I have to say this is probably the anti-pattern of all anti-patterns that the web easily allows without much protection. Its a little surprising that it took this long. Probably vibe coding aided its creation.
Maybe its time to turn off the web. Its only going to get worse.
For starter's you could turn off the ads only.
Just use AdBlock and this is not an issue
It also doesn’t help that nearly everything is now outsourced to SaaS that use ridiculously generic or often sketchy sounding domain names for secure transactions. When the government sends you to id.me, or a doctors office sends you to phreesia.com (huh?), or a business sends you to something like securepayments.com, insurance companies through fiserv.com, restaurants through all kinds of shady sounding domains.
We’ve been trained to ignore the domain name and accept putting sensitive content into random third party providers. How does a scam site look any different?