Google Ad Disguising Itself as www.gimp.org • Hacker News Board

Re: Google Ad Disguising Itself as www.gimp.org

#131

Post by mcv » Sat, Oct 29, 2022, 8:58 PM UTC

hedora wrote: post #64

In this particular case, I suspect a trademark complaint against Google would make sense. Google misrepresented the ad as the product of the Gimp project, and were paid as a result. They usually use an "obeying the law would not scale" type argument in court, but that would clearly be bullshit in this case. They have a business relationship with the ad buyer, and should have verified their affiliation with gimp.org.…

Having the actual url be completely different from the displayed url simply shouldn't be possible. Allowing that invites scams like these. At the very least, they need to be the same domain.

Re: Google Ad Disguising Itself as www.gimp.org

#132

Post by grapehut » Sat, Oct 29, 2022, 8:58 PM UTC

This is a particularly egregious case, I've never seen a fake domain slip through like that before.

However, I have reported dozens of phishing sites for the company I worked for. The phisher would simply buy ads for $BRANDNAME and create a convincingly similar site and phish users. I would report the website to "safebrowsing" and report the ad. Typically it would take 1 to 3 days for the website and/or ad to be removed, which would give them enough time to do countless damage. Then they would simply register a new domain, and repeat.

At some point the only thing you can do is outbid phishing sites for your own brandname?!

It's a shame google can not self-regulate such evil behavior, but it's clear that it should be illegal for google to allow people to buy ads on brandname searches.

Re: Google Ad Disguising Itself as www.gimp.org

#133

Post by mcv » Sat, Oct 29, 2022, 9:02 PM UTC

kevincox wrote: post #20

captainmuon wrote: post #7

How is it even possible to spoof the shown URL?

It's just a setting in Google AdWords. The display URL and target URL are not related. You can also play tricks like a "tracking URL template" that is a URL that can be on another domain and receives the "target URL" as a parameter. It is expected to redirect to the correct URL, of course nothing enforces this other than a manual review. I can't believe that Google allows this but tracking is clearly more important t…

They should not allow this. At the very least, the actual and the displayed url need to be on the same domain, and preferably the displayed url needs to be a substring of the actual url. That way they can still pass parameters for all sorts of statistics.

Re: Google Ad Disguising Itself as www.gimp.org

#134

Post by amelius » Sat, Oct 29, 2022, 9:02 PM UTC

hedora wrote: post #64

In this particular case, I suspect a trademark complaint against Google would make sense. Google misrepresented the ad as the product of the Gimp project, and were paid as a result. They usually use an "obeying the law would not scale" type argument in court, but that would clearly be bullshit in this case. They have a business relationship with the ad buyer, and should have verified their affiliation with gimp.org.…

How much money should they bring to successfully fight this case?

Re: Google Ad Disguising Itself as www.gimp.org

#135

Post by amelius » Sat, Oct 29, 2022, 9:05 PM UTC

tpxl wrote: post #122

birken wrote: post #77

> dig +short gimp.monster 194.110.203.75 > whois 194.110.203.75 ... role: IT Resheniya LLC nic-hdl: ITR30-RIPE address: ul. Novoselov, d. 8A, of. 692 address: 193079 Saint Petersburg address: Russia abuse-mailbox: abuse@rentaserv.su ...

Rentaserv.su is a hosting company, there's probably dozens of websites on that IP.

Yes, Russian websites.

Re: Google Ad Disguising Itself as www.gimp.org

#136

Post by albedoa » Sat, Oct 29, 2022, 9:09 PM UTC

tantalor wrote: post #115

thethethethe wrote: post #9

Earlier quoted context omitted.

I just tried it and now it is 'gilimp.org' The site looks legit

What do you mean it looks legit? You think "gilimp.org" is legit website for gimp??

I read that comment as "the site [does a convincing job of looking] legit". Hopefully it was just worded poorly!

Re: Google Ad Disguising Itself as www.gimp.org

#137

Post by ISL » Sat, Oct 29, 2022, 9:16 PM UTC

Nextgrid wrote: post #124

MereInterest wrote: post #113

Earlier quoted context omitted.

It may be true, but why a judge or jury would accept it as justification is beyond me. "My business model requires me to break the law." is a condemnation of the business model, not a justification.

The problem is that the legal system is flawed in such a way that the wronged parties rarely have the time & resources needed to actually put the issue in front of a judge. If it actually does get in front of a judge (in reality it would get settled out of court if it actually gets anywhere close) I would indeed expect their argument to fall apart. This is something that ideally the government (its consumer protectio…

Agreed -- there's also little recourse for many forms of online fraud, as there's no capacity for law-enforcement to investigate at scale.

Re: Google Ad Disguising Itself as www.gimp.org

#138

Post by dna_polymerase » Sat, Oct 29, 2022, 9:26 PM UTC

lolinder wrote: post #27

dehrmann wrote: post #22

Remind me why Google even allows ads in rank 1 on brand terms? I remember when "don't be evil" Google would talk about how ads are in a different color on the right sidebar.

Not only do they allow it, they actively encourage it. They tell businesses that it's really important to buy ad space on searches for your own brand name so that a competitor doesn't. The way they say it really comes off like a protection racket. "Nice number one spot for searches for your brand name you have there, would be a shame if anything were to happen to it." They make people feel better about it by giving a…

Experienced this as someone doing ads for SMBs. The Google advisers call and after messing up the configs for your campaign (to your disadvantage that is) they advise you to include your brand name as keyword. No matter that 3 out 3 Top results are already for your company.

Re: Google Ad Disguising Itself as www.gimp.org

#139

Post by RamRodification » Sat, Oct 29, 2022, 9:51 PM UTC

mcv wrote: post #131

hedora wrote: post #64

In this particular case, I suspect a trademark complaint against Google would make sense. Google misrepresented the ad as the product of the Gimp project, and were paid as a result. They usually use an "obeying the law would not scale" type argument in court, but that would clearly be bullshit in this case. They have a business relationship with the ad buyer, and should have verified their affiliation with gimp.org.…

Having the actual url be completely different from the displayed url simply shouldn't be possible. Allowing that invites scams like these. At the very least, they need to be the same domain.

Yes! This is crazy to me. How can this not be a thing that has already been discovered and instantly fixed?

Re: Google Ad Disguising Itself as www.gimp.org

#140

Post by echelon » Sat, Oct 29, 2022, 9:53 PM UTC

hedora wrote: post #64

In this particular case, I suspect a trademark complaint against Google would make sense. Google misrepresented the ad as the product of the Gimp project, and were paid as a result. They usually use an "obeying the law would not scale" type argument in court, but that would clearly be bullshit in this case. They have a business relationship with the ad buyer, and should have verified their affiliation with gimp.org.…

All ad companies need to respect trademarks and allow opt-out of reserved terms as a first class feature.

It's disgusting that a competitor can buy an ad for your brand on Google, Apple, etc. and place their result before yours. This is especially harmful for new, up-and-coming companies.

I've had competitors buy ads in our name before. It's a shameful tactic.

It's beyond unfair when these monopoly-like ad companies spent hundreds of billions to co-opt the web and personal mobile computing and shackle us to this fate. It's the nightmare Microsoft and AOL once envisioned, yet now it's actually come to pass.

We already pay for domains and trademarks. We shouldn't have to keep paying protection money to defend ourselves when we're already having to jump through the platforms' obtuse rules and pay their outrageous taxes.

Trademarks should be sacred, and no company should be able to profit off of yours.