Winning an online ad auction normally decides which banner appears on a screen. Two security reports this month suggest it can also decide which code a device runs — and on Starlink connections, one buyer has been winning a great deal.
The chain starts at Citizen Lab, at the University of Toronto. In mid-October the group published "AdFection", documenting how personalisation infrastructure is being used systematically to deliver spyware: instead of attacking the network, you buy the delivery slot. The report named Discover-Tech, an Israeli company, as an important link between the ad industry and vendors of government-grade spyware.
Then came TrendAI, the security arm of Trend Micro. Its report tracked a bidder it calls "Shadow-Earth-79" and found that, over a 90-day window, this buyer took 12.9 percent of all ad impressions displayed on devices connecting through Starlink — second only to Steelhouse at 38 percent. Steelhouse is a brand absorbed into MNTN, which, like Starlink operator SpaceX, is based in Texas. Over a longer period, June 2024 to June 2026, Shadow-Earth-79 was the biggest Starlink-focused ad buyer in 105 countries, including Germany, where it took close to one in three impressions on Starlink-linked devices.
Reuters, citing six unnamed sources, reported that Shadow-Earth-79 is Discover-Tech. TrendAI did not dispute the identification. Heise Online asked both companies for comment.
What stands out is the disproportion. 12.9 percent is nearly five times the share of general ad traffic the same buyer holds; Steelhouse's Starlink share is only 2.2 times its general share. Across all ad inventory, Shadow-Earth-79 was the largest buyer in 49 countries, with more than 90 percent of the market in Hungary and Israel and between 61 and 78 percent in Egypt, Azerbaijan, Venezuela and Qatar. Its target list includes places Western brands generally avoid — Yemen, Libya, South Sudan, Syria and Venezuela — along with regions under travel advisories.
Ad auctions are information machines. To bid, buyers receive location, IP address, autonomous system number, device type and screen resolution; combined with an advertising ID, click tracking and location history, that produces behavioural profiles — and enough context to shape what a device loads next. TrendAI collected Discover-Tech's JavaScript and concluded that functions such as manual script injection and de-anonymisation "are consistent with tools made for surveillance and data collection".
The report goes no further than that. TrendAI explicitly does not repeat Citizen Lab's central allegation that Discover-Tech distributed spyware, and says its own data cannot establish it. What it documents is intent-shaped behaviour: a bidder concentrating on a network used where terrestrial infrastructure is absent, unreliable or untrusted.
That matters because Starlink is the connectivity of last resort precisely where intelligence services find it hardest to reach. In several countries, TrendAI found the targeting ran not at Starlink users in general but at devices belonging to government services. In May, the Israeli daily Haaretz reported that two Israeli firms, Targetteam and Rayzone, offer to locate and partially identify individual Starlink users — a capability worth most where cellular interception is not an option.
Buying ad space is legal, and a lopsided share has innocent explanations: a buyer chasing a narrow audience, or a reseller aggregating inventory. But the asymmetry, the geography and the tooling together are why researchers describe this as surveillance rather than marketing.
