Why I Turned Off Google AdSense

August 5, 2026, 12:43 pm

In 2006, inspired by the recent movie and the launch of the JavaScript Google Maps API, I started working on a project to map the events of the Patrick O'Brian Aubrey/Maturin novels. At the time I thought using Google AdSense which had launched a few years earlier would help support the running costs of the site.

Over the years, as those fairly innocuous text ads evolved into image display ads and then animated ads, I have pushed back over pretty constant suggestions to "optimize" the placement and propagation of ads on my site. I have, however, continued to maintain a 200x200 AdSense square on the top right corner of my site.

To be clear, I’m not opposed to advertising on principle. I actually like a good targeted ad. I appreciate being introduced to a product I am actually interested in.

What I don’t appreciate are ads that are designed to scam people. This is particularly true when the audience is on my personal website. Unfortunately this seems to be unavoidable on the AdSense platform.

Here are a couple of examples of a class of malicious ads I have discovered on my personal site every day for the last week or so. The ad copy is minimal, “continue (or c0ntinue) to our site”. Both ads linked to blatantly "Scareware" sites (following a redirect from a sketchy, but not explicitly malicious placeholder site). I found multiple examples of this attack over many days and served from a variety of destination domains (more on that later), but these two illustrate the Apple and Microsoft flavoured versions:

Implementation of this kind of Scareware isn’t something I have ever looked at closely before. It’s nasty and not very clever:

• Fake scan results - animated counters, no actual scanning happens.

  <h2 data-speed="5000" data-to="51900">51,900</h2> <!-- "objects scanned" -->
  <h2 data-speed="2500" data-to="1200">1,200</h2>   <!-- "threats found" -->

• Tries to block the back/close button

  window.addEventListener("beforeunload", function (e) {
      e.returnValue = "It looks like you are editing something...";
  });

• Attempts to reopen itself when closed

  window.addEventListener('unload', function () {
    window.open(window.location.href, '_blank');
    setTimeout(() => window.location.href = window.location.href, 1);
  });

• Tries to freeze the tab with a Web Worker spam loop

  for (let i = 0; i < 1000000000000; i++) {
    const worker = new Worker(workerURL); // infinite while(true) loop inside
  }

• Abuses legitimate SaaS for credibility/functionality - Tawk.to live chat embedded so scammers can talk to victims.

• noindex,nofollow - tries to stay invisible to search/crawlers since it serves entirely on ad-redirect traffic.

• Looping alarm sound - retriggered every 500ms so it can't finish and fade out, plus a beep fired on every click to reinforce urgency.

  setInterval(function() {
    document.getElementById("infogt").play()
  }, 500);
  
  function beep1() {
    document.getElementById("mdchys").play();
  }




It's designed to frighten people into exposing themselves to fraud and theft and it makes me pretty angry. The Internet is a wretched hive of scum and villainy (apart from all the nice parts) so the fact that this attack exists isn't surprising. The surprising, and deeply disappointing, thing is that Google's tolerance for it isn't low enough to make it uneconomical for the attacker.

When I first discovered these ads on the network I began thinking about possible technical solutions. It did not take long to realise that, given Google’s vast resources, it was unlikely that any of my ideas hadn't already been considered, rejected or adopted. It also occurred to me that some of these measures could reduce advertising revenue through false positives or the broad exclusion of resellers whose networks contain a proportion of bad actors. Those effects, together with the cost of implementation, would inevitably influence any decision about how much to spend removing such actors from the network.

I'm not suggesting Google isn't motivated to keep these bad actors off their network. They certainly are. What I am suggesting is that there is a minimum level of malicious advertising that Google is unwilling to pay more to eliminate. That minimum level might be quite low, but I don't believe it's low enough.

So why not low enough? Because there is evidence in this particular attack that demonstrates it's been economically viable for the attacker not just for the few weeks I observed it, but for years. If you look carefully at the "Apple" branded site, it's impersonating the Apple support page, but it's using an icon for the "MacBook Air" that hasn't been used by Apple since 2022.

For at least four years, and probably far longer, it's been worthwhile for the criminals who operate these sites to build, support and deploy the infrastructure that's playing Whack-a-Mole with Google's compliance systems. They are profiting enough from the victims they defraud to justify that expense.

Google should spend more on making it cost prohibitive for criminals to defraud people via their ad network.

I am a realist and, recognizing my inability to influence the incentive structures of a large multinational corporation, I have instead taken the following steps:

• I have removed AdSense from my site. The thought of someone visiting my site and being deceived or frightened simply is not worth it to me. The small amount I receive from the network makes this a much simpler cost-benefit analysis for me than it might be for Google or larger publishers. I'll keep my account open and occasionally check in, out of curiosity as much as anything, to see whether the calculus ever changes.
• I have implemented an ad unit using my existing Amazon affiliate link. It displays book recommendations drawn from the reading list I have maintained since 2003.
• I wrote this blog post. I hope someone from Google reads it and starts a conversation about making this platform usable again for publishers.

Permalink - Tags: Development,Google