The ad loads
A banner on an ordinary site or app. No click needed.
Case file · AdFection · Citizen Lab, 15 Oct 2026
An ad can profile you. Sometimes it can infect you.
The Citizen Lab found an ad company, Discover-Tech, aiming ads at specific devices through its Controlium platform. Candiru spyware reached at least 45 Al Jazeera computers that way in 2024 and 2025. Nobody clicked anything.
The scan checks the device in front of you for the domains the researchers published. A browser extension searches your cookies and history and can watch live as you browse. No extension? Drop in a DNS or router log. It all runs on your device.
Follow the request. Read the log.
Checking your browser…
The ID check
Its script reports your ad ID or cookie, IP and device details.
The validator
Is this the target? Everyone else gets a harmless ad.
The implant
Spyware lands on the one device that matched.
- 1
Consent
You choose. One cookie remembers it. Nothing is read before you agree.
- 2
Scan
Cookies and history, or a log you drop in, matched on your device against the published list.
- 3
Watch
Turn on live monitoring for a badge and alert if your browser contacts an indicator domain.
- 4
Report
Optional and anonymous. Only the published indicator is sent, never your pages or identity.
Get the scanner
The extension scans on your device and can watch live as you browse. We host it ourselves, so you do not need a Chrome or Apple account to get it. No extension support in your browser? Import files instead.
Chromium browsers
Chrome, Edge, Brave, Opera, Vivaldi, Arc
Direct download, no store
- Unzip the file somewhere you will keep it.
- Open the extensions page (chrome://extensions, edge://extensions, brave://extensions).
- Turn on Developer mode, choose Load unpacked, pick the folder.
Firefox
Firefox on desktop and Android
Direct download, no store
- Open about:debugging and choose This Firefox.
- Choose Load Temporary Add-on and pick manifest.json from the unzipped folder.
- Temporary add-ons are removed when Firefox quits. Permanent install needs a Mozilla-signed file, which has not been published yet.
Safari on Mac
Safari 18 and later
Build it, Apple signing required
Apple only lets Safari run extensions inside a signed app. Build the app from source and sign it with your own Apple ID. A signed build has not been published yet.
BUNDLE_ID=com.yourorg.leahfiles scripts/build-safari.sh
Safari on iPhone and iPad
iOS and iPadOS 18 and later
Build it, Apple signing required
Every iPhone browser runs on Apple's engine, and only Safari can host this extension. Installing needs the same signed app, installed with Xcode or TestFlight. Until then, import files below.
Import files
Any browser, any device
Available now
Export a DNS or router log, drop it in, and it is matched in your browser. Nothing is uploaded.
Checksums: SHA256SUMS. The source is open, so you can read what it does or build it yourself.
Domains
Paste domains from your router, DNS, firewall or proxy logs, or from browser history. Matches show contact with infrastructure the researchers published.
IP addresses
Paste the remote addresses your devices connected to. The public report lists domains, so IP matching grows only as researchers publish addresses.
Advertising ID
The researchers found no advertising IDs in the exposed bid data. No public list of IDs exists, so we say "insufficient data" instead of a false all-clear.
Your entries never leave this page
Your browser downloads the public indicator list and does the matching itself. No account, no upload, no stored identifiers. How that works.
Loading dataset status…