The top result is official
The first search result is the official site
What ranking measures
Links pointing at a page, how people behave after clicking, how long it has existed, how it is structured. Every signal is a measurement of attention, and attention is not authenticity.
There is no step anywhere in ranking that checks whether an address printed on a page is controlled by the party the page names. A search engine cannot do this, not through carelessness but because verifying an onion address means checking a signature against a key, and a crawler has no way to know which key is correct.
The patient attack
It is not technical and it is not spam, which is why it works.
- Build a page that is genuinely useful and rank it over months with ordinary methods. Nothing to detect, because nothing is being faked.
- Let it settle into a position where a steady trickle of people arrive.
- Change the addresses. No ranking signal degrades, because nothing that ranking measures has changed.
- Anyone who checked the page six months ago and remembers it as trustworthy is remembering accurately.
The failure with no attacker
Ranking has momentum. A page that ranked well when its addresses were current keeps ranking long after they expire, because the signals decay slowly and the addresses went stale immediately. So the top result for an address query is frequently a page that was accurate and now describes a retired address, which is the single most dangerous category of address there is.
Using search anyway
- Treat every result as a candidate. You are collecting leads, not answers.
- Look for a date. An undated address page should be assumed old. Anyone maintaining addresses knows the date matters and says so.
- Prefer pages that tell you to verify over pages that tell you they verified. The second asks for trust it cannot earn.
- Never act on a result because of its position. Position is the least informative thing on the page.