Well, it just took me to "giipm.org", a remarkable 10 hours after this was originally posted. It shows "gimp.org" in the status bar when I highlight it with the mouse, but of course "copy link address" just gets a link going through www.googleadservices.com/pagead/ with some long hashes at the end.
It looks like the Dropbox file at least 404s now. IDK if that is the attacker bailing out or Dropbox actually doing something faster even though it arguably didn't do anything wrong. But Google, the enabler is still sitting on its hands.
