Links you found in a search engine

Most people reading this arrived through a search engine, which makes this the channel worth being clearest about.

What ranking actually measures

A search engine estimates which page best answers a query. It does that with links pointing at a page, how people behave after clicking, how long the page has existed, how it is structured, and a long list of similar signals. Every one of those is a measurement of attention.

None of them touch the question you care about. There is no step anywhere in ranking that checks whether an address on a page is controlled by the party the page claims. A search engine cannot do this, not because it is careless but because verifying an onion address means checking a signature against a key, and a crawler has no way to know which key is the right one.

How it gets gamed

The attack here is patient and it is not technical. Somebody builds a page that genuinely is useful, ranks it over months with ordinary methods, and gets it to a position where a steady trickle of people arrive. Then the addresses on it change.

• The page earns its ranking honestly. There is no spam signature to detect because there is no spam. The content is real and often good.
• The swap happens after ranking is established. Nothing about the ranking signals changes when the addresses do, so nothing degrades.
• Old versions look fine. Anyone who checked the page six months ago and remembers it as trustworthy is remembering accurately.
• It scales. One ranked page reaches more people over a year than any forum post, with no ongoing effort.

This is why a site being genuinely helpful is not evidence about its addresses. Those are separate properties and only one of them is visible to you.

The failure that is nobody's fault

Even without an attacker the channel misleads, because ranking has enormous momentum. A page that ranked well when its addresses were current keeps ranking after they expire. The signals that got it there decay slowly and the addresses on it went stale immediately. So the top result for an address query is frequently a page that was accurate and is now describing a retired address, which is the class of address most worth avoiding.

Using it anyway

1. Treat every result as a lead. You are collecting candidates, not answers, and the difference matters most when a result looks authoritative.
2. Look for a date on the page and treat an undated address page as old. Anyone maintaining addresses knows the date matters and says so.
3. Prefer pages that tell you to verify over pages that tell you they verified. The second is asking for trust the page cannot earn.
4. Never act on the first result because it is first. Position is the least informative thing on the page.
5. Verify on arrival, which is the step that makes all of the above optional.