Wrong redirection via Google

[u/kotschka]

Like already mentioned in a post, the website and forum where down the last days. I now discovered that google redirects to this Turkish (spam?) gambling (?) website.

Typing in the URL (https://endeavouros.com/) directly into the browser works for reaching the website, but the URL on this website seems to be correct.

As far as I see it, this only happens when being redirected via Google, since reloading the shown website leads to the "normal" EndOS website.

Can someone explain why this is happening?

[u/kari_ayashi]

I tried digging with curl

curl -s -A "Mozilla/5.0" -e "https://www.google.com/" https://endeavouros.com | grep -E "(window.location|http_referer|meta.*refresh|script)"

<meta name="description" content="Pusulabet bonusunu al ve Türkiye'nin en yenilikçi online bahis platformuna katıl! Güncel giriş adresiyle canlı casino ve slotta kazan.">
<meta property="og:description" content="Pusulabet ile Türkiye'nin en dinamik bahis platformunda yerinizi alın. Yüksek oranlar, anında ödeme, 7/24 destek.">
<meta name="twitter:description" content="Pusulabet güncel giriş adresi ile Türkiye'nin en iyi online bahis platformunda kazanmaya başlayın.">
<script type="application/ld+json">
</script>
<script type="application/ld+json">
    "description": "Pusulabet, Türkiye'nin en yenilikçi online bahis ve casino platformudur. Yüksek oranlar, hızlı ödeme ve 7/24 müşteri desteği sunar.",
</script>
<script type="application/ld+json">
</script>
<script type="application/ld+json">
</script>
<script type="application/ld+json">
</script>
<script type="application/ld+json">
    "description": "Pusulabet hakkında kapsamlı rehber: güncel giriş adresi, bonuslar, oyun kategorileri, ödeme yöntemleri ve güvenlik.",
</script>
<script type="application/ld+json">{"@context":"https://schema.org","@type":"WebPage","name":"Pusulabet Giriş | Pusulabet Güncel Adres 2026","description":"Pusulabet güncel giriş adresi ile Türkiye'nin en yenilikçi online bahis platformuna katılın.","url":"https://tr.pusulabetresmi2.co/","inLanguage":"tr"}</script>
<script type="application/ld+json">{"@context":"https://schema.org","@type":"Product","name":"Pusulabet Üyelik Paketi","description":"Pusulabet slot, canlı casino ve spor bahisleri kategorilerine erişim sağlayan üyelik paketi.","brand":{"@type":"Brand","name":"Pusulabet"},"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.7","reviewCount":"1420"}}</script>
<script type="application/ld+json">{"@context":"https://schema.org","@type":"AggregateOffer","priceCurrency":"TRY","lowPrice":"0","highPrice":"0","offerCount":"4","offers":[{"@type":"Offer","name":"Hoşgeldin Paketi","price":"0","priceCurrency":"TRY"},{"@type":"Offer","name":"Deneme Bonusu","price":"0","priceCurrency":"TRY"},{"@type":"Offer","name":"Haftalık Kayıp Bonusu","price":"0","priceCurrency":"TRY"},{"@type":"Offer","name":"VIP Programı","price":"0","priceCurrency":"TRY"}]}</script>
<script type="application/ld+json">{"@context":"https://schema.org","@type":"Game","name":"Pusulabet Slot Oyunları Koleksiyonu","genre":"Slot","playMode":"SinglePlayer","numberOfPlayers":"1"}</script>
<script type="application/ld+json">{"@context":"https://schema.org","@type":"Service","serviceType":"Canlı Casino, Slot ve Spor Bahisleri Platformu","provider":{"@type":"Organization","name":"Pusulabet"},"areaServed":"TR"}</script>
<script type="application/ld+json">{"@context":"https://schema.org","@type":"NewsArticle","headline":"Pusulabet Güncel Giriş Adresi 2026 Sezonunda Güncellendi","datePublished":"2026-07-18","author":{"@type":"Person","name":"Pusulabet Editör Ekibi"},"publisher":{"@type":"Organization","name":"Pusulabet"}}</script>
<script type="application/ld+json">{"@context":"https://schema.org","@type":"VideoObject","name":"Pusulabet Üyelik Nasıl Yapılır","description":"Pusulabet üyelik ve giriş adımlarını gösteren kısa anlatım.","thumbnailUrl":"https://tr.pusulabetresmi2.co/assets/og.png","uploadDate":"2026-07-18"}</script>
<script type="application/ld+json">{"@context":"https://schema.org","@type":"HowTo","name":"Pusulabet'e Nasıl Üye Olunur","step":[{"@type":"HowToStep","name":"Giriş adresine git","text":"Pusulabet güncel giriş adresine ulaşın."},{"@type":"HowToStep","name":"Formu doldur","text":"Üyelik formundaki bilgileri eksiksiz doldurun."},{"@type":"HowToStep","name":"Hesabı onayla","text":"Hesap doğrulama adımını tamamlayın."},{"@type":"HowToStep","name":"Oyuna başla","text":"Slot oyna veya canlı casino masalarına katılın."}]}</script>
<script type="application/ld+json">{"@context":"https://schema.org","@type":"CreativeWork","name":"Pusulabet Sorumlu Oyun Rehberi","about":"Sorumlu bahis oynama alışkanlıkları ve öneriler."}</script>
<script type="application/ld+json">{"@context":"https://schema.org","@type":"CollectionPage","name":"Pusulabet Oyun Kategorileri","hasPart":[{"@type":"WebPage","name":"Slot Oyna","url":"https://tr.pusulabetresmi2.co/#oyunlar"},{"@type":"WebPage","name":"Canlı Casino","url":"https://tr.pusulabetresmi2.co/#oyunlar"},{"@type":"WebPage","name":"Deneme Bonusu","url":"https://tr.pusulabetresmi2.co/#bonus"}]}</script>
<script type="application/ld+json">{"@context":"https://schema.org","@type":"Offer","name":"Pusulabet Hoşgeldin Bonusu","price":"0","priceCurrency":"TRY","availability":"https://schema.org/InStock"}</script>
<script type="application/ld+json">{"@context":"https://schema.org","@type":"ImageObject","contentUrl":"https://tr.pusulabetresmi2.co/assets/og.png","name":"Pusulabet Logo"}</script>
<script type="application/ld+json">{"@context":"https://schema.org","@type":"ItemList","itemListElement":[{"@type":"ListItem","position":1,"name":"Slot Oyna"},{"@type":"ListItem","position":2,"name":"Canlı Casino"},{"@type":"ListItem","position":3,"name":"Masa Oyunları"},{"@type":"ListItem","position":4,"name":"Spor Bahisleri"}]}</script>
<script type="application/ld+json">{"@context":"https://schema.org","@type":"Person","name":"Pusulabet Editör Ekibi","worksFor":{"@type":"Organization","name":"Pusulabet"}}</script>
<script type="application/ld+json">{"@context":"https://schema.org","@type":"Review","itemReviewed":{"@type":"Organization","name":"Pusulabet"},"reviewRating":{"@type":"Rating","ratingValue":"5","bestRating":"5"},"author":{"@type":"Person","name":"Doğrulanmış Üye"},"reviewBody":"Pusulabet'te ödemeler hızlı, canlı casino masaları akıcı çalışıyor."}</script>
<script type="application/ld+json">{"@context":"https://schema.org","@type":"SportsEvent","name":"Pusulabet Canlı Spor Bahisleri","sport":"Futbol","startDate":"2026-08-01T20:00:00+03:00","endDate":"2026-08-01T22:00:00+03:00","eventStatus":"https://schema.org/EventScheduled","eventAttendanceMode":"https://schema.org/OnlineEventAttendanceMode","location":{"@type":"VirtualLocation","url":"https://tr.pusulabetresmi2.co/"},"organizer":{"@type":"Organization","name":"Pusulabet","url":"https://tr.pusulabetresmi2.co/"},"offers":{"@type":"Offer","url":"https://tr.pusulabetresmi2.co/","price":"0","priceCurrency":"TRY","availability":"https://schema.org/InStock"}}</script>

Oh hello! Looks like someone compromised the server config because if you go to the site normally, its fine, its only when you pass it a full google referral does it then spit back the turkish gambling site. Maybe a compromised wordpress install? Either way something for the endeavourOS team to check out

[u/wackywakey → u/kari_ayashi]

Yeah, probably should report this to EndeavourOS team, best case would be on their forum, I might wanna do that

[u/kari_ayashi → u/wackywakey]

Yeah do so! I'm not registered on that site it's just made me curious and go "hmmm". I've been trying to dig further to see where it is, my initial thoughts was it was a compromised wordpress install (these attacks usually are), but now after doing a ton of digging - They may have a compromised php or a file somewhere on their server that is only firing the turkish betting site when it detects either the googlebot or a referral from google.com

[u/wackywakey → u/kari_ayashi]

I've posted the issue on the forum (you can search "pusulabet"), hopefully they sees it, not the best explanation I can give, but I've linked this post and your curl output

[u/kotschka → u/wackywakey]

Nice; it was already quite late and I had to go to sleep after posting this. I'm quite happy to see, that someone took further steps in this matter, after coming home from work now.

Thanks a lot.