This totally is on Google & Co for allowing those scam ads. They can filter those out. They are simply chosing not to.

Damn, that’s a high-quality variation of a man-in-the-middle attack, and going after the big name companies shows how confident they are they won’t get caught. Cloudflare and Google need to be doing more to prevent this.

This was interesting. I’ve never considered that a scam site could proxy the real one.