Ok so after seeing this I went back into brave reset google as the search engine and found if I scroll a little down I find this as well. So @Bryanpwo can confirm now that this is still an on going issue in the US as well.
This is really weird if I search with Startpage or Ecosia I get the Turkish link , but when clicking on it I get to the EOS website in both cases. No sign of the Turkish link on Brave/Qwant/Startx/DDG/Bink.
As of writing this, I get the gambling (?) site when opening from India.
yer that the site, drunk too much to dive deeper, but wondering if it targeting other distros??
On arch sites i get also weird links from google.. startpage.com is ok mostly. On phone ddg…trying used to mojeek… i dont know where is came from…is it possible some cookies?
just repoted to google, but ya know it will take people making it noticed so if you can also report, I put it under spoof site
That’s great, but as long as endeavouros.com serves that content google is just doing its job.
Yer which is why it will need many reports to get eyes on it, on our end there is not much else that can be done but this
cannot reproduce in DDG, fwiw.
I don’t know how to interpret that; they all scrape from the same well..
Likely a poisoned DNS (it’s always DNS) cache from Google. Other search engines (DDG, Bing, Brave) seem to be unaffected
When I run this command, the real site is returned:
$ curl --referer "" https://endeavouros.com
When I run this command instead, the fake site is returned:
$ curl --referer "https:google.com" https://endeavouros.com
Apparently, both sites (real and fake) reside at the same IP address:
$ curl -s -o /dev/null -w "%{remote_ip}\n" https://endeavouros.com
85.214.143.216
$ curl --referer "https:google.com" -s -o /dev/null -w "%{remote_ip}\n" https://endeavouros.com
85.214.143.216
Because there isn’t a fake site. The real site got infected and serves different content if the referrer is google (i.e. a search result).
Yes. And the problem has nothing to do with the Google search engine. Google simply indexed the content it saw.
The issue is fixed. It was most likely certain plugins and the theme we used that were compromised. I made some theme changes for now.
The current theme isn’t the most beautiful in the world, but we are in the process of redesigning the entire main website and the Discovery website, and it will be available very soon. So, see this as a temporary placeholder.
A big shoutout to Michael Tunnell from “This week in Linux” for pointing me in the right direction.
Nice, thank you for being on top of it.
just when I think I’ve seen it all from the bad actors ^^ I obviously have not…