Fake earnings stories attributed to a hijacked-looking Ethiopian government domain remain live on Google Finance today, nearly three weeks after Google's second global spam update of 2026 began rolling out. Direct visits confirm the pattern on the Criteo and Zeta Global ticker pages, where clicking the headlines redirects not to any article but to a WhatsApp group chat invite for a purported stock trading club. Same-day search results suggest the same template may sit on at least fourteen further stocks. Neither Google nor Ethio Telecom, the operator of Ethiopia's national domain registry, has addressed the case.

The finding is narrow but checkable, and that is what makes it uncomfortable for a company that has spent 2026 running an unusually active spam enforcement cycle. A product Google operates directly, built on Google's own index and aimed at people researching real money decisions, is attributing US equities earnings stories to a domain registered to a federal notarization office in Addis Ababa - the mismatch between registrant and content that makes the domain look hijacked in the first place.

What the ticker pages show

A review of Google Finance stock pages conducted today found that dars.gov.et continues to appear in the platform's "News stories" module as the purported source of earnings stories on companies with no connection to Ethiopia or to one another. The domain sits under .gov.et, a restricted country-code extension reserved for Ethiopian governmental use. On paper it belongs to Ethiopia's Documents Authentication and Registration Service, a federal notarization agency whose own website, written entirely in Amharic, describes queue times and document-verification procedures at branch offices in Addis Ababa and Dire Dawa. Nothing in the agency's stated mandate touches equities, financial data, or publishing of any kind.

Two instances are confirmed by direct visits. The Criteo page displays a dars.gov.et item headlined "CRTO Q1 2026 Earnings: Earnings Beat by 26.6% but Stock Declines 7.8% - Earnings Seasonality." The Zeta Global page carries "ZETA Q1 2026 Earnings: EPS Surges Past Estimates, Stock Slides - Growth Acceleration Report." The fabrication sits in the journalism rather than the numbers: the results the headlines quote are consistent with what the companies actually reported, which makes the items harder to dismiss at a glance, yet no articles exist behind them. Both sit inside the same news module that surfaces legitimate coverage, with nothing to distinguish the fabricated source from the real ones. Two unrelated tickers showing the same template from the same implausible domain is a documented anomaly rather than a rendering glitch, and the phrase "continues to appear" is doing real work: the pattern has now survived multiple reviews.

The headlines do not lead to news coverage. Clicking the dars.gov.et items during the review conducted today redirects the browser away from the Ethiopian domain entirely and onto a WhatsApp group chat invite page for a group named 88 Richard Cleary US Stock Club (CFA). The destination is WhatsApp's standard invite screen, presenting "Open app" and "Continue to WhatsApp Web" buttons beneath the group name, and the fabricated headlines tested during the review resolve to this same invite rather than to any page on the government domain whose name they carry.

Two details on the invite page stand out. The parentheses enclosing the CFA designation, the credential of a chartered financial analyst, are full-width characters standard in Chinese, Japanese, and Korean typesetting rather than the ASCII parentheses a US financial publisher would normally produce. And the group's profile image, a digitally rendered bull charging across candlestick charts, carries a visible Shutterstock watermark labeling it an AI-generated image, indicating an unlicensed preview rather than a purchased asset.

The redirect reframes what the fabricated headlines are for. A hijacked government domain gaming Google's index for ranking signals would be a search-quality story on its own. Headlines built to move readers off Google Finance and into a private messaging group invoking an individual's name and a professional credential describe a recruitment funnel, and the structure matches a pattern federal agencies have documented at scale. The FBI's 2025 internet crime report references a July 3, 2025 public service announcement describing fraudsters targeting United States stock investors through investment clubs accessed on social platforms and messaging applications, while 2025 FTC data recorded investment schemes as the costliest social media fraud category, with operators assembling WhatsApp groups stocked with fake testimonials from supposedly successful investors. Whether any real individual named Richard Cleary has a connection to the group could not be established, and this article makes no claim that one exists; invoking trusted figures and professional credentials is itself a recurring feature of the schemes those agencies describe.

Fourteen more tickers remain unverified

A search conducted the same day returned results suggesting the template recurs well beyond the two confirmed pages. Snippets showed what appeared to be a DoorDash headline reading "DASH Q1 2026 Earnings: EPS Beats Estimates by Nearly 13% as Profitability Improves - Low Growth Earnings," attributed to the same domain. Similar snippet-level results surfaced for Procter & Gamble, Enterprise Products Partners, Sidus Space, Wise Group, Upstart Holdings, United Airlines, and Paramount Skydance, each following the recognizable structure of a ticker symbol, a claimed earnings result, and a secondary label such as "Zero Gamma Level" or "Financial Health Score."

None of those fourteen additional pages has been checked by direct visit. Their inclusion here flags a pattern warranting further verification, not a confirmed total. The distinction matters in both directions: the confirmed footprint is smaller than the search results imply, and the real footprint may be considerably larger than what direct visits alone have established.

An enforcement apparatus built for exactly this

The silence around the case is notable because Google has spent much of 2026 tightening exactly this category of enforcement. A March 2026 spam update took effect on March 24, and a June 2026 spam update began on June 24 at 09:03 PDT. According to Google's documentation, both apply "globally and to all languages," and both run through SpamBrain, the AI-based detection layer underpinning the company's automated enforcement.

The policy categories fit the fact pattern closely. Google's expired domain abuse and site reputation abuse policies, announced on March 5, 2024 and effective from May 5, 2024, were written specifically to address domains hosting content inconsistent with their established purpose in order to exploit accumulated ranking signals. A government-restricted domain publishing US earnings content is about as clean an example of purpose-inconsistent content as the category allows. Whether either policy applies to this specific case is a question Google has not addressed. Ethio Telecom, the state-owned operator that administers the .et registry, has issued no public statement either, and the agency's own website carries no notice of a security incident.

There is a documentation history here too. Google did not formally clarify that its spam policies apply to AI-generated surfaces in Search at all until May 15, 2026, when it extended the rules to cover AI Overviews and AI Mode - roughly two years after AI Overviews launched at scale in May 2024. The gap between shipping an AI-driven surface and formally policing it is, on the record, measured in years rather than weeks.

A documented pattern predates this case

The Google Finance headlines fit a pattern that PPC Land has reported since May 2025, when research documented manipulation inside AI Overviews, including self-promotional listicles that ranked their own publishers as "best in category" and were cited by Google's AI feature as if independently authoritative. Lily Ray, an SEO strategist quoted in that reporting, argued the shift marked a departure from the company's own history of updates like Panda and Penguin that targeted low-quality content, saying it "sort of feels like they've thrown that legacy to the wayside." That is Ray's characterization rather than an established fact about Google's internal priorities, but it is a named, on-record assessment that maps closely onto what the Finance pages show: a regularly updated spam apparatus sitting alongside cases it has not caught.

A separate PPC Land analysis, "The AI slop loop," traced the mechanism by which fabricated claims can enter and persist within AI-mediated results: false information gets published, is cited by retrieval-based systems, generates further AI-produced content repeating the claim, and accumulates citation volume that those systems treat as a signal of accuracy. The mechanism does not require an absence of review at any single point. It describes how automated citation compounds an error faster than any review process catches up.

A separate pressure builds against the same index

Unconnected to any of this, the publishers who feed Google's index are moving from complaints toward timelines, according to reporting published on July 8, 2026 by Mark Stenberg in Adweek's On Background newsletter. The structural grievance is that Googlebot indexes sites for search and gathers content for AI products through a single crawler, so a publisher cannot refuse one function without disappearing from the other.

Cloudflare, which according to Adweek hosts roughly one-fifth of the world's websites, announced on July 1 that from September 15, 2026, new customers and existing free-tier customers will have default settings that block what it calls "multi-purpose crawlers" on any page carrying ads. Cloudflare chief strategy officer Stephanie Cohen told Adweek the company wants publishers to remain discoverable without giving their content away at no cost. USA Today Inc. went further: CEO Mike Reed told Adweek the company is prepared to delist from Google Search entirely within six to twelve months, resting future monetization on licensing agreements with Meta, Microsoft, and Amazon, and noting that Google, unlike those companies or AI firms including OpenAI and Anthropic, has struck no publisher licensing deals. The creator network Beehiiv announced a parallel Cloudflare partnership letting its creators block Google's crawler, Adweek reported.

Google disputed the framing. A spokesperson told Adweek the company already offers granular controls, pointing to Google-Extended for AI training and a Search Console control being tested for generative AI search features, and said neither affects standing in traditional search. Publishers remain skeptical; according to Adweek, executives at two unnamed media companies said they worry Google-Extended could quietly penalize search visibility. Google's own executives have conceded the engineering difficulty: Sulina Connal, the company's managing director for news and books partnerships in Europe, described a clean AI Overviews opt-out as a "huge engineering project" at a February 11, 2026 conference. The UK Competition and Markets Authority imposed a binding Publisher Conduct Requirement on June 3, 2026, and Google launched a Search Console opt-out toggle for a subset of UK publishers the same day, though the requirement's main obligations take force in December 2026. No comparable binding rule exists in the United States, where a federal judge dismissed a newspaper-publisher antitrust suit against Google in April 2026.

The economics behind the standoff are quantified. Google Web Search traffic to news publishers fell from 51 percent of referrals in 2023 to 27 percent in the fourth quarter of 2025, according to NewzDash analysis of more than 400 publishers. A randomized field experiment found AI Overviews reduce outbound organic clicks by 39.8 percent when the feature appears. Yet blocking carries its own cost: a Rutgers and Wharton working paper found publishers who blocked large language model crawlers lost roughly 7 percent of weekly traffic within six weeks, with the decline visible in human browsing panel data.

Why this matters for the marketing community

The two developments are not causally linked, and this article does not claim they are. What binds them is the asset they both stress: the reliability and reach of Google's index. The Finance pages expose a quality-control failure inside a product Google operates, one that SpamBrain and the named policy categories covering expired and reputation-abused domains exist specifically to catch. The publisher standoff is the opposite kind of pressure, a structural objection to a system working exactly as designed.

For financial advertisers and investors, the failure is not abstract. Anyone researching Criteo through Google Finance during the company's ongoing acquisition situation, covered separately by PPC Land, encounters a fake earnings story sitting beside legitimate reporting on the buyout talks - and one click away from it, an invitation to join a private trading group of the kind federal agencies have warned recruits US stock investors. For the search and SEO community, the case supplies a concrete, revisitable test of whether Google's 2026 enforcement cycle reaches its own financial product. And for publishers weighing Cloudflare's September default or a delisting timeline of their own, the spectacle of a spoofed government domain outranking silence from Google is one more data point in a calculation about what participation in this index is still worth.

Timeline

  • March 5, 2024 - Google announces its site reputation abuse and expired domain abuse spam policies, effective May 5, 2024.
  • May 2024 - AI Overviews launch at scale across Google Search globally.
  • May 2025 - PPC Land reports on research documenting spam and manipulation inside AI Overviews, including self-promotional listicles cited as authoritative sources.
  • December 23, 2025 - NewzDash analysis of more than 400 publishers finds Google Web Search traffic to news sites fell from 51 percent to 27 percent of referrals between 2023 and the fourth quarter of 2025.
  • February 11, 2026 - Google's Sulina Connal describes building a granular AI Overviews opt-out as a "huge engineering project" at a London publishing conference.
  • March 24, 2026 - Google's March 2026 spam update is released globally.
  • April 2026 - A federal judge dismisses a newspaper-publisher antitrust suit against Google.
  • May 15, 2026 - Google formally clarifies that its spam policies apply to generative AI responses in Search, including AI Overviews and AI Mode.
  • June 3, 2026 - The UK Competition and Markets Authority imposes a binding Publisher Conduct Requirement on Google; Google launches a Search Console AI opt-out toggle the same day for a subset of UK publishers.
  • June 24, 2026, 09:03 PDT - Google's June 2026 spam update is released globally.
  • July 1, 2026 - Cloudflare announces that from September 15, 2026, new and free-tier customers' default settings will block multi-purpose crawlers on ad-carrying pages.
  • July 8, 2026 - Adweek publishes Mark Stenberg's reporting on Cloudflare's crawler policy, USA Today Inc.'s stated six-to-twelve-month delisting timeline, Beehiiv's parallel partnership, and Google's response.
  • July 13, 2026 - Direct visits to Google Finance confirm dars.gov.et cited as a news source on Criteo and Zeta Global, with the fake stories redirecting to a WhatsApp group chat invite for "88 Richard Cleary US Stock Club（CFA）"; a same-day search surfaces the same pattern of fake earnings stories on fourteen further tickers, unconfirmed by direct visit. No public statement from Google or Ethio Telecom addresses the domain.

Summary

Who: Google, through its Google Finance product; dars.gov.et, a domain registered under Ethiopia's restricted .gov.et extension and belonging on paper to a federal notarization agency; Criteo and Zeta Global, confirmed by direct page visits to display the fabricated content; a WhatsApp group presenting itself as "88 Richard Cleary US Stock Club（CFA）", to which the fabricated headlines redirect; fourteen further publicly traded companies whose pages appear to show the same pattern in search results but remain unverified; and, separately, publishers including Cloudflare, USA Today Inc., and Beehiiv preparing measures against Google's crawler.

What: Direct visits to Google Finance ticker pages today confirm fake earnings stories sourced to a government-restricted Ethiopian domain on Criteo and Zeta Global - stories whose quoted figures track the companies' actual reported results but which lead to no articles - persisting despite Google's March and June 2026 spam updates and the 2024 policy categories written for purpose-inconsistent domains. Clicking the headlines redirects not to any page on the Ethiopian domain but to a WhatsApp group chat invite for a purported stock trading club, matching a recruitment pattern federal agencies have warned targets US stock investors. A same-day search surfaces the same template on fourteen further tickers, flagged here as an unverified signal. In a separate development, Cloudflare has set a September 15, 2026 default crawler-blocking policy and USA Today Inc. has stated it may delist from Google Search within six to twelve months, according to Adweek.

When: The Google Finance pages were visited and the corroborating search conducted today, July 13, 2026. The publisher developments were reported by Adweek on July 8, 2026, building on Cloudflare's July 1, 2026 announcement.

Where: The fabricated headlines appear globally within Google Finance; the domain is registered under Ethiopia's country-code extension administered by Ethio Telecom; the publisher standoff spans Cloudflare's global network and publisher decisions in the United States and elsewhere.

Why: The persistence of fake financial news stories inside a Google-operated product, through two global spam updates and more than two years after the relevant policy categories took effect, is a concrete measure of the gap between Google's stated anti-spam enforcement and what its AI-assembled surfaces show users. The WhatsApp redirect raises the stakes beyond index hygiene: the content operates as an active funnel into a private messaging group, the recruitment channel federal agencies have repeatedly flagged in investment fraud targeting US stock investors. PPC Land has documented the broader enforcement gap since May 2025 across AI Overviews and related products, and named practitioners including Lily Ray have argued on the record that it reflects a change in priority rather than a temporary oversight. The separate publisher-crawler standoff adds a second, structural pressure on the same index, at a moment when publishers hold concrete data on what participation in it costs them.