Public takedowns can reduce an operation's reach without leaving every host offline at the same time. Domains may remain resolvable, old certificates may persist, or a service may move to another front end. The Discover-Tech case offers a reason to monitor the gap between an enforcement announcement and the disappearance of observable infrastructure.
Citizen Lab reported that Google and IAB Europe removed Discover-Tech from vendor lists in early October 2026, while Beeswax terminated access, Vungle paused access for a review, and Eskimi blocked accounts and domains. The report also lists general Discover-Tech domains, several NOAS servers, Candiru validator names, and command-and-control names. It describes the evidence as historical activity observed during the investigation.
Those actions are important. They do not convert every reported host into a permanent indicator or every absence into proof of cleanup. A monitoring plan should track both cases and preserve the time of each observation.
Observe the current surface
A public search at 2026-11-03 found no current matches for several named domains. domain="mtrtb.com" returned zero at 15:41:23, http.body="mtrtb.com" returned zero at 15:41:43, and domain="discover-tech.io" returned zero at 15:41:33. domain="powerium.net" and http.body="powerium.net" also returned zero at 15:41:53 and 15:42:04.
These are successful queries with zero-count results. They show that the selected public index did not expose those strings at those times. They do not prove that every NOAS server is gone. The report says the servers could return nothing to unselected visitors, and a search engine's request may not resemble an eligible device.
The broader market remains visible. http.body="adsbygoogle" returned 621,764 web responses at 15:40:52, and the port 443 subset returned 274,280 at 15:42:15. That larger surface is not evidence of continuing AdFection activity. It is a baseline for understanding how commonly ad-client code appears across public pages.
Monitor relationships, not only names
A replacement domain can inherit an old role without reusing a name. Monitor certificate fields, CNAMEs, hosting names, ASNs, and page metadata that were connected to the reported operation. For example, Confiant reported a shared AWS load balancer and Wix account metadata among several properties. Those relationships can help an analyst examine a new host, but they can also produce false associations when infrastructure is shared.
Build alerts around combinations. A new domain that shares a known certificate with an ad-serving property and is contacted after an ad render is more interesting than either fact alone. A contact to a validator followed by a command channel is more meaningful than a single low-reputation domain hit. The order and context carry information.
A continuous review cycle
Run the domain inventory on a schedule that matches the risk. Record the exact query, scope, result, and error status each time. Compare changes in DNS, certificates, and public response content. Review the list after a new vendor enforcement action or after a corporate ownership change.
Keep an archive of historical positive observations. A current zero should not overwrite the evidence that a domain or relationship existed. The archive allows an analyst to explain why an old indicator still appears in a detection rule and when it stopped matching public data.
Response after a new hit
If monitoring finds a related host, do not begin with a public accusation. Check internal DNS and proxy logs, identify the device and process, and preserve the response. Determine whether the contact came from an ad, a user action, or an unrelated service. Then decide whether the host belongs in a blocklist, an alert, or a watchlist.
Citizen Lab recommends blocking targeted ads at the gateway until the industry can show that it can reliably stop AdFection-style delivery. That policy addresses the execution path directly. Infrastructure monitoring supports the policy by showing whether old or new hosts continue to appear inside the environment.
The discipline after a takedown is the same as before one: record what was observed, when, and with what scope. A current zero is useful. It is not a guarantee, and it is not a substitute for endpoint evidence.