An Israeli advertising technology company, Discover-Tech, heavily targeted users of SpaceX’s Starlink satellite internet service in what researchers believe was an attempt to track their locations or surveil them, according to six people familiar with the matter.
Researchers at TrendAI, a unit of Tokyo-based cybersecurity company Trend Micro, found that Discover-Tech was one of the biggest sources of digital ads shown to Starlink users and the top bidder on Starlink traffic in more than 100 countries, including several where the satellite internet service is banned or restricted.
The findings were based on digital advertising data collected through TrendAI’s telemetry.
TrendAI published a report on October 15 detailing the targeting of Starlink users but did not identify Discover-Tech by name. Instead, it referred to the entity as “Shadow-Earth-79”. Six sources familiar with the matter told Reuters that the codename referred to Discover-Tech.
TrendAI said its approach to attribution was designed to reduce the risk of errors and avoid labels that could mislead cybersecurity defenders or trigger inappropriate responses.
SpaceX, Discover-Tech and its chief executive did not respond to requests for comment.
On the same day TrendAI published its report, Canadian cybersecurity watchdog Citizen Lab and New York-based advertising technology firm Confiant separately identified Discover-Tech, accusing it of abusing the digital advertising bidding process to obtain data about internet users.
Advertisers participating in real-time bidding can receive information about users through the process. By collecting and combining such data with other information, companies can potentially identify users, track their online activity and target them with surveillance software.
Citizen Lab and Confiant said Discover-Tech’s advertisements had appeared within dozens of sensitive networks belonging to media organisations, governments and technology companies.
Following the investigations, Google, Comcast and other companies said they had removed Discover-Tech from their advertising platforms.
At least one major US technology company and an international organisation have also launched internal inquiries into whether Discover-Tech’s advertisements targeted their employees, according to two people familiar with the matter.
TrendAI’s report identified suspicious bidding patterns suggesting that Shadow-Earth-79 was operating “targeting and tracking infrastructure rather than a commercial advertising operation”.
The report said the entity was the largest buyer of digital advertisements in Syria, Libya, Yemen and South Sudan, and the second-largest in Afghanistan, despite limited demand for legitimate Western advertising in sanctioned or conflict-affected countries.
It also secured an unusually dominant share of advertising bids in several countries, including Hungary, Israel, Egypt, Azerbaijan and Venezuela.
The six sources said TrendAI researchers believed Discover-Tech was responsible for the activity and had discussed naming the company in the report. However, five of the sources said the researchers eventually dropped the plan after senior executives raised legal concerns.
Tracking Starlink users has become an increasing focus for governments seeking to monitor the spread of satellite internet terminals. Because Starlink routes data through SpaceX-operated satellites rather than nationally regulated telecommunications networks, the service can bypass local internet restrictions and provide connectivity in conflict zones.
Starlink has become particularly important in Ukraine, where the military relies on the service for frontline communications and directing drone strikes.
In May, Israeli newspaper Haaretz and the website Intelligence Online separately reported that Israeli-owned businesses were offering clients ways to identify and track Starlink users, with advertising data appearing to play a key role in the process.