Return to Answer

This is a common abuse in paid advertising (note the "Ad" icon at the tail of your left arrow).

Advertisers want to track people who click on Google ads, partly to independently confirm Google's click billing, and partly to give away free cookies. So they request search engines to send users to a ClickURL which does that, and then forwards to the proper destination. The ClickURL may be off site, for instance at the ad agency.

The advertiser wants to provide a separate DisplayURL, which is simply the URL shown in the text ad. To hide the ugly ad agency URL, and to show a neatly displayed URL, instead of the actual destination URL (which may be lengthy e.g. a specific product page). This DisplayURL is being abused by the hackers.

The search engine is never provided the destination URL (where the ClickURL should forward to). Since the ClickURL is often on a different domain than the DisplayURL, this is hard to police. Target may retain several SEOs, each using a different Gooogle ID or ad agency, so there's nothing weird about a random Google ID running ads with a target.com DisplayURL all of a sudden.

Fairly likely that the advertiser is a small business and got hacked: i.e. the spammer got ahold of their Google user credentials, discovered a Google Ad account with stored credit card data, and is running ads on their dime.

This is a common abuse in paid advertising (note the "Ad" icon at the tail of your left arrow).

Advertisers want to track people who click on Google ads, partly to independently confirm Google's click billing, and partly to give away free cookies. So they request search engines to send users to a ClickURL which does that, and then forwards to the proper destination. The ClickURL may be off site, for instance at the ad agency.

The advertiser wants to provide a separate DisplayURL, which is simply the URL shown in the text ad. To hide the ugly ad agency URL, and to show a neatly displayed URL, instead of the actual destination URL (which may be lengthy e.g. a specific product page). This DisplayURL is being abused by the phishers.

The search engine is never provided the destination URL (where the ClickURL should forward to). Since the ClickURL is often on a different domain than the DisplayURL, this is hard to police. Target may retain several SEOs, each using a different Gooogle ID or ad agency, so there's nothing weird about a random Google ID running ads with a target.com DisplayURL all of a sudden.

Fairly likely that the advertiser is a small business and got phished: i.e. the spammer got ahold of their Google user credentials, discovered a Google Ad account with stored credit card data, and is running ads on their dime.

This is a common abuse in paid advertising (note the "Ad" icon at the tail of your left arrow).

Advertisers want to track people who click on Google ads, partly to independently confirm Google's click billing, and partly to give away free cookies. So they ask search engines to send users to a ClickURL which does that, and then forwards to the proper destination. The ClickURL may be off site, for instance at the ad agency.

The advertiser wants to provide a separate DisplayURL, which is simply the URL shown in the text ad. To hide the ugly ad agency URL, and to show a neatly displayed URL, instead of the actual destination URL (which may be lengthy e.g. a specific product page). This DisplayURL is being abused by the hackers.

The search engine is never provided the destination URL (where the ClickURL should forward to). Since the ClickURL is often on a different domain than the DisplayURL, this is hard to police. Target may retain several SEOs, so there's nothing weird about a random ad agency having a target.com DisplayURL all of a sudden.

Fairly likely that the advertiser has been hacked: i.e. the spammer got ahold of their Google user credentials, discovered a Google Ad account with stored credit card data, and is running ads on their dime.

This is a common abuse in paid advertising (note the "Ad" icon at the tail of your left arrow).

Advertisers want to track people who click on Google ads, partly to independently confirm Google's click billing, and partly to give away free cookies. So they request search engines to send users to a ClickURL which does that, and then forwards to the proper destination. The ClickURL may be off site, for instance at the ad agency.

The advertiser wants to provide a separate DisplayURL, which is simply the URL shown in the text ad. To hide the ugly ad agency URL, and to show a neatly displayed URL, instead of the actual destination URL (which may be lengthy e.g. a specific product page). This DisplayURL is being abused by the hackers.

The search engine is never provided the destination URL (where the ClickURL should forward to). Since the ClickURL is often on a different domain than the DisplayURL, this is hard to police. Target may retain several SEOs, each using a different Gooogle ID or ad agency, so there's nothing weird about a random Google ID running ads with a target.com DisplayURL all of a sudden.

Fairly likely that the advertiser is a small business and got hacked: i.e. the spammer got ahold of their Google user credentials, discovered a Google Ad account with stored credit card data, and is running ads on their dime.

This is a common abuse in paid advertising (note the "Ad" icon at the tail of your left arrow).

Advertisers want to track people who click on Google ads, partly so they can independently confirm Google's click billing, and partly so they can pass users through their site to give them a free cookie. So they ask search engines to send users to a ClickURL which does that, and then forwards to the proper destination. The ClickURL may be off site, e.g. at the ad agency.

The advertiser wants to provide a separate DisplayURL, which is the URL shown in the text ad. Partly so users don't see the ad agency URL, and partly so they see a neatly displayed URL instead of edge5.foo.nordstrom.com/click/gp/blah?item=125126161. This DisplayURL is being abused by the hackers.

The search engine is never provided the destination URL (where the ClickURL forwards to). Since the ClickURL is so often on a different domain than the DisplayURL, this is hard to police. Target may retain several SEOs, so there's nothing weird about a random ad agency having a target.com DisplayURL all of a sudden. So it's a really hard thing to catch.

Fairly likely that the advertiser has been hacked, i.e. the spammer got ahold of their Google user credentials.

This is a common abuse in paid advertising (note the "Ad" icon at the tail of your left arrow).

Advertisers want to track people who click on Google ads, partly to independently confirm Google's click billing, and partly to give away free cookies. So they ask search engines to send users to a ClickURL which does that, and then forwards to the proper destination. The ClickURL may be off site, for instance at the ad agency.

The advertiser wants to provide a separate DisplayURL, which is simply the URL shown in the text ad. To hide the ugly ad agency URL, and to show a neatly displayed URL, instead of the actual destination URL (which may be lengthy e.g. a specific product page). This DisplayURL is being abused by the hackers.

The search engine is never provided the destination URL (where the ClickURL should forward to). Since the ClickURL is often on a different domain than the DisplayURL, this is hard to police. Target may retain several SEOs, so there's nothing weird about a random ad agency having a target.com DisplayURL all of a sudden.

Fairly likely that the advertiser has been hacked: i.e. the spammer got ahold of their Google user credentials, discovered a Google Ad account with stored credit card data, and is running ads on their dime.