company. It called it an "ad tech entity" with the codename "Shadow-Earth-79." The six sources said that was Discover-Tech, and that researchers were convinced enough to discuss naming it. Five of them said the idea was dropped after TrendAI executives raised legal concerns.

TrendAI said its attribution approach is meant to reduce the risk of mistakes and avoid "hype-driven labels" that can mislead defenders. Industry experts say that kind of caution is common in cybersecurity when executives fear retaliation.

Others were less shy. The same day, Citizen Lab and New York ad security firm Confiant named Discover-Tech outright, saying it abused the bidding process and that its ads turned up inside dozens of sensitive networks belonging to media organizations, governments and tech companies. We covered that work, which tied Discover-Tech's ads to spyware delivery at Al Jazeera. Google, Comcast and others then pulled Discover-Tech from their ad platforms, and at least one major US tech company and one international organization opened internal inquiries into whether its ads targeted their staff.

Why Starlink users are worth hunting

Starlink terminals send data through SpaceX satellites rather than nationally regulated telecoms. That lets people slip past local internet controls, talk from hostile areas and coordinate on the battlefield. Ukraine's military leans on it for frontline communications and for directing drone strikes.

So governments want to know who is using one, and tracking Starlink users has become a growing business. In May, Haaretz and Intelligence Online reported that Israeli-owned companies were pitching clients on ways to identify and track Starlink users, with ad data appearing to play a key role.

The tool people use to get around state censorship, in other words, may be quietly announcing them every time they open a web page. Discover-Tech and its chief executive did not respond to requests for comment over two weeks. SpaceX did not respond either.

Some offers on this page may be paid placements or contain affiliate links.