[tidenly]

Crazily enough, the domain shown under the ad on google ads isn't automatically pulled. You can set it manually.

Attackers exploit this by first using a genuine domain to get the ad approved, and then altering the info after the campaign starts. I saw a similar attack like this on twitter a month or so ago.