Incident reporting often needs a denominator, even when the only available number describes something adjacent to the incident. The AdFection case offers a useful example. ZoomEye can measure public web responses that contain common advertising code. Citizen Lab can describe confirmed infections at one media organization. Those figures should not be merged into a single impact claim.
Citizen Lab's report says Discover-Tech ads were used to deliver Candiru spyware to at least 45 devices at Al Jazeera in 2024 and 2025. The research also analyzed a large bidding dataset and found ads on almost 200,000 unique websites and apps during a four-month period. The confirmed victim cluster is specific. The broader delivery footprint is a measure of reach, not a count of infections.
Three layers of measurement
The first layer is delivery opportunity. This includes impressions, bids, and pages or apps where an ad could render. The second is selection. This includes requests to a NOAS server and decisions to return JavaScript to a chosen device. The third is compromise. This includes validator contact, exploit execution, spyware installation, and command-and-control activity.
External search adds a fourth layer: public observability. In this review, http.body="adsbygoogle" returned 621,764 observed web responses at 2026-11-03T15:40:52+00:00. Limiting the query to port 443 returned 274,280 at 15:42:15. The result says that ad-client markup appeared in many public responses in the selected index. It does not say that those pages used Discover-Tech, displayed a malicious creative, or had an infected visitor.
The named infrastructure tells a different story. domain="mtrtb.com" returned zero at 15:41:23, domain="discover-tech.io" returned zero at 15:41:33, and domain="powerium.net" returned zero at 15:41:53. Those are successful observations of absence in the selected index. They should be reported with the same precision as positive counts.
Make the denominator explicit
A count is useful when the unit and scope are clear. "Web responses containing a string" is a different unit from "unique domains," "users," "devices," "ad impressions," and "confirmed infections." The query time and asset scope are part of the result. A later analyst should be able to reproduce the search and understand why a new count differs.
For a management summary, pair every number with its limit. For example: "Public search found 621,764 web responses containing an ad-client marker. This establishes a broad advertising surface, not a victim population." For the confirmed incident: "The primary report documents at least 45 targeted Al Jazeera devices." The two statements can sit together because they answer different questions.
Avoid smoothing uncertainty
The AdFection investigation is strong, but the public record still leaves gaps. The full exploit chain was not disclosed in every detail. The number of victims beyond Al Jazeera is unknown. The exact relationship between every observed ad and every later connection depends on logs that most organizations do not have. A report should say this rather than filling the gaps with an estimate.
It is also possible to overcorrect. A confirmed infection is not made hypothetical because other counts are uncertain. The right approach is to use the strongest available evidence for each claim. Citizen Lab's network logs and implant analysis support the Al Jazeera finding. A ZoomEye count supports a statement about public web exposure. Neither source should be asked to prove the other's conclusion.
A reusable reporting pattern
Use a short evidence table with four columns: claim, source, measurement, and limit. Then write the narrative from the table. For a public exposure count, include the dork and timestamp. For a victim count, cite the primary investigation. For an inference, label it as an inference and explain the missing evidence.
This pattern makes reports more stable when new data appears. A changed search result can be compared with the dated baseline. A revised victim count can be attributed to a new source. Stakeholders can see which decisions depend on confirmed compromise and which depend only on exposure.
The result is less dramatic than a blended total, and far more useful. In an adtech spyware case, the difference between a page, an impression, a selected device, and an infected device is the core of the story.