Ad Auctions Raise Starlink User Tracking Questions Around Discover-Tech

The concern around Discover-Tech is less about an ad campaign’s reach than about what an ad auction can reveal. Researchers say the Israeli advertising technology firm bought unusually large volumes of ad space associated with Starlink traffic across more than 100 countries. That pattern could expose information about users’ locations or create opportunities for further monitoring. The available findings do not establish that any Starlink subscriber was identified or followed.

The claims draw on research by TrendAI, Trend Micro’s research arm. Its October 15 analysis used the codename “Shadow-Earth-79” and did not identify a company. A Reuters account, citing six people familiar with the matter, says the activity was attributed to Discover-Tech. TrendAI says its naming and attribution process aims to limit misidentification and labels that could mislead security teams. The distinction matters: a pattern that looks suspicious can justify investigation without proving what an advertiser intended or what data it ultimately obtained.

What ad auctions can expose

Online advertising is often sold through real-time auctions. When a website or app has space to sell, it can send a bid request to advertisers and intermediaries. That request may include details about the device, the page or app, and signals that help estimate a user’s interests or location. Advertisers then compete to place an ad.

A single bid request may reveal little about an individual. Repeated requests can be more informative, especially when linked with other information over time. In principle, those signals could help build a picture of someone’s habits, identify a device that appears in multiple places, or narrow down where a user is located. The same infrastructure might also help someone select people for more targeted surveillance. Those are possible uses of auction data; the research described here does not show that Discover-Tech carried them out against named Starlink subscribers.

That gap between capability and confirmed use is central to assessing the claim. A high volume of bids shows that a buyer was active in a particular advertising environment. It does not, on its own, demonstrate that the buyer received usable location data, connected it to real identities, or monitored specific people. Those steps would require evidence beyond the purchasing pattern.

The geography stands out

TrendAI’s analysis describes Shadow-Earth-79 as the largest ad buyer in Syria, Libya, Yemen and South Sudan, and the second largest in Afghanistan. It also points to unusually high shares of bids in Hungary, Israel, Egypt, Azerbaijan and Venezuela. TrendAI interprets that distribution as more consistent with targeting or tracking infrastructure than with ordinary commercial advertising.

The pattern is a useful lead, but it leaves open why the activity concentrated in those markets. Advertising demand varies by country, and the volume of ads available can differ sharply between regions. A buyer’s share of bids can look large where competing demand is limited. At the same time, repeated purchases around users of a particular service could create a surveillance opportunity regardless of whether the buyer’s initial purpose was commercial. The available account does not detail the underlying bid data enough to settle those questions.

Separate research adds context

Discover-Tech had also drawn scrutiny from Citizen Lab and ad security firm Confiant. Their separate findings, published on the same day as TrendAI’s analysis, named the company and alleged that it used ad auctions to gather data across sensitive networks, including those associated with media organizations, government bodies and technology firms. Citizen Lab described Discover-Tech as presenting itself as a legitimate advertising company while acting as a facilitator for spyware providers.

Those allegations broaden the concern beyond Starlink, but they do not independently confirm that Starlink users were tracked. Google and Comcast have said they removed Discover-Tech from their advertising platforms. Reuters also reported that a major U.S. technology company and an international organization began internal inquiries into whether the firm’s ads reached their employees. The outcomes of those inquiries have not been provided in the source material.

Why Starlink users draw attention

Starlink connects users through satellites, so it can provide internet access where conventional telecom networks are unavailable or constrained. That reach can make the service valuable to people with few alternatives—and may make its users more exposed to monitoring attempts. The source describes efforts to restrict internet access and Starlink use in Iran, alongside changes to service for high-speed drones in Ukraine. These examples underline the sensitivity around the service, but they do not establish a connection between those events and Discover-Tech’s ad buying.

There is precedent for consumer technology and advertising systems becoming sources of sensitive data. The source cites a backdoor in an iOS advertising library that could gather device location and capture screenshots, as well as Chrysaor, Android spyware associated with the Pegasus family, which Lookout and Citizen Lab found on a small number of devices. It also describes a researcher’s claim that a Samsung smart TV running Tizen collected extensive data, including ad-related telemetry. That case remains under investigation, so it should be treated as an allegation rather than a settled finding.

The practical takeaway for platform operators is that advertising access can carry security implications beyond the ads themselves. Reviewing unusual buying patterns may help identify suspicious activity, but investigations need to distinguish a buyer’s reach from proof of data collection and proof of individual tracking. For Starlink users, the key unanswered question is whether Discover-Tech obtained or used signals tied to identifiable subscribers. The company and SpaceX have not commented, and the evidence described so far does not answer it.