Thank you for your comment, Jakob.

I did some checking into Firefox and Chrome options for phishing protection. The firefox support page I looked at is here: https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work

And the chrome page is here: https://www.quora.com/How-does-Google-Chrome-protect-my-devices-from-dangerous-sites

Both use site reputation to determine whether anything you download might be harmful to you. “Site reputation” is based on statistics the browser companies gather from users like us. The browser companies track where we go and notice if bad things happen to us as a consequence of visiting a site. The site which is hurting people acquires Bad Karma (technical term, that) from the browser companies. Enough bad karma and the browser companies may label the site as malicious and start warning visitors that this site can’t be trusted and downloads should not be done.

No matter what we think of reputation-based protection, there are ways around it. For example, many legitimate sites host advertising. If you click on an ad, the host site gets paid. If the ad is corrupt (“malvertising” https://en.wikipedia.org/wiki/Malvertising ), then by clicking on the ad, you could become the victim of ransomware or other malware. In this case, the website that infected you could have a 100% golden reputation. That site serves up the malvertising ad, which itself is not hosted by the serving website, it is taken from some other website by the serving website and shown to you.

As a further level of indirection, the cybercriminal may have hacked the ad hosting site, and replaced a legitimate ad with an infected copy. Now both the ad hosting site and the ad serving site can have perfect reputations and you still end up looking at a ransomware screen. Incidentally, as people get infected, what sites start taking the reputation hits?

Best advice I have for mavertising? Don’t click the link. If you see an ad that you really want to pursue, type the relevant keywords (company name, product name, etc) into a search engine and find it that way.

Stacy