I created a tool that automatically follows ads to try to find scams.
But that was usually reserved to typosquat domain ads or ads on porn websites. I didn't know scammers used normal page ads too.
I know tech support scams used to use google search ads, but I don't think they do that as much anymore, so maybe they have moved onto things like adsense.
These scammers usually do IP address checks to check for residential IP before showing the scam, and some also do some basic fingerprinting checks, so that is how they get past detection. That said, it shouldn't be too difficult for google to do some better checks if they actually cared.
Google is absolutely smart enough to make these attacks un-economical. IMO they are unwilling to incur the loss in revenue this would involve (false positives, banned resellers etc).
As a result, even though "Enhanced" safe browsing can use Gemini Nano to do client side detection of scams and then flag it in google safe browsing for everyone, the entire domain and all subdomains are whitelisted, so that detection never seems to actually fire. https://blog.google/security/using-ai-to-stop-tech-support-s...
I'm not sure which domains this applies to, but it seems to apply to most of the domains that these scammers actually like to use.
Same issue with spam sms in my country: I think they geo-locate it so submitting the link to safe browsing project takes way too long