Where the discover-tech campaign was observed, and on whose networks

How to read this data

This is a sample of the bid log of a commercial ad-buying account, not the complete data: each daily extract is capped at 15,000, 18,000 or 20,000 records, so volumes and counts here understate the real activity. Alongside the activity examined here, discover-tech also ran ordinary, lawful advertising, and much of this data reflects routine programmatic ad delivery. A country, institution, ISP or IP address appearing here does not on its own mean it was deliberately targeted or that anything malicious happened. Treat the patterns as leads for further investigation, not conclusions.

The reverse also holds: individual people are much harder to identify than organisations. Anyone observed on a home broadband or mobile connection shows up only as a consumer ISP, so possible individual victims are not counted in the institution figures. The number of people affected may be far larger than those tables suggest.

Key observations

Derived from the bid-level records. Each record is a bid request the buyer account acted on for a specific device/IP.

Weekly records by advertised domain

Advertised domains

share of all records

Geography

Records per country (log scale). Select a country to see which domains, campaigns and networks were involved there.

Institutions

Organisations identified from the network-owner name attached to each IP, grouped into sectors by keyword. Consumer ISPs, hosting and VPN providers are excluded here and covered under ISPs. Individuals observed on those networks cannot be identified from this data and are not counted. Every institution was checked against its registry record and reverse DNS. Charts and counts use only verified and mixed entries; the table shows all of them with the result.

Records by sector

verified + mixed · click to filter

Most consistently observed institutions

days seen out of

Targeting per ISP

Every IP resolved to its origin AS through Team Cymru bulk whois (one lookup per /24, the smallest globally routed IPv4 prefix). Networks tagged Hosting/VPN carry of resolved records. Server space rented out behind a telecom's AS (for example EDIS servers announced by Synapsecom) cannot be told apart this way.

Top 20 networks

Concentration

Campaigns

Campaign names as configured in the buyer account. The bar shows each campaign's active window within the observation period.

Method

How this was built

daily JSON extracts were parsed in full. Null placeholder rows were dropped.
Domains were normalised (scheme, www. and trailing slashes removed).
All distinct /24 prefixes were resolved to origin ASN, BGP prefix and AS name with Team Cymru bulk whois.
The addresses seen on 60+ days were looked up individually in the authoritative RIR RDAP service for netname, range and registrant.
Institutions come from the per-IP organisation name in the records, sector-tagged with keyword rules. The rules are conservative and favour precision over recall.
Adversarial check: every headline figure was recomputed from the raw files with separate code and matched exactly. Each institution's most persistent IP was looked up in RDAP and reverse DNS and graded Verified, Mixed (the organisation's network also serves residents, students or guests), Public ISP or Unverified. Networks were tagged Hosting/VPN by AS and organisation name.

Caveats

The account also ran legitimate advertising. Inclusion in this dataset is not evidence of malicious intent toward any country, organisation or address.
Only organisations that own their own network block can be named. Individual victims on residential or mobile connections are much harder to find and are not counted, so institution figures understate who may have been affected.
Records are bid events, not confirmed ad views. Wins and impressions are a small subset.
Presence in the data shows the campaign was observed on a network. It does not prove the network was named in a targeting list. Repetition over many days is the stronger signal.
Yandex records carry /24-truncated IPs, so per-host persistence can only be measured on other exchanges.
records have no IP at all and are counted under “unresolved”.
The dataset is a sample, not the complete log. Every daily extract is capped at exactly 15,000, 18,000 or 20,000 rows, so absolute volumes, IP counts and days-seen figures are lower bounds. Relative comparisons are indicative only.