AdWords
4K members online now
4K members online now
Understand Google's advertising policies, including ad approval status and account suspension
Guide Me
star_border
Reply

How is this possible - Phishing Ad for AdWords MCC logins

[ Edited ]
Collaborator ✭ ✭ ✭
# 1
Collaborator ✭ ✭ ✭

Hello,

 

I typed this morning "adwords en forum" and I received this AdWords Ad which looks like a phishing scheme which wants my MCC login data while trying to trick me through a Display URL that looks like Google domain.

 

accounts.google.com.accounts.google.co...‎

 

adwords-phising.png

 

the click ID is

 

http://www.google.com/aclk?sa=l&ai=CRJbStrgoVd7DDIK4jAaNwIGwD7f4jI0Hr9HdxuoB5OWwBQgAEAFgg6XhhegboAH5...

 

First of all how did this Ad go trough with such a long Display URL which is not even matching the Destination URL domain

 

http://fysiowikberg.fi/adw&cad=rja

 

 Later Edit : when I clicked the triangle near the Display URL and chose "Why this Ad" it shows me the complete very long display URL

 

complete-display-URL.png

2 Expert replyverified_user

Re: How is this possible - Phishing Ad for AdWords MCC logins

Rising Star
# 2
Rising Star
Display URL tricked to look like Google, but points to a Finnish domain, dangerous. Should be taken down immediately!
Sumanth Sridhar

Re: How is this possible - Phishing Ad for AdWords MCC logins

Top Contributor
# 3
Top Contributor
The case was escalated to the appropriate team at Google;
Thank you
Moshe, AdWords Top Contributor , Twitter | Linkedin | Community Profile | Ad-Globe
Did you find any helpful responses or answers to your query? If yes, please mark it as the ‘Best Answer’

Re: How is this possible - Phishing Ad for AdWords MCC logins

Collaborator ✭ ✭ ✭
# 4
Collaborator ✭ ✭ ✭

Today I have seen the Ad a second Time. Below you have a screenshot and the click ID .

The phishing ad is on the right hand side , 3rd AdWords ad.

The search term was again "adwords en forum" , location Bucharest, country Romania.

 

When I click the ad to get to the destination URL the browser Firefox shows me that it has been reported as "web forgery" , see second screenshot , but the AdWords ad is still running.

 

The message is "This web page at accounts.google.com.adwords.google.com.markatescilim.com.tr has been reported as a web forgery and has been blocked based on your security preferences."

 

mcc-phishing-ad-15-april-2015.png

 

 

http://www.google.ro/aclk?sa=l&ai=Ct8AqlyUuVb7oLouazAOrxAG3-IyNB6_R3cbqAeTlsAUQAygEYIOl4YXoG6AB-ZLnz...

 

reported.png

Re: How is this possible - Phishing Ad for AdWords MCC logins

Top Contributor
# 5
Top Contributor
OK; let me reopen the case with Google.
Moshe, AdWords Top Contributor , Twitter | Linkedin | Community Profile | Ad-Globe
Did you find any helpful responses or answers to your query? If yes, please mark it as the ‘Best Answer’

Re: How is this possible - Phishing Ad for AdWords MCC logins

Visitor ✭ ✭ ✭
# 6
Visitor ✭ ✭ ✭
It seems like it is my webpage that is being used fysiowikberg.fi . I got a facebook message about this so i went to my adwords account and saw a fake campaign. I got a bit scared so i closed my whole adwords account and of course changed my google password. Today a nice chap from the US called and warned me about this same thing. But i have already closed my adwords account that i previously used to market my website. I don't understand what is going on here.