Sources and limits

What this tool cannot do

• It cannot scan a device for spyware or read device memory.
• It cannot query Discover-Tech's bidding data. The researchers saw nearly four billion bid records on two open servers that were shut down in August 2026, and the records held IP addresses or /24 ranges and city-level location, not advertising IDs or cookie IDs.
• A match is possible exposure or profiling. It does not confirm that spyware was installed.
• No match does not show a device was never targeted. Only indicators that researchers or platforms released can match.
• It is an educational and hygiene tool, not a forensic instrument.

How matching works

The browser downloads the indicator list from /api/v1/indicators.json, normalises what you typed, and compares it locally. A domain indicator also matches its subdomains. The matching code is a small standalone Rust crate, ioc-core, so an auditor can read and test it without the web app.

Indicator roles map to severity. Command-and-control and validation servers are critical. Ad delivery, tracking and vendor-linked infrastructure are elevated. Vendor-linked consumer products such as Akedo or MyIPInfo are informational and do not by themselves produce a "possible exposure" result.

Mainstream ad platforms the report names, such as Google, Yandex, Vungle, Beeswax, Xandr and Eskimi, are shown separately as context. They never change the result, trigger an alert or get blocked. The report names these platforms and their share of Discover-Tech's bids; for Beeswax and Xandr it also gives the domain, and for the rest we list the platform's own ad domains.