Israeli Ad-Tech Firm Discover-Tech Allegedly Used Ad Auctions to Track Starlink Users in 105 Countries

The convergence of satellite telecommunications and ad-tech auctions demonstrates that physical isolation from terrestrial networks fails to eliminate digital surveillance risks.

• The bidder footprint: Cybersecurity researchers identified an entity tracked as Shadow-Earth-79—linked by Reuters to Israeli ad-tech firm Discover-Tech—as the leading ad bidder targeting Starlink connections across 105 countries.
• The mathematical anomaly: The firm captured roughly 13% of all winning bids on Starlink traffic within those jurisdictions, nearly five times its baseline market share across general digital advertising.
• The programmatic response: Ad exchanges, including Google and Beeswax, terminated or restricted Discover-Tech's platform access following findings linking its infrastructure to surveillance and spyware delivery.

• Ad exchanges broadcast rich metadata: Real-Time Bidding (RTB) protocols routinely share device identifiers, IP ranges, and location signals to thousands of potential buyers within milliseconds to price impressions.
• Starlink fills high-risk network gaps: SpaceX's satellite network serves remote facilities, humanitarian missions, maritime routes, and conflict zones where local terrestrial internet is compromised, non-existent, or tightly monitored.
• Prior spyware linkages exist: Parallel investigations by Citizen Lab and Confiant connected Discover-Tech infrastructure to Candiru spyware deployment, including the confirmed compromise of 45 Windows endpoints at Al Jazeera between 2024 and 2025.

The exposure identified under operation Shadow-Earth-79 reveals an arbitrage between consumer ad-tech protocols and satellite infrastructure. Global ad networks run on millisecond auctions where supply-side platforms ping demand-side bidders with bidstream data. This stream contains technical specifications of the connected device, including operating system attributes, network carrier information, and geographic indicators derived from IP blocks.

In consumer broadband, this metadata simply routes an impression. When mapped across low-Earth-orbit satellite connections like Starlink, that same bidstream transforms into an intelligence asset. Starlink routes network traffic via dynamic ground stations and assigned IP pools. An operator with access to global ad exchange pipes can monitor these specific IP blocks. By aggressively bidding on Starlink-routed requests across 105 countries—accounting for 13% of all winning placements—a bidder can continuously map device locations, track when specific field units go live, and profile users who deliberately operate off local grids.

The economic incentives explain why ad exchanges serve as surveillance vectors. Building specialized SIGINT access requires bilateral telecom access or complex hardware interception. In contrast, registering as a legitimate programmatic buyer on mid-tier ad networks provides direct access to real-time telemetry from millions of endpoints. Discover-Tech’s market share in Starlink auctions reached nearly five times its normal baseline across general web traffic. This disparity reflects intentional acquisition of satellite telemetry rather than commercial consumer advertising.

Furthermore, ad-tech targeting creates a dual-purpose vector. The first phase is geolocation and telemetry harvesting via the RTB pipeline. The second phase involves payload delivery. Reports from Citizen Lab and Confiant demonstrated that Discover-Tech used malvertising to deploy zero-click exploits delivering Candiru spyware. This infrastructure was tied directly to the compromise of 45 Windows devices at Al Jazeera between 2024 and 2025. While investigators have reported no confirmed widespread infections across Starlink endpoints to date, dominating the bidding pipeline allows an operator to simultaneously survey target groups and hold the initial injection vector for malicious payloads.

For modern enterprise and field operations, this invalidates the assumption of perimeter security via satellite. Operating over satellite uplinks protects against local Internet Service Provider interception, yet terminal traffic remains exposed the moment an endpoint loads a web application, software tool, or web page containing standard ad exchange scripts.

• Field operations and conflict-zone personnel: Teams in Syria, Libya, Yemen, South Sudan, and Afghanistan using Starlink to bypass local state networks expose terminal movements via automated ad auctions.
• Corporate security and risk officers: Multinational organizations maintaining off-grid satellite resilience protocols face enterprise network mapping through employees' routine browsing habits.
• Digital publishers and investigative media: Newsrooms operating in sensitive environments risk device fingerprinting and targeted spyware deployment, following the operational precedent set at Al Jazeera.
• Ad exchange integrity teams: Global advertising networks must expend operational resources auditing demand-side platforms to detect anomalous bid-to-conversion ratios designed for telemetry gathering rather than ad monetization.

• Ad-tech regulatory and auction protocol overhauls: Watch whether major industry trade bodies restrict granular network carrier and IP telemetry in bidstream broadcasts to prevent location tracking.
• Hardware-level ad and script filtering: Monitor whether enterprise satellite hardware vendors integrate automated network-level blocking of commercial ad networks to protect deployed terminals.
• Downstream commercial impact on Discover-Tech: Observe if coordinated exchange bans by Google, Beeswax, and others effectively shut down the firm's global telemetry pipelines.