AdNow tracking code on Eastern European websites sent Romanian browser and click data to Russian-linked servers in Novosibirsk, according to a five-month investigation published in September 2026 by Snoop and CheckFirst. The same advertising network paid the publishers that supplied the readers’ attention, including conspiracy and far-right sites.
The arrangement was straightforward: a reader opened a page, the page loaded an ad, and code inside that ad recorded details about the reader’s browser before sending them elsewhere. The investigators say this happened even when their test browsers had refused consent for tracking. They monitored more than 100,000 ads on 1,145 webpages across 131 Eastern European sites.
How AdNow’s pixels built and exported browser profiles
A tracking pixel is usually a tiny, invisible request made when a page or advertisement loads. It can tell an ad network that a particular browser visited a particular page. In this case, Snoop and CheckFirst report that AdNow’s code assembled a browser fingerprint from device and browser properties, connected it to identifiers created by the website, and sent Facebook’s fbclid referral identifier when a visitor arrived through Facebook. The reported traffic reached servers registered in Russia, including infrastructure associated with Novosibirsk.
Those identifiers did not themselves reveal a visitor’s name, the investigation says. But they could link multiple visits, referrals and apparent interests to the same browser, the useful unit in behavioural advertising, and in surveillance systems built from browsing history.
“Such databases serve purposes far beyond advertising: they can become tools for surveillance and behavioral manipulation when they end up in the hands of authoritarian states,” CheckFirst wrote.
The investigation used custom software and HAR files, browser network logs that record requests made as a webpage loads, to follow the ad calls after a page displayed advertising. Its core technical claims are investigators’ findings, not a completed regulator ruling. Still, the work is unusually concrete: it follows the requests made by the browser rather than inferring collection from an ad network’s privacy policy.
Snoop says it cannot determine how many Romanian people were ultimately identified or profiled. That unknown is not a minor accounting gap. A fingerprinting system becomes more useful as it appears across more sites and over more visits, while the people being followed generally see only an ad slot.
The reporting also places the technical pipeline in a longer corporate dispute. AdNow’s Bulgarian operator had previously said it had no Russian connections after moving its headquarters in 2021, while Snoop reported evidence it says conflicts with that account. Snoop reports that 79 Romanian publications have carried AdNow advertising or trackers during the past decade.
In May, IAB Europe removed AdNow from its centralized real-time-bidding system, the machinery that lets advertisers bid automatically for a reader’s attention. Snoop dates that removal to May 25, 2026, and reports that AdNow stopped using that channel in Romania and the EU but continued serving ads through undeclared servers, including nnowa.com. AdNow is currently absent from the IAB Europe vendor list; the reported removal date and continued routing are Snoop’s account.
Ad revenue on conspiracy and extremist sites
The other half of the investigation is why this traffic was worth collecting. Snoop found the IAB25-5 hate-content classification in AdNow’s ad code and reported that placements on conspiratorial and extremist sites were among the network’s highest-valued inventory.
That code matters because programmatic ads do not merely buy space on a page; they buy a type of reader. A classification attached to a page can help place readers into an audience bucket, allowing advertisers and intermediaries to price attention differently. Here, the system appears to have made readers of hate- and conspiracy-adjacent material commercially valuable while the publishers received the resulting payments.
That financial incentive has a paper trail. Snoop’s earlier examination of Romanian tax-authority records identified at least €2 million in AdNow payments between 2016 and 2024 to Romanian television sites, conspiracy influencers and far-right publications. The figure is a floor, not a complete ledger: it covers payments the tax authority records allowed Snoop to identify.
This is the same basic business logic behind advertising revenue around right-wing content: divisive publishers do not need to be an accidental by-product of the ad market when their audience is the product being priced. The difference here is that the investigation traces both sides of the exchange, reader data moving toward Russian-linked infrastructure, and money moving back to the sites where that data was gathered.
It also sits beside a wider pattern in which tracking infrastructure and advertising machinery become conduits for risks users did not sign up for, from cross-platform tracking of sensitive user data to deceptive social-media ads. The ad shown to a reader is the visible part of the transaction. The browser requests, identifiers and payments are where the arrangement says what it is for.
CheckFirst says its findings on two other Russian-origin ad-tech companies, MGID and AdsKeeper, will be published separately. For AdNow, the record already describes a loop: publishers supplied a receptive audience, tracking code extracted the audience’s browsing signals, and ad money rewarded the publishers for keeping that loop running.
Key Takeaways
- Snoop and CheckFirst reported that AdNow tracking traffic from monitored Eastern European sites reached Russian-linked servers associated with Novosibirsk.
- The investigation tracked more than 100,000 ads across 1,145 webpages on 131 websites over five months.
- AdNow’s code reportedly combined browser fingerprints, site identifiers and Facebook referral identifiers to correlate browser visits.
- Snoop identified at least €2 million in AdNow payments to Romanian media sites, conspiracy influencers and far-right publications between 2016 and 2024.
- CheckFirst’s current investigation concerns AdNow; its findings on MGID and AdsKeeper are pending separate publication.
Further Reading
- The Kremlin’s Digital Pirates: How Russian Tracking Pixels Harvest Romanians’ Data, CheckFirst’s account of the joint technical investigation and its scope.
- The Kremlin’s Digital Pirates: How Russian Tracking Pixels Harvest Romanians’ Data, Snoop’s full reporting on AdNow’s tracking flow, classifications and publisher economics.
- Pe urmele banilor din reclamele rusești, Snoop’s earlier investigation into AdNow’s contracts, routing and claimed relocation.
- Investigație Snoop: Milioane de euro direcționate de o companie de advertising, HotNews reporting on the financial records behind AdNow’s Romanian payments.