Crazily enough, the domain shown under the ad on google ads isn't automatically pulled. You can set it manually. Attackers exploit this by first using a genuin

Crazily enough, the domain shown under the ad on google ads isn't automatically pulled. You can set it manually. Attackers exploit this by first using a genuine domain to get the ad approved, and then altering the info after the campaign starts. I saw a similar attack like this on twitter a month or so ago.