About DecryptAds

Our mission

Programmatic advertising is hard to follow. A single ad can pass through half a dozen companies in different countries before it reaches a page, and data moves along the same path. We want to make that easier to read, so people can spot the risks they’ve been missing and see how publishers, data brokers, and intermediaries actually pass data and money between each other. Often it’s not how you’d expect.

If you work at a brand, agency, SSP, or on an ad ops team, that means you can check who is actually allowed to sell a site’s inventory, catch suspicious sellers early, notice when exchanges quietly drop someone, and have a record to point to when something doesn’t add up. The better you can see the chain, the less of your budget goes somewhere it shouldn’t.

Government, intel, and cyber teams use it the same way. If public ad money is ending up at a company in a sanctioned country, or a site that looks local is actually sitting on a bulletproof network somewhere else, you can start from the publisher or the app and follow it out to the exchanges, the data brokers, and the ASN behind it.

What makes DecryptAds different

1. Our own risk scores. We built separate scores for publishers, ad systems, sellers, and apps, because each of them goes wrong in different ways. Every score lists the findings behind it, so you can see why a site got a 70. A spoofed domain or a partner in a sanctioned country counts for a lot more than a sloppy ads.txt, and a big, well-known publisher with a messy file isn’t treated like a site that showed up last month.
2. We look at the actual page. We load publisher pages in a real browser, on desktop and on mobile, and score two things separately: how much of the page is ads (a good way to spot made-for-advertising sites) and how much tracking goes on, including what fires before anyone clicks a consent banner. Lots of sites do fine on one and badly on the other.
3. Everything is connected. Publishers, seller IDs, ad accounts, apps, tracking IDs, nameservers, TLS certificates, and hosting networks all live in one linked data model, so you can start anywhere and follow the thread. If fifty sites share the same set of ad partners, the same analytics ID, or the same servers, you’ll see it, even when someone has edited the files to make them look different.
4. All of it in one place. We collect ads.txt, app-ads.txt, sellers.json, buyers.json, and adagents.json (AdCP, including /.well-known/adagents.json) and put them next to data-broker registrations from California, Texas, Vermont, and Oregon, country risk (sanctions, foreign adversaries, secrecy havens), and who hosts what at the network level. As far as we know, nobody else has all of this together.
5. Where the company says it is. We match an ad system’s sellers.json contact to public lists: OFAC sanctions, U.S. foreign adversaries, secrecy havens. Browse the flagged exchanges, or open a publisher and see which of its partners sit in those countries. Handy when you need to show the path, not just a domain.
6. Where it actually lives. We look up the origin ASN and flag networks known for bulletproof hosting, known-bad traffic, or sanctions. The country on the AS often doesn’t match the address in the file. That’s the interesting bit: a publisher that looks domestic, hosted on an abuse-tolerant network in another country.
7. We keep the history. Every version of every file is saved, and we keep the original file too, not just the parsed copy. Page crawls are recorded as HAR, so if a lawyer, a regulator, or a case needs to see what was actually fetched, it’s still there. You can also see what changed and when. The Quiet Removals Feed shows sellers that several exchanges dropped in the same week. Nobody announces those, and they’re often worth a closer look.
8. Check your own traffic. Upload OpenRTB bid requests or impression exports from GAM, Xandr, The Trade Desk, or Amazon APS, and we’ll compare what’s in your logs with what publishers actually declare. Sellers that show up in your traffic but not in the publisher’s files get flagged.
9. Apps and CTV too. Apps from Google Play, the App Store, Roku, Fire TV, and Samsung TV are linked to their app-ads.txt, their store privacy labels, and their own risk score. We also scan the apps for ad SDKs and line them up with what they declare. If an app is built to talk to an ad system that isn’t in its app-ads.txt, you’ll see it.
10. Your own feeds, and an API. Feed Builder lets you save a search, say every site using a certain seller ID and hosted on a known bad network, and re-run it on a schedule to see what’s new. We also publish curated feeds of our own. Everything in the dashboard is available through our REST API and MCP server, so you can use it from scripts or an AI assistant.

Explore

• Open the app
• Pricing — free, researcher, and enterprise
• Blog

Social media

• LinkedIn
• X
• Bluesky
• Mastodon