Whoever bought the ad for syscoin.org didn't use an absolute URL and the link goes to https://thousandetherhomepage.com/syscoin.org.
I'm actually curious if you could make "dangerous ads" where a stray click from a logged in account would trigger a transaction.