How I advertise malicious software on Google Ads

xlii.space

397 points by xlii 21 hours ago


1970-01-01 - 20 hours ago

Google has forgotten the plot. A quick tangent story follows: I attempted to add a Tesla Supercharger as it went live to Google Maps. I was the very first to pay to recharge at the new location. The process went something like this:

1st time: Uploaded 4 photos, local business info, current charger prices, and GPS coordinates. Google replied this would be sent to human review. It was rejected within 6 minutes.

2nd attempt: Uploaded 6 more photos, including shots of local business hours and info, and current prices. Rejected in 6 minutes.

3rd time: One photo of a new charger, no description. Rejected in 6 minutes.

4th time: Appended all above details to local business info. It went live within a minute.

5 days later: Supercharger location was added by ??? and included no info at all and the pinpoint was off by 100m.

OptionX - 20 hours ago

Google is the worst offender, but a lot of companies are increasingly hiding themselves behind a wall of automated systems to completely neuter users ability to challenge any decision unilaterally taken by the them. The LLM-age has worsen the situation but it started well before it.

At some point it may be necessary to add the requirement for large companies to have a both human contact point and perhaps a requirement for specifics on account terminations and the like, or at least a way to request them, to the letter of the law.

Toutouxc - 20 hours ago

That’s surprising, because in my opinion Google doesn’t care about malicious anything. The other day I had to look for something on YouTube on my dad’s computer with a disabled ad-blocker. I saw like 30 ads in 15 minutes, every single one of them was a scam, literally not a single non-fraudulent ad. Google is full cartoon villain evil at this point.

xlii - 19 hours ago

I made an update, but I'll post also here in comments. It seems that either a human read it or it triggered some trigger, but my account has been reinstated. Thank you, also those who made this issue visible.

On one side I'm happy it happened, on the other, it's a shame that it took complaining on the internet amplified by HackerNews to get this problem fixed...

huhtenberg - 20 hours ago

We had that, almost a decade ago.

The cause was that the site was in fact compromised and at a certain very discreet URL it hosted a bunch of pages for legit products that linked to external shady sites. They got in through some PHP hole. Got lucky they didn't do more damage. However as per various Google pages and dashboards no issues were present except being tagged as a malware distribution site.

The remedy was to audit the site, clean it up and then re-submit the appeal. Got the tag cleared in a couple hours.

mcast - 19 hours ago

When you search "us passport" or "tsa precheck" on Google, you constantly see promoted ad results impersonating government sites (ie passportvisarush.com or easegov.com) extracting and selling your PII (social security number, etc) from your application.

I've reported the ads multiple times, but new ones still end up being promoted. I'm sure these companies have mined and sold thousands of SSN/address/DOB info from unsuspecting users.

andriamanitra - 20 hours ago

I'm guessing "race term" got automatically flagged because it can be understood as "word or expression that refers to a racial group or to race/ethnicity" i.e. an euphemism for a slur.

bede - 20 hours ago

FYI https://race-term.com is blocked by NCSC's Protective DNS service using my UK University's connection. Are you sure your domain is not blacklisted somewhere?

hermitcrab - 16 hours ago

We are entering a Kafkaesque world where all powerful companies are the gatekeepers, but there is no chance to talk to a human to appeal their decisions. Your only hope is if a) you have an inside contact or b) you can create enough stink on social media.

Jean-Papoulos - 2 hours ago

Google is guilty of this across their whole range of product. We hear a lot about Youtube, but it's the same for Ads and Android. I had my developer account banned for a copyright issue, and to this day I don't know what the issue actually was.

hermitcrab - 16 hours ago

I sympathize. My Google Adwords account (that had been running continuously for 10 years at that point) got suspended for (I shit you not) hyperlinking to another domain. I believe it was due to a very poorly trained contractor. The whole sorry saga is here:

https://successfulsoftware.net/2015/03/04/google-bans-hyperl...

de6u99er - 20 hours ago

Google doesn't care. They advertise online betting to kids, because those platforms now have some "free" online games.

redbluething - 8 hours ago

Meanwhile on the publisher side, Adsense is unusable with the constant scareware content on the network:

https://www.cannonade.net/blog/why-i-turned-off-google-adsen...

lorey - 20 hours ago

Had the same issue. In the end, getting pulled into some Google Ads sales funnel and them solving the issue through internal tickets helped. Spent $1000 on useless ads in the process, but have an "unlocked" account now. Really disappointing customer experience.

commandersaki - 10 hours ago

What's crazy is there's so much malvertising on Google. I used to see heaps of Homebrew advertisements leading to malicious curl | sh installs.

soltanov - 21 hours ago

Google treats its customers so blindly. in short, Google is not user centric company at all.

WarmWash - 19 hours ago

The real question is why you would spend money to advertise to probably the most advertising adverse, and ad-bloc literate, demographic?

notatoad - 16 hours ago

this is what regulatory failure looks like. There's no downside for google to do this, because nobody is going to hold them accountable. Nobody is telling them they have to explain their actions, and it's easier for them not to, so why would they?

throwawayffffas - 20 hours ago

Check if chrome flags your site as malware. If it does, hire a lawyer and sue them for defamation.

tolusky - 11 hours ago

Google needs to do more of safety verification before making any ad go live on its platform. It owes us that duty.

faeyanpiraat - 20 hours ago

Neat terminal, I've been building the same thing in my free time but haven't reached a point where it is complete / stable enough for being my daily driver.

Have you (anyone) actually sticked to the way of working this enables, or is this just a gimmick?

burnte - 12 hours ago

Sounds like AI saw terminals and the word "race" and assumed it was for exploiting race conditions.

maerF0x0 - 18 hours ago

I noticed this around homebrew install style key words. People blindly copy and paste a shel script that is given sudo on a fresh install. Seems pretty ideal setup for bad guys.

GoToRO - 16 hours ago

Add facebook too. No problem for them to accept money from websites that were reported as fraud. They pause it a little then they are right back at it.

monegator - 20 hours ago

Ah yes, i got an account suspended on play console due to inactivity. The new help system has been "improved" in the sense that it is directly inside play console, so of course i can't appeal or request to reinstate or transfer the app ids to a new account, because THE CURRENT ACCOUNT IS CLOSED AND I AM ALWAYS REDIRECTED TO A PAGE THAT TELLS THAT THE ACCOUNT IS CLOSED.

So i tried appealing using another console account. After about a week i got the usual automated response stating that my previous report was auto-translated into english (i wrote it in fucking english of course) and some generic babble about what happened.

To which i replied that i have no problem opening a new account using the old email, but i'd want to know beforehand if i'd keep, or how to retain, the package IDs so it's not going to be a fucking painful mess to tell customers to reinstall.

And of course i got the same autogenerated email, with a couple new lines summarizing the first part.

I feel for the author, it is literally impossible to talk to a human there.

sspiff - 20 hours ago

They are begging you to spend your ad budget elsewhere.

motoroco - 8 hours ago

I got blocked by Microsoft for trying to advertise on DDG. I signed up for a new account (no prior M$ affiliation to start from), imported my Google Ads campaign, paid them a hundred bucks and was almost ready to spend. Then I uploaded my WA state business license and immediately got force logged out without any reason. An email came by to say I had been blocked. Support was utterly useless, there was no way to appeal that I could find, and I had to file a chargeback with my bank to get the $100 out. Don't waste your time & money, folks

skylurk - 20 hours ago

> You can position and resize terminals freely instead of squeezing everything into a uniform grid

yes please!

- 20 hours ago
[deleted]
pampas - 7 hours ago

The lack of support is why all the publishers I know give some third party SSP a hefty cut of their revenue just for support. Trying to get any non-wordy website like a tool or game approved is infuriating because they want blog spam.

customguy - 20 hours ago

I really wonder about these youtube ads for these (non-existing, AI slop) incel games... it's always the same pattern, a man is exploited and/or rejected by a woman who gets everything for free he has taken from him, is spat on and whatnot, then starts his quest to fight the demoness or whatever. Are there any articles about those and the companies behind them?

trhway - 9 hours ago

Yet the scam ads like the 33tb ssd are running wild unrestrained on YT.

ozim - 17 hours ago

Everyone who is angry at „not giving feedback what is malicious” should remember that bad guys will also do so and with feedback they just get more information on how to make malicious sites to hide better.

Google is not great but we all can’t have nice things because of thieves and criminals.

micromacrofoot - 12 hours ago

pretty much every ad network is full of scam content now, some of the AI generated ads I see on youtube are just jaw-droppingly bad... the whole industry needs to be reset

it used to be common but more of an exception, but now it feels like everything is a scam

chrisgd - 19 hours ago

Anthropic is terrible too. I couldn’t rectify my spending versus my usage. Automated assistant shows me where things are that I am already asking about. Gets escalated and person doesn’t respond to my question. Back to automated with multiple requests to escalate before they will do it

shevy-java - 14 hours ago

The thing is: I don't see any ads. So I won't see his advertised malicious ad either, nor the software. All gets blocked. All must be blocked. That's why everyone needs hero blockers such as Ublock origin and other solutions here.

By the way - which company removed ublock origin from Chrome? Could it have been a certain adCompany that does daily deeds of Evil?

classified - 15 hours ago

In the good old days, twitter was the replacement helpdesk for the monster corporations. If your issue went viral there, it would suddenly be magically fixed, when the day before it was completely impossible and out of the question. YC should send Google an invoice for services rendered.

cbeach - 18 hours ago

My Adsense account got automatically disabled years ago, allegedly for click fraud (no such behaviour on my part) and there was no effective way for me to appeal.

I'm now a huge supporter of any initiative or law that attempts to break Google's stranglehold on online advertising. They have placed too much responsibility in their broken automation, and they are a bad faith actor in the space.

deaton - 18 hours ago

I've used adblockers, revanced, and whatever else for years, so I don't see many ads, but every time I'm on a computer without this stuff installed I am appalled by how many scams get through. At some point, Google must have realized that nobody is going to come after them for selling ad space to scammers (possibly because of section 230 of the CDA?) and hey, scammers are willing to pay enough for it to be worth it.

kg - 20 hours ago

Behavior like Google's monopolistic behavior here in turn enables other monopolies - if distributing your own software puts you at risk of being arbitrarily banned by advertisers, deranked in search, blocked by virus scanners, etc without recourse, you're going to end up leaning on app stores like Steam, Google Play, etc because they have a shortcut through all the red tape.

rvz - 20 hours ago

Maybe Google have detectors of some sites that are mostly vibe-coded also being associated with AI slop.

Also why use Google Ads in the first place? Given that HNers and technical users are extremely allergic to that?

jens_tlb - 20 hours ago

[dead]

talhaanwar - 19 hours ago

So you are guy whose weired and malicious ad destroyed my system

delegate - 19 hours ago

Interestingly how everyone is talking about 'Google', this faceless entity.. but in essence there are humans who work there, employees not doing their job properly. Lazy, detached, disinterested .. with no consequences for coasting.. Or are badly organized/managed, have the wrong incentives, are burned out, going through a divorce, performance review, whatever..

People are people, life happens, job happens, but unfortunately some of these roles have real external impacts on other people. One demotivated employee at a Google* can radiate their unhappiness onto great number of others because of the circumstantial power they have at their disposal.

At the very least they could copy & paste the exact reason for the ban, but no, they'll drag people through mud and automated replies, etc.