Starlink users appear to have been singled out by a suspicious online advertising operation, according to new research and Reuters reporting that connects the activity to Israeli ad-tech company Discover-Tech.
Reuters reported on Oct. 27, citing six people familiar with the matter, that researchers at TrendAI, a Trend Micro research unit, concluded Discover-Tech was the entity they track as SHADOW-EARTH-79. TrendAI’s public report did not name the company, and Reuters said SpaceX, Discover-Tech and Discover-Tech’s chief executive did not respond to requests for comment.
The issue is ad bidding, not a Starlink account scam
The reported activity is not a conventional fake invoice, password theft email, or support scam. It centers on real-time bidding, the automated auction system that decides which ads appear inside websites and apps.
TrendAI said bid requests can expose data such as geolocation, IP address, autonomous system number, device model, screen size and identifiers. Collected over time, those signals can be combined into behavioural profiles. The risk increases around Starlink traffic because satellite internet is used in areas where terrestrial networks are damaged, blocked, degraded or politically sensitive.
TrendAI assessed with moderate-to-high confidence that SHADOW-EARTH-79’s advertising presence functioned as targeting and tracking infrastructure rather than ordinary commercial advertising.
Why the Starlink pattern stood out
TrendAI’s country-level Starlink analysis covered telemetry from June 2024 through June 2026. Its report said SHADOW-EARTH-79 was overrepresented in Starlink IP space and showed an “obvious skew” toward buying ad impressions on Starlink addresses compared with its broader footprint.
TrendAI reported on Oct. 15 that SHADOW-EARTH-79 was the top winning bidder for ad impressions in 105 countries in observed Starlink traffic. The entity accounted for about 13% of winning bid events in Starlink traffic, compared with an average of about 3% for other bidders, according to TrendAI. It also said the entity was the single largest bidder for ad impressions in 49 countries across all observed traffic.
The report also flagged activity in places where commercial Western advertising demand would be unlikely, including sanctioned or active-conflict regions. In selected regional data, SHADOW-EARTH-79 ranked as the top buyer in Syria, Libya, South Sudan, Yemen and Azerbaijan, and ranked second in Afghanistan.
TrendAI cautioned that IP geolocation has a margin of error. It said cross-checking against Starlink’s official geo-feed produced two conflicts, with one IP range geolocated by TrendAI to Myanmar appearing as Canada in Starlink’s feed and another geolocated to Sudan appearing as Niger.
A wider ad-surveillance investigation
The Reuters report landed less than two weeks after Citizen Lab and Confiant published related research naming Discover-Tech. Citizen Lab said Discover-Tech operated a platform called Controlium and that devices at Al Jazeera were infected with Candiru mercenary spyware through targeted online ads in 2024 and 2025. Citizen Lab said the attacks required no click from the victim once the targeted ad was rendered.
Confiant said its own investigation began with a Discover-Tech ad creative that triggered scanner detections on April 12, 2026. Its report described device fingerprinting, behavioural monitoring and a command-and-control channel hidden inside ad-delivered code.
Citizen Lab said Google and IAB Europe removed Discover-Tech from vendor registries in early October 2026. It also said Google terminated Discover-Tech’s access to ad exchange platforms, Beeswax removed it from its ad buying platform, Vungle paused access during a review and Eskimi blocked accounts and domains.
What the reports do and do not show
The public Starlink findings do not establish spyware infections on subscribers’ devices. TrendAI analyzed advertising telemetry from a single ad-buying platform, not Starlink account records or router logs.
The reports also show how a privacy risk can sit outside the internet provider. Starlink may provide the connection, but websites, mobile apps and advertising exchanges still decide which ads run once a device reaches the open web. In that layer, an ad does not need to sell anything to be useful to an operator collecting location and device data.
The practical security takeaway
For ordinary home users, the case is a reminder that ad tracking is not only a marketing concern. For journalists, aid workers, government staff, military contractors, activists and organizations operating in sensitive regions, ad exposure can become part of the threat model.
TrendAI recommended risk reduction rather than relying on identifying every suspicious bidder. Its guidance said ad blockers are more useful when they can remove ad tags, prevent ad-supported apps from reaching ad back ends and reduce tracking data sent to ad networks.
Citizen Lab’s recommendations went further for organizations, calling for ad blocking on work devices and at network gateways where possible, disabling unique advertising IDs on managed mobile devices and moving toward browsers with stronger anti-tracking controls.
In this case, the warning sign was the bidding pattern behind the ad, not its appearance.
Get new small business insights by email
Practical ideas and useful articles to help you make better business decisions.
Tech Help Canada Staff researches, writes, and reviews practical content for business owners and professionals. Our coverage spans business, marketing, SEO, technology, and the tools and systems people use to grow and operate online. We focus on clear, useful information backed by research, hands-on experience, and editorial review. Learn more about our team and editorial standards. Need help with something? Contact Us
