Comment by hddqsb | Hacker News Reader

Comment by hddqsb | Hacker News Reader

Parent Full thread

EDIT: There is definitely a mismatch between the display URL and the landing page URL. It's not clear to me how that can happen; for example https://www.youtube.com/watch?v=jx-gl6K2zQw shows that only the display path can be edited (not the domain), consistently with the wording on https://support.google.com/google-ads/answer/2616010 and https://support.google.com/google-ads/answer/2375287. On the other hand, https://support.google.com/adspolicy/answer/6368661 talks about destination mismatch as if it is technically possible and just forbidden by policy.

The ad's ID is DChcSEwiPvfuL-YX7AhVmkmYCHUXQC1wYABAAGgJzbQ (displayed when reporting it), the display URL is https://www.gimp.org/ and the final location after clicking the ad is https[:]//gilimp[.]org/ (with no intermediate redirects via gimp.org).

Update: The DNS records for gilimp.org have been deleted. Archived snapshot: https://web.archive.org/web/20221029152445/https://gilimp.or....

-------------

Original comment:

The Reddit user says the ad's display URL was different from landing page URL. If that's the case it is particularly concerning. I believe Google Ads only allows the advertiser to set the path component of the display URL, and takes the domain from the landing page (real) URL; so it's unclear how the mismatch could happen.

Maybe the Reddit user took the screenshot on a separate occasion from when they clicked the malicious link, and the ad changed in that time (currently I can see an ad for GIMP, and it links to the official domain, and the linked Twitter thread linked by @pmoriarty says the attacker is actively changing things). The only other explanation I can think of is that the official GIMP website has an open redirect vulnerability.

Yeah Google Ads lies about the destination URL, it always has. Which is why the correct choice is to consider Google Ad links malicious by default. There's actually no way to be sure where clicking them will send you, and tons of fraudsters have put scam ads with the official legit domain listed.

I've seen both Amazon and Best Buy URLs on scam ads.

The entire hackjacking of the URLs needs to stop. It is destroying the web. From Safari hiding the full path in the browser in the name of "minimalism" to AMP and all the other bullshit.

URLs are sacred. Please don't fuck with them. Please.

> From Safari hiding the full path in the browser in the name of "minimalism"

That was never the intent of hiding the path, it was and is to help users identify what a site’s domain actually is. To distinguish malicious sites with recognizable domain-like strings in/overlapping their paths as well as malicious sites with recognizable domains as subdomains. It’s not a panacea, but it’s effective. Chrome (and IIRC Firefox) also experimented with similar approaches before ultimately splitting the difference with higher contrast text for the domain.

This is possible with all advertiser platforms, they dont validate for your domain and will happily link to any domain.

Just to avoid no confusion, the issue here is that the URL displayed in the ad (and also when hovering over it) has a different domain from the page the user lands on when they actually click the ad. It's not about whether the advertiser owns the domain.

Assuming you meant "just to avoid any confusion" :)

I can't get the ad to show up for me, but maybe GIMP has an open redirect on their website and the malvertiser is taking advantage of that?

That's what I thought too, but I managed to get the malicious ad and confirmed that it's a destination mismatch in Google Ads rather than an open redirect (no requests to gimp.org in the network monitor).

I had to search for "gimp.org" to get the ad to be the first result; just searching "gimp" doesn't return the ad.

The scam ad says "gimp.org" but if you follow it, the landing page is hosted at gimp.monster. It's a clone of the proper gimp.org with a the download instead pointing to who-knows-what .exe on Dropbox.

WHOIS gimp.monster has WHOIS-guard, but the Icelandic "privacy" address turns up a bunch of Reddit links about scam sites. Namecheap is the common thread, but that's hardly a lead.

You can just set any URL you want

Do you know how that can be done? Based on the video https://www.youtube.com/watch?v=jx-gl6K2zQw it looks like only the display path can be edited (not the domain).

You can’t set the domain. Just the path.

Have you run Google Ads before?

I run Google Ads for a living.

Update: It used to be possible to set the Display URL field to an arbitrary value, see for example https://www.youtube.com/watch?v=AQFR8eJlYxQ&t=100 (2015). Maybe it's still possible somehow.

Just tested, you can still see this Ad if you search for gimp!

I don't see any ad when I search for "gimp". Maybe it's only targeting Windows users?

edit: nevermind. I was being saved by ublock origin. Searching with it disabled shows the malicious ad.

Reply on news.ycombinator.com