One firm topped Starlink ad bids in 100 countries

Starlink users in more than 100 countries faced a new layer of digital tracking through standard advertising channels. Researchers at TrendAI, the cybersecurity division of Trend Micro, identified Discover-Tech, an Israeli advertising technology firm, as the primary source of these ads. Six individuals familiar with the matter said the company used the ads to geolocate and monitor subscribers.

The investigation began with earlier reports this year. Outlets including Haaretz and Intelligence Online noted that Israeli businesses were selling tools to identify Starlink users. These initial reports pointed to the role of ad data in the tracking process. TrendAI published a detailed report on October 15 that analyzed bidding data for Starlink traffic. The report did not name Discover-Tech directly, instead using the codename Shadow-Earth-79.

TrendAI executives cited legal concerns for withholding the company name in the initial release. They aimed to minimize errors and avoid labels that might mislead defenders. On the same day TrendAI published its findings, the Canadian watchdog Citizen Lab and the New York-based firm Confiant also identified Discover-Tech. Both groups stated that the company abused the ad-bidding process to leak user data.

The bidding data showed Discover-Tech as the top buyer of ad space for Starlink users in over 100 nations. This included countries where the service is officially banned or restricted. The firm was the largest ad buyer in Syria, Libya, Yemen, and South Sudan. It ranked as the second-largest buyer in Afghanistan, a market with low demand for Western advertising.

The company also held dominant bidding shares in Hungary, Israel, Egypt, Azerbaijan, and Venezuela. TrendAI researchers noted that the bidding patterns suggested the entity was operating tracking infrastructure rather than running a typical commercial advertising campaign. The ability to track users through this method allows governments to monitor the spread of satellite terminals, which bypass local telecommunications firms.

Citizen Lab and Confiant found that the ads appeared within sensitive networks used by media organizations, governments, and technology firms. The leaked data could be merged with other information to de-anonymize users and track their online movements. In response to the investigations, major companies including Google and Comcast removed Discover-Tech from their ad platforms. At least one major US tech company and one international organization have started internal inquiries into potential employee targeting.

Discover-Tech and its chief executive did not respond to requests for comment over the past two weeks. SpaceX also did not respond to inquiries regarding the findings. The incident follows a similar pattern of self-censorship in the cybersecurity industry, such as when Palo Alto Networks removed references to China from a report on a cyberespionage campaign earlier this year.