An entity researchers linked to Israeli firm Discover-Tech won an unusually large share of advertising auctions involving Starlink connections in 105 countries, according to Reuters and a TrendAI investigation. The findings raise the prospect that data exchanged in programmatic advertising could be used to identify and track people using SpaceX’s satellite internet service.
Over a 90-day observation period, the entity accounted for 12.9% of observed ad-auction wins on Starlink connections, compared with 2.6% of all ads in TrendAI’s sample. Six people familiar with the research identified Discover-Tech as the company behind the entity, called SHADOW-EARTH-79 in a TrendAI report; the researchers did not initially name the company, Reuters reported.
The numbers describe activity seen in researchers’ samples, not the percentage of Starlink users who were monitored. They also do not show that Starlink’s satellite network itself was compromised. Rather, the concern is data generated when devices access websites and apps over a Starlink connection.
- Argentina: the entity won 91.3% of observed Starlink-related ad auctions.
- The Philippines: 89.1%.
- Japan: 82.6%.
TrendAI also observed activity in countries including Syria, Libya, Sudan and Myanmar, where Starlink use is banned or restricted. Separately, the entity won 91.1% of the observed general advertising auctions in Hungary.
Why ad auctions can expose connection data
Real-time bidding, or RTB, sells digital ad space through automated auctions that take place in fractions of a second. To assess an impression, bidders can receive information about the intended audience and device. Even bidders that do not win an auction may receive some of that information.
- An IP address and approximate connection location.
- A phone’s advertising identifier and other device attributes.
- Details about the app or webpage being viewed.
- In some cases, more precise location data supplied through the advertising ecosystem.
Combined with previously collected information, those signals can potentially be used to identify an individual, map movements or infer activity patterns. An auction winner can also serve an ad containing JavaScript, which may extend data collection beyond the information shared by the ad platform.
The issue carries heightened risk for satellite links used in remote locations, areas with damaged communications infrastructure or near military fronts. Starlink is used by Ukraine’s military. An IP address does not automatically reveal precise GPS coordinates, but it can become useful when combined with other data.
Separate research links ad delivery to spyware attacks
Citizen Lab has separately documented a technique it calls AdFection, in which targeted advertisements were used to deliver commercial spyware without requiring the target to click an ad, download a file or approve an installation. Under certain conditions, simply loading an ad can trigger exploitation of a vulnerability.
The researchers said at least 45 devices within the Al Jazeera network were targeted in attacks during 2024 and 2025 associated with Candiru spyware, from a company now called Integrity Labs. Citizen Lab confirmed infections and reported technical links between Discover-Tech advertising infrastructure and servers used by Candiru.
Citizen Lab described AdFection as the first public technical demonstration of commercial spyware infections delivered through targeted advertising without victim interaction. That finding is distinct from TrendAI’s Starlink auction analysis: the available reporting does not establish that the Starlink users identified in the auction data were infected with Candiru spyware.
Following the investigations, Google and Comcast removed Discover-Tech from their advertising platforms, while IAB Europe suspended the company from its approved vendor list.
SpaceX, Discover-Tech and Discover-Tech’s director did not respond to Reuters requests for comment before its report was published. The case places renewed scrutiny on RTB systems: the same infrastructure built to match ads with audiences can expose connection and device signals with consequences far beyond advertising.
