Watching for AdFection infrastructure after the takedowns

Public takedowns can reduce an operation's reach without leaving every host offline simultaneously. Domains may persist, old certificates may remain, or a service might move to another front end. The Discover-Tech case highlights the importance of monitoring the gap between an enforcement announcement and the disappearance of observable infrastructure.

Following the takedown, companies like Google, IAB Europe, Beeswax, Vungle, and Eskimi removed or paused access to various Discover-Tech domains, NOAS servers, validator names, and command-and-control names. However, the evidence is historical and does not guarantee every host has been cleaned up.

To effectively monitor, track both the presence and absence of reported hosts, preserving the time of each observation. For instance, a public search on November 3, 2026, found no current matches for several named domains. While these results suggest those specific domains are no longer active, they do not prove the complete disappearance of NOAS servers. The broader internet remains active, with a significant baseline of ad-client code appearing across public pages.

Instead of focusing solely on domain names, monitor relationships such as certificate fields, CNAMEs, hosting names, ASNs, and page metadata associated with the reported operation. For example, Confiant noted shared AWS load balancers and Wix account metadata among several properties. These relationships can help analysts analyze new hosts, though they can also lead to false associations when infrastructure is shared. Build alerts around combinations of these factors for more meaningful insights.

Implement a continuous review cycle, running the domain inventory on a schedule that matches the risk level. Record the exact query, scope, result, and error status each time, and compare changes in DNS, certificates, and public response content. After new enforcement actions or corporate ownership changes, review the list. Keep an archive of historical positive observations to maintain evidence of past indicators. A current zero result should not overwrite this evidence.

Upon discovering a related host during monitoring, do not immediately make public accusations. First, investigate internal DNS and proxy logs to identify the device and process. Understand whether the contact originated from an ad, user action, or unrelated service. Determine if the host should be added to a blocklist, alert, or watchlist.

According to Citizen Lab, blocking targeted ads at the gateway is a recommended policy until the industry can reliably stop AdFection-style delivery. Infrastructure monitoring complements this policy by indicating whether old or new hosts continue to appear in the environment. Regardless of previous takedowns, the standard practice remains: record observations meticulously, noting when and with what scope.