Look up gilimp, among many other examples. There was a malicious ad which used the real gimp.org display domain but redirected to a malicious gilimp.org when clicked.