5 ms·
I can't get the ad to show up for me, but maybe GIMP has an open redirect on their website and the malvertiser is taking advantage of that?
by cmeacham98 4y ago
I can't get the ad to show up for me, but maybe GIMP has an open redirect on their website and the malvertiser is taking advantage of that?
- hddqsb 4y agoThat's what I thought too, but I managed to get the malicious ad and confirmed that it's a destination mismatch in Google Ads rather than an open redirect (no requests to gimp.org in the network monitor).
- cuttysnark 4y agoI had to search for "gimp.org" to get the ad to be the first result; just searching "gimp" doesn't return the ad. The scam ad says "gimp.org" but if you follow it, the landing page is hosted at gimp.monster. It's a clone of the proper gimp.org with a the download instead pointing to who-knows-what .exe on Dropbox. WHOIS gimp.monster has WHOIS-guard, but the Icelandic "privacy" address turns up a bunch of Reddit links about scam sites. Namecheap is the common thread, but that's hardly a lead.