Why I Turned Off Google AdSense

☰ Menu Patrick O'Brian Timeline Projects The Martian Software Blog Bio

BlueSky<br>Mastadon<br>Feeds<br>Contribute

Why I Turned Off Google AdSense<br>August 5, 2026, 12:43 pm

In 2006, inspired by the recent movie and the launch of<br>the JavaScript<br>Google Maps API, I started working on a project to map the events of the Patrick<br>O'Brian Aubrey/Maturin novels. At the time I thought using Google AdSense which had<br>launched a few years earlier would help support the running costs of the<br>site.

Over the years, as those fairly innocuous text ads evolved into image display<br>ads and then animated ads, I have pushed back over pretty constant suggestions<br>to "optimize" the placement and propagation of ads on my site. I have, however,<br>continued to maintain a 200x200 AdSense square on the top right corner of my site.

To be clear, I’m not opposed to advertising on principle. I actually like a good targeted ad. I appreciate being introduced to a product I am actually interested in.

What I don’t appreciate are ads that are designed to scam people.<br>This is particularly true when the audience is on my personal website.<br>Unfortunately this seems to be unavoidable on the AdSense platform.

Here are a couple of examples of a class of malicious ads I have discovered<br>on my personal site every day for the last week or so. The ad copy is minimal,<br>“continue (or c0ntinue) to our site”. Both<br>ads linked to blatantly "Scareware" sites (following<br>a redirect from a sketchy, but not explicitly malicious placeholder site). I<br>found multiple examples of this attack over many days and served from a variety<br>of destination domains (more on that later), but these two illustrate the Apple<br>and Microsoft flavoured versions:

the ad

where it leads

the ad

where it leads

Implementation of this kind of Scareware isn’t something I have ever looked at closely before. It’s nasty and not very clever:

Fake scan results - animated counters, no actual scanning happens.

51,900<br>1,200

Tries to block the back/close button

window.addEventListener("beforeunload", function (e) {<br>e.returnValue = "It looks like you are editing something...";<br>});

Attempts to reopen itself when closed

window.addEventListener('unload', function () {<br>window.open(window.location.href, '_blank');<br>setTimeout(() => window.location.href = window.location.href, 1);<br>});

Tries to freeze the tab with a Web Worker spam loop

for (let i = 0; i

Abuses legitimate SaaS for credibility/functionality - Tawk.to live chat embedded so scammers can talk to victims.

noindex,nofollow - tries to stay invisible to search/crawlers since it serves entirely on ad-redirect traffic.

Looping alarm sound - retriggered every 500ms so it can't finish and fade out, plus a beep fired on every click to reinforce urgency.

setInterval(function() {<br>document.getElementById("infogt").play()<br>}, 500);

function beep1() {<br>document.getElementById("mdchys").play();

It's designed to frighten people into exposing themselves to fraud and theft<br>and it makes me pretty angry. The Internet is a wretched hive of scum and<br>villainy (apart from all the nice parts) so the fact that this attack exists<br>isn't surprising. The surprising, and deeply disappointing, thing is that Google's<br>tolerance for it isn't low enough to make it uneconomical for the attacker.

When I first discovered these ads on the network I began thinking about possible<br>technical solutions. It did not take long to realise that, given Google’s vast<br>resources, it was unlikely that any of my ideas hadn't already been considered, rejected or<br>adopted. It also occurred to me that some of these measures could reduce<br>advertising revenue through false positives or the broad exclusion of resellers<br>whose networks contain a proportion of bad actors. Those effects, together with<br>the cost of implementation, would inevitably influence any decision about how<br>much to spend removing such actors from the network.

I'm not suggesting Google isn't motivated to keep these bad actors off their<br>network. They certainly are. What I am suggesting is that there is a minimum<br>level of malicious advertising that Google is unwilling to pay more to<br>eliminate. That minimum level might be quite low, but I don't believe it's low<br>enough.

So why not low enough? Because there is evidence in this particular attack<br>that demonstrates it's been economically viable for the attacker not just for the<br>few weeks I observed it, but for years . If you look carefully at the "Apple"<br>branded site, it's impersonating the Apple<br>support page, but it's using an icon for the "MacBook Air" that hasn't been<br>used by Apple since<br>2022.

For at least four years, and probably far longer, it's been worthwhile for<br>the criminals who operate these sites to build, support and deploy the<br>infrastructure that's playing Whack-a-Mole with Google's compliance systems.<br>They are profiting enough from the victims they defraud to justify that<br>expense.

Google should spend more on making it cost prohibitive for criminals...