EndeavourOS main site Hijacked by a Turkish Gambling site (AGAIN)

[utaneuta]

EndeavourOS Google Search result showing gambling spam

Hi, first off, sorry if it’s a bit clunky, since this is my first post here, but basically, what’s happening is that if you search “endeavouros” with Google search engine, the main result shows a Turkish gambling site (Pusulabet), even though visiting endeavouros directly with endeavouros.com is completely fine, and if you access it, you’ll be directed to that gambing site instead of endeavouros main page itself. Thanks to that one Reddit post in EndeavourOS subreddit, someone did the curl comma…

it’s the same issue as the one on the post above, when you go to the EndeavourOS site through Google, itll appear but when you type in the link, it doesnt (checks for Referrer headers)

[UncleSpellbinder]

Confirmed. And welcome to the forum…

• The first link appears to be for EOS. Clicking it brings you to that gambling site…

• The address for that site is even a seemingly EOS site address.

[utaneuta]

@UncleSpellbinder

The address for that site is even a seemingly EOS site address.

It is the EndeavourOS website, what I assume is one of the plugins they use for their website got hacked and serves a gambling site page whenever the Referrer header is a search engine.

Hopefully they can fix it soon

[ricklinux]

Me too.

I guess we better let @Bryanpwo know.

[rubi1200]

Confirmed here too using above methodology.

Haven’t these people got better things to do with their time and energy?

[swh]

@Bryanpwo may take a look again to that issue

EndeavourOS Google Search result showing gambling spam

The issue is fixed. It was most likely certain plugins and the theme we used that were compromised. I made some theme changes for now. The current theme isn’t the most beautiful in the world, but we are in the process of redesigning the entire main website and the Discovery website, and it will be available very soon. So, see this as a temporary placeholder. A big shoutout to Michael Tunnell from “This week in Linux” for pointing me in the right direction.

[UncleSpellbinder]

These people trolling the net need to leave our little purple corner of the web alone!

[marteng69]

Made some tests. That gambling site only appears if you are using Google as search engine.
It does not happen with Bing, Startpage, DuckDuckGo nor Ecosia.

@utaneuta welcome to the forum!

[Stephane]

so remove from your browser search engine Google

[Mellow]

Doesn’t happen with brave search seems to be just Google

[sconne15]

Once the Turkish online gamblers come for you, you know you have really hit the big time

[kwg]

It seems to be exactly the same issue as before.

This command returns the regular content:

$ curl --referer "" https://endeavouros.com

This command returns the gambling content:

$ curl --referer "https:google.com" https://endeavouros.com

The gambling content is being served by the EndeavourOS Web server:

$ curl -s -o /dev/null -w "%{remote_ip}\n" https://endeavouros.com
85.214.143.216

$ curl --referer "https:google.com" -s -o /dev/null -w "%{remote_ip}\n" https://endeavouros.com
85.214.143.216

[Bryanpwo]

The issue is solved. (for now)

[dbarronoss]

But did we win? Was the payout good ?

[drunkenvicar]

I lost $400 on Keno, $100 on blackjack and $300 in strip Texas hold’em poker. I had to keep the camera on. It was weird. thank god they took my credit card…next time I click EndeavourOS I need to learn Turkish.

[Archie1]

Can we sue them? Get a payout or something?

[joekamprad]

5% of all money Endeavournauts spending on the gambler website.

[winnyace]

I believe this is an appropriate video to share here: https://youtu.be/IPFiKEm-oNI

We love modern day SEO exploits!

[MichelN]

Well if endeavour would add a gambling page maybe they get a higher income instead of the donations . The idea is not that bad after all.

[marteng69]

@Stephane

so remove from your browser search engine Google

Why should I? This would not help to solve this issue.
To clarify. I am using Startpage as default search engine and additionally I am using a referer blocker. So with this blocker activated I would never have experienced this hijacked part of the webseite.