An Israeli advertising firm named Discover-Tech is under scrutiny for allegedly using online ads to target and track users of SpaceX’s Starlink satellite internet, according to recent findings from TrendAI, a research unit of Trend Micro. The report, publicly released under the codename SHADOW-EARTH-79 on October 15, highlights how routine ad systems may expose users in sensitive locations—even without their interaction with the ads themselves. The accusations don’t involve any proven breach of Starlink’s networks or satellites but raise major privacy and safety concerns. Cybersecurity News first covered this on October 27.
How the Tracking Allegedly Worked
Investigators examined Starlink’s network identifier, AS14593, and found that bidders in real-time ad auctions were receiving data such as IP addresses, network identifiers, advertising IDs, and sometimes location info. By combining persistent advertising IDs with network details, ad operators might correlate user activity across multiple sessions—even if users never clicked on ads.
In the sample observed by TrendAI, the operation known as SHADOW-EARTH-79 emerged as the top bidder for ads served to Starlink-connected devices in over 100 countries. While this buyer represented about 12.9% of Starlink-associated ad impressions, across general internet traffic they only accounted for 2.6%. The data suggests a strong emphasis on targeting satellite internet users versus the overall user base.
Regions, Risks, and Infrastructure Insights
The tracking was especially evident in countries such as Syria, Libya, Yemen, and South Sudan, where SHADOW-EARTH-79 was often the leading ad buyer. Researchers also analysed publicly available JavaScript code linked to the operation—finding patterns that resemble tracking infrastructure more than standard ad-tech behavior. These include scripts tied to correlating anonymous identifiers and manually inserting features aimed at identifying users behind anonymized layers.
Although the data is based on a single ad-buying platform and uses IP-based geolocation (which can miscategorize users, especially in volatile regions), the patterns seen are troubling for users in conflict zones or other high-risk areas.
Reactions and Recommendations
Following investigations, companies including Google and Comcast said they removed Discover-Tech from their advertising platforms. SpaceX, Discover-Tech, and their leadership have reportedly not commented.
TrendAI advises users in sensitive positions to limit permissions, turn off ad personalization, avoid ad-supported apps, and deploy ad blockers that stop network requests—not just those that block visible ads. The researchers stress they found no evidence that every Starlink user was exposed, only that the infrastructure to enable broad tracking appears to be in place.
The implications are significant. Starlink has been a crucial connectivity provider in remote or conflict-affected regions. If ad-tech firms can derive user identity or location through ad delivery systems, the potential for misuse—by governments or other bad actors—is real. What we need next is transparency in ad-tech data sharing, clearer limits on what ad networks can collect, and tighter controls over routines that expose sensitive info without users’ awareness.
