Reuters reported on October 27, 2026, that Israeli ad-tech company Discover-Tech was linked to advertising purchases associated with Starlink, citing six people familiar with the matter. In separate research, TrendAI labeled a bidder in Starlink traffic SHADOW-EARTH-79 and measured it as the leading buyer in 105 country-level slices, but second by total ad volume across the traffic it observed.
What the reported link means
Reuters’s account concerns Discover-Tech. TrendAI’s October 15 report uses the label SHADOW-EARTH-79 for its measured bidder. Keeping those attributions distinct matters: the Reuters report linked Discover-Tech to the activity, while TrendAI reported its own traffic measurements under that actor label.
What TrendAI measured in Starlink traffic
The country rankings and the aggregate ranking answer different questions. The first compares buyers within individual country-level slices; the second ranks their combined raw ad volume across observed Starlink traffic.
| Measurement | Reported result | Scope |
| Country-level ranking | First in 105 countries | TrendAI’s observed Starlink traffic, ranked by country |
| Aggregate raw-volume ranking | Second | All Starlink traffic in TrendAI’s observations |
| 90-day comparison | 66,208 ads; 12.9% share against a 2.6% baseline; 4.9× reported lift | TrendAI’s comparison of observed Starlink ads |
TrendAI defines “lift” as a buyer’s share of a particular traffic slice divided by its share of overall traffic. It reported a 4.9× lift for SHADOW-EARTH-79 in the 90-day comparison. TrendAI based its analysis on its own telemetry from one demand-side platform, or DSP, used to bid on advertising inventory.
How ad auctions can expose data
Real-time bidding (RTB) is the automated auction that chooses an ad, often in milliseconds. A bid request can include an IP address, geolocation, an autonomous system number, device type or model, and screen size. TrendAI says those signals, combined with advertising IDs, click tracking or location history, can support behavioral profiling.
Those are possible uses of bid-request data. The Starlink measurements described above count bidding and ads, rather than a subscriber-level tracking record.
The Al Jazeera case was separate
Citizen Lab reported that at least 45 Al Jazeera devices were targeted in 2024 and 2025 in a separate ad-delivered operation linked with high confidence to Candiru spyware. The lab described network contacts running from Discover-Tech infrastructure to a Candiru validator and then a command-and-control server. NeoTeo’s earlier account of the Al Jazeera ad-delivered spyware operation covers that separate case.
