What happened?
On 15 October 2026 two research teams published reports on Discover-Tech, an Israeli company that buys ad space for its clients (a demand-side platform):
- Citizen Lab, How Discover-Tech turned targeted ads into a pipeline for spyware. Citizen Lab calls the technique "AdFection".
- Confiant, ADINT: weaponized ad tech for zero-click spyware.
The main points, as the reports state them:
- From March to June 2026, Discover-Tech's ads reached about 120,000 websites and 75,000 apps. Citizen Lab reviewed nearly four billion bid records. Apps named in the report as places the ads appeared include MX Player, Viber, Truecaller, Duolingo, Yahoo Mail and Opera Mini.
- A device that loaded one of these ads could be identified and tracked. On phones, the reports also describe attempts to link advertising IDs to phone numbers.
- For selected targets, the same ad path was used to deliver spyware without a click. Citizen Lab says at least 45 devices at Al Jazeera were targeted in 2024 and 2025 and links the attacks with high confidence to the spyware maker Candiru. The malware sample the report describes is Windows software.
- Ads from this campaign were also seen on the networks of institutions such as NATO, the UN and the European Parliament. Citizen Lab stresses that an ad being shown is not evidence of infection.
- Google cut Discover-Tech off from its ad platforms, and Google and IAB Europe removed it from their vendor registries in early October 2026.
Among its advice for users, Citizen Lab suggests an ad-blocking service on your network and regularly resetting your phone's advertising ID.
Which domains does EZOBLOCKER block?
Since 17 October 2026, 53 rules from these reports are on our lists: 28 in Trackers (Discover-Tech's own ad, tracking and data domains) and 25 in Security (servers linked to the spyware delivery). A rule that starts with a domain also covers all its subdomains. The main ones:
| Domain | What the reports say it is | Category |
|---|---|---|
mtrtb.com | Discover-Tech's main domain, ad serving and impression tracking | Trackers |
discover-tech.io, mydsp.io | Discover-Tech and its ad-buying platform, MyDSP | Trackers |
adtimizer.co, tekma-dmp.ai | Ad platforms the reports tie to Discover-Tech | Trackers |
myipinfo.io | An IP lookup site run by Discover-Tech | Trackers |
trustlayersdk.com | Server of an app SDK that presents itself as a verification tool | Trackers |
8 cloudfront.net addresses | Serve the scripts the reports attribute to Candiru | Security |
| 17 other domains | Spyware delivery servers named in the reports | Security |
We checked that these domains are blocked on all four of our DNS servers (Istanbul, Nuremberg, Montréal and Mumbai).
What did we find that the reports do not list?
Discover-Tech still publishes its own disclosure file for the ad industry's consent framework, info.discover-tech.io/disclosure.json. On 17 October 2026 it listed three domains where the company stores cookies: mtrtb.com, adsimp.com and sync-pixel.com.
adsimp.comandsync-pixel.comdo not appear in either report.sync-pixel.comwas registered on 7 October 2026, one day before the company's IAB registration was removed and eight days before the reports.
Both are now on our lists, in the Trackers category.
Where are the list files?
The domains are in EZOBLOCKER's own list, published as open source under CC0 on GitHub:
- domains/trackers/adint.txt: Discover-Tech's ad, tracking and data domains.
- domains/security/adint.txt: servers linked to the spyware delivery.
The same repository has the hosts/ and adblock/ formats. Pi-hole, AdGuard Home, NextDNS and Blocky users can add these files directly. They update automatically every 6 hours. See the blocklists page for every list we use.
How do we catch companies like this earlier?
Discover-Tech had named mtrtb.com in its own public disclosure, yet most blocklists, ours included, did not have it. So every week we now read the public registries of ad-tech companies and the disclosure files those companies publish themselves. The ad and tracking domains they declare are reviewed and added to our lists. The first run added 725 rules. Companies that disappear from these registries are flagged for a closer look.
What does EZOBLOCKER do with these domains?
When an app or a web page on your phone tries to reach a domain on our lists, the DNS lookup goes, encrypted, to our servers, which give no usable answer. The ad or tracker doesn't load, and the request does not reach the company. The Trackers and Security categories are on by default.
DNS blocking has limits. A domain that isn't on our lists yet loads normally, and apps that use their own encrypted DNS can skip a DNS filter. The limits page explains this, and the protection check shows whether the categories are working in your browser.