Starlink Users Targeted by Ad Bidding

Discover-Tech, an Israeli advertising technology firm, was the number one bidder for digital ads targeting Starlink users in more than 100 countries, according to researchers at TrendAI. The company’s activity was detected in several nations where SpaceX’s satellite internet service was either banned or restricted. Six people familiar with the matter stated that the firm likely used these ads to geolocate or surveil users.

TrendAI, a unit of Tokyo-based cybersecurity company Trend Micro, released a report on October 15. The document identified the entity as "Shadow-Earth-79" rather than naming Discover-Tech directly. TrendAI explained in a statement that this approach was intended to reduce the risk of mistakes and avoid "hype-driven labels" that could mislead defenders. Five of the six sources said company executives raised legal concerns, leading researchers to drop their plan to name the firm publicly.

The investigation drew on digital advertising data within TrendAI’s telemetry. The report noted that Shadow-Earth-79 won an implausibly dominant share of bids in countries including Hungary, Israel, Egypt, Azerbaijan, and Venezuela. It was also the top buyer of ads in Syria, Libya, Yemen, and South Sudan, regions with little demand for legitimate Western advertising.

On the same day as the TrendAI report, the Canadian watchdog Citizen Lab and New York ad tech firm Confiant also named Discover-Tech. Both groups said the firm abused the ad-bidding process to collect user data. They reported that the ads appeared in dozens of sensitive networks belonging to media organizations, governments, and tech firms.

In response to the findings, Google, Comcast, and other companies removed Discover-Tech from their ad platforms. At least one large US tech company and one international organization have launched internal inquiries to determine if the firm targeted their employees. SpaceX did not respond to requests for comment, and Discover-Tech’s chief executive also did not respond over the past two weeks.

The use of advertising data to track satellite internet users has become a common tactic for governments seeking to monitor the spread of terminals. In May, Israeli newspaper Haaretz and the website Intelligence Online reported that Israeli-owned businesses were pitching clients on ways to identify Starlink users. The Israeli firm’s operations fit this pattern of exploiting ad data to de-anonymize users in hostile or restricted environments.