[grapehut]

This is a particularly egregious case, I've never seen a fake domain slip through like that before.

However, I have reported dozens of phishing sites for the company I worked for. The phisher would simply buy ads for $BRANDNAME and create a convincingly similar site and phish users. I would report the website to "safebrowsing" and report the ad. Typically it would take 1 to 3 days for the website and/or ad to be removed, which would give them enough time to do countless damage. Then they would simply register a new domain, and repeat.

At some point the only thing you can do is outbid phishing sites for your own brandname?!

It's a shame google can not self-regulate such evil behavior, but it's clear that it should be illegal for google to allow people to buy ads on brandname searches.