Report: Israeli ad firm was top bidder on Starlink traffic in 105 countries

A TrendAI analysis says an ad tech entity it codenamed SHADOW-EARTH-79 was the top winning bidder for ads on Starlink traffic in 105 countries, and Reuters reports that the entity is Discover-Tech, an Israeli firm. ¹ Those are the researchers’ findings and a news report about them, not a ruling, and none of the sources include a response from Discover-Tech.

What was reported

TrendAI published its analysis on October 15, the same day Citizen Lab released a separate report on Discover-Tech. The analysis found that the entity won about 12.9% of ads in its Starlink sample, against a 2.6% share in general traffic. ¹ That is nearly five times its normal footprint.

The skew was sharper in some places. It took 91.3% of observed Starlink wins in Argentina, 89.1% in the Philippines and 82.6% in Japan. It also led in Syria, Libya, Yemen and South Sudan. ¹ TrendAI said it had moderate-to-high confidence that the pattern was consistent with “targeting and tracking infrastructure rather than a commercial advertising operation.” ¹

TrendAI did not name Discover-Tech in that report. Reuters, citing six people familiar with the research, reported on Tuesday that the codename belonged to Discover-Tech, and that researchers believed the ads were likely used to geolocate or otherwise surveil Starlink users. ¹ Those people said TrendAI had considered naming the company but held back after executives raised legal concerns. ¹

TechRadar’s account adds that the ads do not need to be clicked: being served the ad is enough to begin collecting data from browsers and apps. ² Starlink supplies only the internet connection, so ads still load on ordinary webpages and in apps over it. ²

The earlier case

Citizen Lab’s October 15 report describes how Discover-Tech works. When a user is shown one of its ads, the device’s ad identifier and IP address go to servers the company runs. If the user is selected, malicious JavaScript is sent to the browser or app and exploits the device. ³ Citizen Lab said it found no sign of legitimate advertising activity by the firm and linked infections at Al Jazeera to Candiru spyware delivered this way. ³

Google has cut Discover-Tech off from its ad exchange platforms, and IAB Europe removed it from its vendor list on October 8. ¹

The Starlink findings are separate from the Al Jazeera infections. The sources describe likely geolocation and surveillance of Starlink users, not confirmed spyware installs on their devices.

The researchers point out that several of the top-bidding countries restrict or prohibit Starlink, which they say may put its users in places where satellite access is politically sensitive. ¹

What you should do

Most readers face little direct risk from this report, but the habits that help are cheap. Keep your phone, browser and apps updated, since that is general advice rather than a step the sources prescribe. Do it promptly if you use Starlink in a country that restricts it, or if your work makes you a likely target, such as journalism or activism. Rebooting and updating costs minutes, and it matters most when your location or connection is itself sensitive.

Our read: The case rests on two linked parts: bidding patterns that look unlike normal advertising, and the attribution that came through Reuters’s sources rather than TrendAI’s own report. Both are claims, not findings tested in court. The Starlink pattern is notable because satellite service is how people reach the internet in places where other routes are blocked. Watch for any public response from Discover-Tech and for whether TrendAI names the firm itself.

Footnotes

1. Gizmodo, “Researchers Uncover Signs of Massive Surveillance Operation on Starlink Users”. Retrieved October 28, 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸

2. TechRadar, “Starlink users heavily surveilled by alleged Israeli spy firm — company served ads to geolocate users and spy on browsers and apps”. Retrieved October 28, 2026. ↩ ↩²

3. The Citizen Lab, “Exposing AdFection Executive Summary”. Retrieved October 28, 2026. ↩ ↩²