My guess is that they're getting "other Google affiliates". What happens is a "publisher" combines CSE with Adsense then drives (often robotic) traffic to the

My guess is that they're getting "other Google affiliates". What happens is a "publisher" combines CSE with Adsense then drives (often robotic) traffic to the ads that come back in the feed. They then identify high-paying keywords and make money. Sophisticated attackers will observe that Google cares if the IP address matches the CSE request, but they don't care if the cookie and IP make sense (or if that cookie is being used elsewhere in the world). This means a sneaky extension can lift the (advertising) cookies of Google users elsewhere in the world and deliver them to places (e.g. Turkey) where it is convenient to run the click farm.