Google keeps phishing ad after being reported
Yesterday I almost installed a download from a phishing site if it hadn’t been for Chrome to block the download and mark it as suspicious.
I wanted to download PostgreSQL on my mac. I googled "install postgresql" and then click on the official PostgreSQL site. I was undecided about whether to install it via Homebrew or by downloading the app itself. I closed the tab and then I decided to download the PostgreSQL app. I quickly typed 'download postgres' and I clicked without looking on the first Google result. Again, I clicked download without looking, assuming it was the official site. Then Chrome warned me that the download was suspicious.
When I checked the website url, it was posfgresql.com instead of postgresql.com... I was in shock... I knew about phishing ads on Google, but I didn’t think it would happen to me.
I reported the ad to Google and the domain to Cloudflare (many phishing sites route through Cloudflare, likely because of the ease of setting up HTTPS).
Today, I received a response from Google stating:
Dear Alexandru,
We’re writing to let you know that we reviewed your report (ID 9-7817000036510).
Here's what we found
We decided not to take this ad down. We found that the ad doesn’t go against Google’s policies, which prohibit certain content and practices that we believe to be harmful to users and the overall online ecosystem.
I was in shock again. How is this possible to promote phishing ads and not even remove them after being reported? It is that hard to check the url redirect?
I checked the advertiser's page and all their ads are phishing urls...
Here's the advertiser's link:
https://adstransparency.google.com/advertiser/AR10215658740934246401 Too bad you can't see where the ads point to. postgres https://adstransparency.google.com/advertiser/AR102156587409... proxyman https://adstransparency.google.com/advertiser/AR102156587409... tunnelblick https://adstransparency.google.com/advertiser/AR102156587409... openvpn https://adstransparency.google.com/advertiser/AR102156587409... They appear to doing malware stuffing. Would love to see someone analyze those binaries. Google has failed to address malicious ads and continue serving inline with normal search results. Users are forced to protect themselves with ad blockers so they won’t be exposed to and possibly fooled by malicious ads.
Now they are punishing users who use ad blockers. Google, do a safety stand-down and suspend the campaign against ad blockers and suspend the practice of including paid ads inline with search results until you solve the fake ad problem. Yes, this will involve going slower and spending money on staff to review content.