Reporting works at the creative, and the operators work at the domain. The paper traced ad landing pages to domains that several protective DNS services had already flagged, one of them tied to the TamperedChef malware campaign [10]. The team reported a single ad pointing at that domain and it came down; 41 more ads pointing at the same domain kept running [11]. That is 42 creatives aimed at one known-bad destination, and the abuse channel reached one of them [1].
The bill is the part defenders can act on. Roongta itemised it: $96 for a 4-core DigitalOcean VM, plus GPU time on an L40S at $1.57 an hour [14], with the LLM annotation finishing in under 12 hours [15]. Twelve hours of L40S is $18.84, so the full run lands under roughly $115 [2]. Across 188,000 creatives that is about six hundredths of a cent per ad [3].
The flag rate itself is low. 238 plus 3,346 plus 258 is 3,842 ads, near 2 percent of the corpus [4]. Duration carries more weight than the count. The most-viewed false-claims ad had been live more than two years and collected 14.5 million impressions on its own [6], and one French creative carrying no advertiser information beyond a Continue button and a QR code took 1.6 million impressions [7]. The scareware copy is templated and easy to fingerprint, down to lines like "Your phone has been severely damaged by 33 types of viruses" [17], which is why a similarity search plus an open-weight model panel was enough to find them [3].
For a defender the usable output is the landing-domain list, not the report queue. The archive is public, extraction costs a day of GPU rental, and the domains can go into a resolver blocklist without Google's participation. The researchers say the pipeline is not tied to Google's archive [16], so the same method applies to any platform publishing one under the transparency rules Google built the Ads Transparency Center to satisfy [2].
