How Ad Auctions Can Reveal Starlink Users
Matthew Leo · Published October 31, 2026 · News
A webpage does not need to contain spyware to disclose something useful about its visitor. Before an advertisement appears, a real-time auction can broadcast the device’s IP address, rough location, network provider and other identifiers to companies competing to place the ad.
That machinery has become part of a new surveillance story involving Starlink users. On October 27, 2026, Reuters reported that a company called Discover-Tech was linked by six sources to unusually aggressive bidding on Starlink traffic observed by Trend Micro researchers. SpaceX and Discover-Tech did not respond to Reuters’ requests for comment.
The public evidence supports concern, but it has limits. Trend Micro did not name Discover-Tech in its research, and its data does not prove that particular Starlink users were successfully identified or compromised.
What the research actually found
Trend Micro’s October 15 report refers to the ad buyer as SHADOW-EARTH-79. In the company’s view of one advertising platform, that buyer was the leading bidder in observed Starlink traffic in 105 countries. About 13 per cent of its winning events involved Starlink traffic, roughly five times the baseline in Trend Micro’s dataset.
The company analyzed 84.7 million ad requests. That is a substantial sample, but it is not a complete view of the advertising market. Trend Micro also cautioned that IP-based location estimates have a margin of error. The numbers show a pattern of interest, not a census of everyone targeted.
Citizen Lab at the University of Toronto had previously documented Discover-Tech’s use of targeted advertising in a separate investigation involving spyware delivery. Reuters’ sources connected that company to the unnamed buyer in the Trend Micro report. That attribution is reporting from sources, not a name disclosed by Trend Micro itself.
Why Starlink traffic is especially revealing
Real-time bidding can expose an IP address, autonomous system number, device characteristics and a location estimate. A buyer can combine those signals with the timing of repeated requests. Starlink traffic adds a useful filter: it can indicate that a device is using a satellite network rather than a local mobile or fixed-line provider.
That does not automatically reveal a person’s name. It can still narrow a search. In a remote area, on a ship or near a sensitive facility, the set of possible users may be small. Repeated observations can also show that a device has moved or that it appears at predictable times.
This distinction matters. The risk is not that an advertisement magically locates every satellite terminal. It is that the advertising supply chain can turn routine browsing into a low-cost stream of clues. A determined buyer can purchase many of those clues without first compromising the network.
Ad blocking is only one layer
An ad blocker can reduce exposure in a browser, but high-risk organizations should not treat it as a complete fix. Apps, embedded web views and permitted first-party scripts may still participate in advertising or analytics systems.
A more useful control set starts with the devices and workloads that should never generate advertising traffic:
- Use managed browsers and block third-party advertising on operational devices.
- Separate personal browsing from mission, safety and infrastructure systems.
- Restrict mobile apps and web views that include advertising software development kits.
- Monitor outbound connections to ad exchanges and unfamiliar tracking domains.
- Test what public IP address and network name a site sees through each connection path.
- Assume that a repeated location pattern can be sensitive even when no account name is attached.
Organizations using satellite connections should also decide whether traffic exits from a gateway that accurately reflects the user’s location. That behaviour can vary by network design and region, so it should be measured rather than assumed.
The Canadian angle is bigger than one company
Citizen Lab’s Toronto-based investigation is a reminder that Canada has deep expertise in commercial surveillance research. Canadian privacy law also treats online identifiers as potentially personal information when they can be linked to an individual.
For northern communities, field crews, newsrooms and emergency teams, satellite internet can be the practical way to get online. The same connectivity can make network choice itself a valuable signal. Procurement reviews should therefore cover the advertising and analytics behaviour of the devices using the link, not only the satellite provider’s contract.
The most important conclusion is also the least dramatic: the public evidence does not show that every Starlink user was tracked. It shows that the ad auction can expose enough metadata to make a particular network worth targeting. That is a design problem the advertising industry has left open for surveillance buyers to exploit.
Tags: Starlink, privacy, cybersecurity, satellite connectivity, digital advertising