The advertising entity that outbid everyone else for ad space on Starlink satellite internet connections in 105 countries spent only about $109,000 between March and June 2026 and recorded no conversions at all, according to the research findings reported by Gizmodo — a figure researchers cited as evidence the activity was not a commercial advertising business.
On Tuesday 27 October, Reuters reported that six people familiar with the research identified the entity, codenamed SHADOW-EARTH-79, as Discover-Tech, an Israeli advertising technology company. The underlying analysis came from TrendAI, a research unit of Tokyo-based cybersecurity company Trend Micro, and was published on 15 October through the company’s research arm without naming any company.
Key facts
- SHADOW-EARTH-79 was the number one winning bidder for ad impressions on Starlink traffic in 105 individual countries, TrendAI said.
- It accounted for roughly 12.9% of observed winning bids in the Starlink sample against a 2.6% baseline across general traffic — described by Gizmodo as a nearly fivefold over-representation, and the highest lift of any high-volume buyer.
- Analysis of about four billion bidding records showed some 3.77 billion bids placed and roughly 442 million auctions won, with script tags appearing across 75,373 Android and iOS apps and 120,768 websites, per Gizmodo.
- Google and Comcast removed Discover-Tech from their advertising platforms; IAB Europe, the European digital advertising industry body, removed it from its Global Vendor List on 8 October.
- SpaceX and Discover-Tech did not respond to Reuters. Separately, gsmdome says it approached the company’s director and Security Affairs says it approached the chief executive; neither received a reply.
Why it matters
TrendAI concluded with what it called moderate-to-high confidence that the bidding patterns were consistent with targeting and tracking infrastructure rather than a commercial advertising operation, pointing to anomalous bidding, dominance in sanctioned and conflict states, and over-bidding for Starlink address space.
Starlink is widely used where terrestrial networks are degraded, TrendAI noted, and Ukraine’s front-line units rely on it for communications and, Security Affairs says, for directing drone strikes. gsmdome reports that signals from ad auctions, combined with previously collected information, can potentially be used to identify an individual, map movements or infer activity patterns, and that an IP address does not by itself reveal precise GPS coordinates but becomes useful alongside other data.
Where the bids concentrated
Gizmodo reports the entity captured 91.3% of observed Starlink wins in Argentina, 89.1% in the Philippines and 82.6% in Japan, and was the top bidder in Syria, Libya, Yemen and South Sudan — markets where, TrendAI wrote, “the demand for legitimate Western advertising in sanctioned or active-conflict states is effectively zero,” as quoted by Gizmodo. It ranked second in Afghanistan and showed similar dominance in Hungary, Israel, Egypt, Azerbaijan and Venezuela; gsmdome puts its share of observed general advertising auctions in Hungary at 91.1%. Several of the countries involved restrict or prohibit Starlink, Gizmodo notes, so users who do get online there may be operating where satellite connectivity is politically sensitive.
Why the company was not named at first
The two research reports landed on the same day and took opposite approaches to naming: Citizen Lab, working from forensic evidence of spyware delivery on specific devices, identified Discover-Tech outright on 15 October, while TrendAI’s bid-pattern analysis withheld the name behind a codename. Reuters’ contribution on 27 October was to tie SHADOW-EARTH-79 to the firm Citizen Lab had already named.
TrendAI did not directly explain the omission, Security Affairs reports, saying only that its naming policy helps prevent mistakes and avoids labels that could push security teams towards the wrong risk or response. Five of the six sources told Reuters the researchers had discussed naming Discover-Tech and dropped the idea after TrendAI executives raised legal concerns.
The spyware link
Citizen Lab, the digital watchdog at the University of Toronto, described Discover-Tech as the buyer of ordinary-looking ads that delivered Candiru spyware with no user interaction. Candiru is an Israeli mercenary spyware vendor, now rebranded Integrity Labs, which the US Commerce Department’s Bureau of Industry and Security added to its Entity List trade restrictions in 2021.
Citizen Lab said at least 45 devices in the Al Jazeera network were targeted in attacks during 2024 and 2025, reconstructing from network logs a sequence in which devices contacted Discover-Tech infrastructure as ads loaded, followed within seconds by a Candiru validation server. It called the technique AdFection and described it as the first public technical demonstration of commercial spyware delivered through targeted advertising without victim interaction.
What has happened since
Discover-Tech held certified or approved vendor status with Google and IAB Europe from 2020 until earlier this month, Gizmodo reports, before Google terminated the firm’s access to its ad exchanges. Security Affairs adds that at least one large US technology company and one international organisation have opened internal inquiries into whether the ads targeted their employees, according to one of the six sources and a seventh person.
Security Affairs also notes earlier reporting in May by the Israeli newspaper Haaretz and the website Intelligence Online that Israeli-owned businesses were pitching clients on ways to identify and track Starlink users, with ad data appearing to play a key role — context that shapes what Starlink users can do about it.
Frequently Asked Questions
Did the research show that Starlink’s satellite network itself was compromised?
No. As gsmdome sets out, the findings describe data generated when devices reach websites and apps over a Starlink connection, not a breach of SpaceX’s network. Gizmodo makes the same point, saying the real-time bidding process provides a mechanism for tracking without requiring any compromise of Starlink’s own infrastructure.
How can an advertising auction reveal anything about a Starlink user?
Real-time bidding sells ad space through automated auctions that run in fractions of a second, and bidders can receive information about the intended audience and device in order to value an impression, according to gsmdome. Even bidders that lose an auction may receive some of that information, and a winner can serve an ad containing JavaScript that extends collection beyond what the ad platform shares.
Were Starlink users found to be infected with spyware?
Not according to the published reporting. gsmdome states explicitly that the available reporting does not establish that the Starlink users identified in the auction data were infected with Candiru spyware. Gizmodo likewise says researchers have not publicly confirmed infections of Starlink devices.
Whose networks did the ads turn up in?
Citizen Lab and the ad security firm Confiant found the ads reached networks associated with NATO, the European Parliament, the US Department of Defense, the International Atomic Energy Agency and the International Criminal Court, Gizmodo reported. Security Affairs adds that the ads appeared inside dozens of sensitive networks belonging to media organisations, governments and technology firms.
![Using Your Own Router with Starlink: Bypass Mode [2026]](https://starlink-news.com/wp-content/uploads/2026/09/using-your-own-router-with-starlink-bypass-mode-20-f6c09f95-120x86.png)
