All of those can be performed by an url shortening service or advertising or a compromised website (wordpress comes to mind) or ... etc.

/* insert ascii goatse here */