Why is this allowed? I know Google will do anything for money, but why is Google allowed to signpost a link to gimp.org which actually takes you to g--imp.org (sanitised)?
I mean, if nothing else, how do they not share the liability for damages done by the spyware they're literally promoting? For the businesses squatting on the names of more notable ones? AdWords goes too far.
The point is that Google should not be allowed to let those malicious ads through and be held accountable for the damages, both to the GIMP project in this case as well as to whoever may have clicked on the malicious link and installed the malware.
Ban? They shouldn't need to look for bad actors or ban anyone†, they just shouldn't let people spoof the domain on an advert. At all.
What's happening is Google would rather accept the cash up front and keep it if and when someone reports an ad. No forethought is given to people tricked by this.
† Obvious exception for unicode squatters but even they should be filtered out entirely automatically. Invisible or misleading characters in your domain should be automatically blocked.
I mean, if nothing else, how do they not share the liability for damages done by the spyware they're literally promoting? For the businesses squatting on the names of more notable ones? AdWords goes too far.