6 ms·
EDIT: There is definitely a mismatch between the display URL and the landing page URL. It's not clear to me how that can happen; for example https://www.youtube
by hddqsb 4y ago
EDIT: There is definitely a mismatch between the display URL and the landing page URL. It's not clear to me how that can happen; for example https://www.youtube.com/watch?v=jx-gl6K2zQw https://www.youtube.com/watch?v=jx-gl6K2zQw shows that only the display path can be edited (not the domain), consistently with the wording on https://support.google.com/google-ads/answer/2616010 https://support.google.com/google-ads/answer/2616010 and https://support.google.com/google-ads/answer/2375287 https://support.google.com/google-ads/answer/2375287. On the other hand, https://support.google.com/adspolicy/answer/6368661 https://support.google.com/adspolicy/answer/6368661 talks about destination mismatch as if it is technically possible and just forbidden by policy.
The ad's ID is DChcSEwiPvfuL-YX7AhVmkmYCHUXQC1wYABAAGgJzbQ (displayed when reporting it), the display URL is https://www.gimp.org/ https://www.gimp.org/ and the final location after clicking the ad is https[:]//gilimp[.]org/ (with no intermediate redirects via gimp.org).
Update: The DNS records for gilimp.org have been deleted. Archived snapshot: https://web.archive.org/web/20221029152445/https://gilimp.org/ https://web.archive.org/web/20221029152445/https://gilimp.or....
-------------
Original comment:
The Reddit user says the ad's display URL was different from landing page URL. If that's the case it is particularly concerning. I believe Google Ads only allows the advertiser to set the path component of the display URL, and takes the domain from the landing page (real) URL; so it's unclear how the mismatch could happen.
Maybe the Reddit user took the screenshot on a separate occasion from when they clicked the malicious link, and the ad changed in that time (currently I can see an ad for GIMP, and it links to the official domain, and the linked Twitter thread linked by @pmoriarty says the attacker is actively changing things). The only other explanation I can think of is that the official GIMP website has an open redirect vulnerability.
- weird-eye-issue 4y agoYou can just set any URL you want
- austinpena 4y agoYou can’t set the domain. Just the path.
- weird-eye-issue 4y agoHave you run Google Ads before?
- austinpena 4y agoI run Google Ads for a living.
- hddqsb 4y agoDo you know how that can be done? Based on the video https://www.youtube.com/watch?v=jx-gl6K2zQw https://www.youtube.com/watch?v=jx-gl6K2zQw it looks like only the display path can be edited (not the domain).
- anilshanbhag 4y agoJust tested, you can still see this Ad if you search for gimp!
- bink 4y agoI don't see any ad when I search for "gimp". Maybe it's only targeting Windows users? edit: nevermind. I was being saved by ublock origin. Searching with it disabled shows the malicious ad.
- cmeacham98 4y agoI can't get the ad to show up for me, but maybe GIMP has an open redirect on their website and the malvertiser is taking advantage of that?
- hddqsb 4y agoThat's what I thought too, but I managed to get the malicious ad and confirmed that it's a destination mismatch in Google Ads rather than an open redirect (no requests to gimp.org in the network monitor).
- cuttysnark 4y agoI had to search for "gimp.org" to get the ad to be the first result; just searching "gimp" doesn't return the ad. The scam ad says "gimp.org" but if you follow it, the landing page is hosted at gimp.monster. It's a clone of the proper gimp.org with a the download instead pointing to who-knows-what .exe on Dropbox. WHOIS gimp.monster has WHOIS-guard, but the Icelandic "privacy" address turns up a bunch of Reddit links about scam sites. Namecheap is the common thread, but that's hardly a lead.
- ocdtrekkie 4y agoYeah Google Ads lies about the destination URL, it always has. Which is why the correct choice is to consider Google Ad links malicious by default. There's actually no way to be sure where clicking them will send you, and tons of fraudsters have put scam ads with the official legit domain listed. I've seen both Amazon and Best Buy URLs on scam ads.
- systemvoltage 4y agoThe entire hackjacking of the URLs needs to stop. It is destroying the web. From Safari hiding the full path in the browser in the name of "minimalism" to AMP and all the other bullshit. URLs are sacred. Please don't fuck with them. Please.
- deleted 4y ago[deleted]
- eyelidlessness 4y ago> From Safari hiding the full path in the browser in the name of "minimalism" That was never the intent of hiding the path, it was and is to help users identify what a site’s domain actually is. To distinguish malicious sites with recognizable domain-like strings in/overlapping their paths as well as malicious sites with recognizable domains as subdomains. It’s not a panacea, but it’s effective. Chrome (and IIRC Firefox) also experimented with similar approaches before ultimately splitting the difference with higher contrast text for the domain.
- dustymcp 4y agoThis is possible with all advertiser platforms, they dont validate for your domain and will happily link to any domain.
- hddqsb 4y agoJust to avoid no confusion, the issue here is that the URL displayed in the ad (and also when hovering over it) has a different domain from the page the user lands on when they actually click the ad. It's not about whether the advertiser owns the domain.
- hddqsb 4y agoUpdate: It used to be possible to set the Display URL field to an arbitrary value, see for example https://www.youtube.com/watch?v=AQFR8eJlYxQ&t=100 https://www.youtube.com/watch?v=AQFR8eJlYxQ&t=100 (2015). Maybe it's still possible somehow.