Reuters on Tuesday identified Israeli advertising technology company Discover-Tech as “Shadow-Earth-79”, the codenamed top bidder for advertising shown to internet connections associated with SpaceX’s Starlink service. By the time the name became public, the firm had already lost much of its access to the ad market: Alphabet, IAB Europe and several buying platforms had cut it off weeks earlier. Reuters’ report rests on six people familiar with the research; this account also draws on the deep dive and IBTimes UK.
Key facts
- Alphabet removed Discover-Tech from Google’s advertising vendor registries during the first week of October, and IAB Europe, which maintains an approved-vendor list for digital advertising, delisted it on 8 October. Both dates come from the University of Toronto’s Citizen Lab.
- Comcast’s ad-buying platform Beeswax severed access, Eskimi blocked the company’s accounts and domains, and Vungle paused its access pending a review, per IBTimes UK.
- TrendAI, the research firm behind the advertising telemetry analysis, published its findings on 15 October without naming the company.
- Citizen Lab’s records list Discover-Tech as a Google advertising vendor since 2020.
- Neither study establishes a Starlink network breach, identifies who bought any Starlink-focused intelligence, or shows that the activity continues.
Why it matters
Starlink terminals route traffic through satellites rather than state-run telecommunications networks, which is why researchers cited by IBTimes UK describe the service as important to militaries such as Ukraine’s and to journalists and citizens in restrictive countries, Iran among them. Concentrated bidding on those connections was therefore treated as a signal worth examining rather than ordinary ad buying.
The sequence also tests the advertising industry itself. The removals closed some routes into ad inventory but produced no industrywide accounting of earlier exposure, and the buyer was identified by outside researchers rather than by the platforms that had been selling to it.
What the bidding data showed
TrendAI analysed advertising telemetry collected from June 2024 through June 2026 and found Shadow-Earth-79 was the leading winning bidder on Starlink traffic in 105 countries. Across the whole Starlink sample it took 12.9% of winning advertisements, against a 2.6% baseline share of the traffic TrendAI observed overall — nearly five times its ordinary presence.
Country shares ran far higher: 91.3% of observed Starlink wins in Argentina, 89.1% in the Philippines and 82.6% in Japan.
A separate analysis of broader advertising traffic put the same bidder first among buyers in Syria, Libya, Yemen and South Sudan, and second in Afghanistan, IBTimes UK reports. Researchers said that pattern was difficult to explain through legitimate commercial demand in those markets.
How researchers say ad auctions could be used
In real-time bidding, the automated system that auctions digital ad space, platforms send bid requests to potential advertisers each time a website or app loads. Those requests can carry device information, browser details, IP addresses and location metadata, IBTimes UK explains, and researchers argue that an unusually high bid volume lets such data be accumulated over time and used to profile or geolocate users.
A winning advertiser can go further and place code inside the ad itself, the deep dive adds, creating openings to profile a user or attempt an intrusion without ever touching satellite infrastructure. Neither account establishes that Discover-Tech identified individual Starlink subscribers or tracked their browsing.
The spyware findings behind the cut-offs
Citizen Lab’s 15 October investigation connected Discover-Tech’s advertising infrastructure to spyware delivery without establishing that any Starlink customer had been infected. The firm bought ad space used to deliver zero-click spyware from Candiru, the surveillance vendor since rebranded as Integrity Labs, Citizen Lab found.
The documented target was Al Jazeera, where researchers recorded infections on 45 Windows devices between 2024 and 2025. Devices that loaded the advertising scripts contacted Discover-Tech infrastructure before being routed to spyware validation servers within seconds, IBTimes UK says.
The two accounts put the firm’s reach slightly differently — more than 120,000 websites and 75,000 apps in the deep dive’s summary of Citizen Lab, almost 200,000 websites and apps in IBTimes UK’s. The gap is arithmetic rather than contradictory: the two figures sum to just under 200,000, so IBTimes UK appears to be reporting a combined property count. Either way, the number describes ad placements, not affected users.
Background
The naming closes one gap in the tracking allegations first reported this month, when the bidder existed publicly only as a codename.
Starlink’s role in conflict has drawn scrutiny on other fronts this month, including disputes over service limits affecting Ukraine’s front-line units. On the advertising question, two items stay open in all three accounts: who bought any Starlink-focused intelligence, and how much earlier exposure the platform removals left unexamined.
Frequently Asked Questions
How much did Discover-Tech reportedly spend on this bidding?
Citizen Lab counted roughly 3.77 billion bids in the company’s records from March to June 2026, IBTimes UK reports. The spend behind them came to about $109,091 (£82,000), with no recorded conversions — though Citizen Lab cautioned that the system may not have logged conversion data reliably.
Which organisations’ networks saw ads carrying the firm’s scripts?
Advertising containing Discover-Tech’s scripts appeared in networks associated with NATO, the European Parliament, the US Department of Defense, the International Atomic Energy Agency and the International Criminal Court, according to IBTimes UK. It adds that at least one major US technology company and one international organisation have opened internal inquiries into whether their staff were targeted.
Why did the original research not name Discover-Tech?
TrendAI researchers considered naming the firm in their 15 October report but executives raised legal concerns, Reuters reported, citing five people familiar with the matter. The company appeared in that report only as Shadow-Earth-79, and was named nearly two weeks later once Reuters had six sources of its own.
![Using Your Own Router with Starlink: Bypass Mode [2026]](https://starlink-news.com/wp-content/uploads/2026/09/using-your-own-router-with-starlink-bypass-mode-20-f6c09f95-120x86.png)
