A university repository is supposed to help people find research, theses, dissertations, and other academic work. When someone searches for a publication, they expect to arrive at a reliable source of information—not a page promoting online gambling.
During a security review, our Open Journal Theme team used targeted Google searches, often called Google dorking, to check whether repository domains were appearing in results they should not be associated with. One of those searches led us to a worrying discovery: a group of gambling-related pages appearing under an academic repository domain.
The repository homepage did not need to look obviously damaged for this to matter. The search results alone showed that the institution’s domain was being associated with material completely unrelated to its academic purpose.
Table of Contents
The First Warning Sign: Gambling Content in Search Results
Figure 1. Search results recorded during the review showed gambling-related titles associated with an academic repository domain.
The first screenshot recorded by our team showed several Google results with titles and descriptions related to online slot games. The listings appeared under a repository website, rather than a gambling website. That was the first clear sign that something was wrong.
This can be a sign of search spam. Attackers may use a trusted academic domain to promote unrelated pages. Some incidents involve SEO cloaking—showing different content to search engines and visitors—but these results do not prove that happened here. The listings could also come from unwanted files or injected pages.
Turning a Google Result Into a Search-Scope Check
A screenshot is a starting point, not an incident timeline. The next step is to collect the exact affected URLs, the keywords Google associates with them, and the current page response. For an authorized review, a focused search can help reveal whether the suspicious listings extend beyond one URL.
SEARCH QUERY / ILLUSTRATIVE EXAMPLE
site:repository.example.edu (“slot” OR “gacor” OR “togel”)
site:repository.example.edu inurl:id/eprint “casino”
For repository managers, the important point is simple: if Google is showing gambling keywords under your academic domain, the issue deserves investigation even if the homepage still opens normally.
A Second Discovery: An Unwanted Page on an EPrints URL
Our team’s notes also documented a second example on a different EPrints repository. This time, the evidence was not limited to Google search results. A page reached through a repository document-style URL displayed gambling promotions instead of academic material.
The recorded URL followed an EPrints-style path containing /id/eprint/, which made the finding especially concerning. That path is normally associated with repository records and their documents. Seeing unrelated promotional content there raises questions about what files were stored or served, and who had permission to place them there.
The two screenshots came from separate repository domains. They illustrate related warning signs, but they do not establish that both websites were compromised through the same method.
Technical Detail: Checking What the EPrints URL Actually Serves
A record-style URL containing /id/eprint/ is not automatically a vulnerable endpoint. Depending on the EPrints configuration, it can identify a record or document. We first establish what the server returns and whether it matches the academic record expected at that address.
TECHNICAL EXAMPLE / READ-ONLY
URL=”https://repository.example.edu/id/eprint/12345/”
curl -sSI –max-time 15 “$URL”
curl -sSL –max-time 15 “$URL” \
| grep -Ein ‘<title>|slot|gacor|togel|casino|<iframe’ \
| head -n 20
Look for an unexpected page title, unrelated links, content type, or redirect. A keyword match alone is not proof of malicious code; compare it with the approved repository record and archived evidence.
What Suspicious Page Markup Can Look Like
An unauthorized document can be a simple HTML page rather than a changed EPrints core script. In a security review, an off-domain redirect paired with irrelevant promotional metadata would be a reason to identify the uploader and trace the file history.
ILLUSTRATIVE HTML / NOT CASE EVIDENCE
<!– Sanitized demonstration; not recovered client code –>
<title>Casino Bonus | Academic Repository</title>
<meta http-equiv=”refresh”
content=”0;url=https://example.invalid/promotion”>
<a href=”https://example.invalid/promotion”>External promotion</a>
Why a Repository Can Look Normal While It Is at Risk
One of the difficult things about this type of incident is that everyday users may not notice it. The main repository pages can remain accessible. Researchers may still download papers, and staff may still be able to sign in. Meanwhile, search engines can continue discovering suspicious pages hidden deeper in the website.
This is why our team does not rely only on checking the homepage. We look at what the repository is serving through its public URLs and what search engines have already indexed. The question is not only whether EPrints is running, but whether it is serving the content the institution actually intended to publish.
Where We Look When Investigating an EPrints Incident
The screenshots show the symptoms, not the exact point of entry. Without server logs, file records, account history, and a review of the installation, it would be misleading to claim that a particular EPrints core file was hacked.
Instead, an EPrints investigation should focus on the places where unwanted content could have entered or been exposed. That includes uploaded document files and their access permissions, repository user accounts, publishing and approval workflows, custom plugins or scripts, and server-level settings that decide how files are delivered to visitors.
We also check whether unusual files are present in document storage, whether important configuration files have changed unexpectedly, and whether administrator or server credentials may have been misused. An HTML file appearing beneath an EPrints document URL does not automatically mean the EPrints application itself was modified. Finding the difference is an important part of doing the work properly.
Technical Detail: Reviewing EPrints Document Storage
In a typical EPrints 3 installation, repository-specific content is stored under archives/ARCHIVEID/. Uploaded documents live in its documents/ directory, while configuration and generated HTML occupy separate paths. That separation matters: an unwanted file in uploaded content is a different incident from a modification to application code.
TECHNICAL EXAMPLE / READ-ONLYEPRINTS_ROOT=”/opt/eprints3″ # Adjust to the actual installation
ARCHIVE_ID=”repository” # Confirm the real archive ID
DOC_ROOT=”$EPRINTS_ROOT/archives/$ARCHIVE_ID/documents”
# Recent file changes: evidence triage, not proof of an attack
find “$DOC_ROOT” -type f -mtime -14 \
-printf ‘%TY-%Tm-%Td %TH:%TM %p\n’ | sort -r | head -n 25
# Script-like or HTML files: check against legitimate uploads
find “$DOC_ROOT” -type f \
\( -iname ‘*.php’ -o -iname ‘*.phtml’ -o -iname ‘*.html’ \) \
-print
Technical Detail: Correlating Files With Access Logs
Finding an unusual file is only one part of the investigation. A stronger assessment ties the file to server-side metadata and requests for the affected URL, then checks whether it was created through a legitimate EPrints workflow or an unauthorized access path.
TECHNICAL EXAMPLE / READ-ONLY# Preserve identifying attributes for a candidate file
stat “/path/to/reviewed-file.html”
sha256sum “/path/to/reviewed-file.html”
# Example Apache log path: adapt to the actual deployment
grep -F ‘/id/eprint/12345/’ /var/log/apache2/access.log \
| tail -n 20
Our Approach: Investigate First, Then Recover Safely
When an academic repository is affected, deleting a suspicious page is often the easiest part. The harder task is understanding how it got there and making sure the same issue does not return.
Our EPrints incident-response approach starts by preserving the relevant evidence, identifying affected URLs, and checking the repository’s files and access history. From there, the team can isolate unauthorized content, review suspicious accounts, inspect server configuration and extensions, and close the access path once the cause has been confirmed.
Recovery also needs to protect legitimate academic records. A rushed cleanup can accidentally remove research files or disrupt access to published work. We therefore treat backups, file integrity, and repository availability as part of the security work—not separate concerns. For long-term prevention, institutions can also explore our EPrints security hardening and support services.
After cleanup, the search results and affected paths should be monitored for reappearance. Search engines may continue to show old titles or snippets for some time, so the public search results need to be checked alongside the live repository. Google Search Console’s URL Inspection tool can help repository owners check corrected pages as Google recrawls them.
Technical Detail: Verifying Recovery Beyond the Homepage
After containment and an authorized restoration, testing only the homepage is not enough. The previously affected URL, its real publication metadata, and linked documents need to be checked alongside access controls and continued search-index monitoring.
TECHNICAL EXAMPLE / READ-ONLY
URL=”https://repository.example.edu/id/eprint/12345/”
# Verify the response on the previously affected route
curl -sSL –max-time 15 -o /tmp/eprints-review.html \
-w ‘HTTP %{http_code} | Type %{content_type}\n’ “$URL”
# Screen the returned page for selected spam indicators
grep -Ein ‘slot|gacor|togel|casino’ /tmp/eprints-review.html \
|| echo ‘No selected spam terms found in this response’
Signs Your EPrints Repository May Have Been Compromised
This case is a reminder that repository administrators should watch for more than obvious homepage defacement. Warning signs can include:
- Google results with gambling keywords or snippets that do not match the page a visitor sees.
- Unknown HTML pages or promotional content under repository document URLs.
- Unexpected files, links, or redirects—and suspicious pages that keep returning after removal.
- Unrecognized user accounts or unexplained changes to administrative access.
None of these signs identifies a specific vulnerability on its own. Together, though, they provide good reasons to review the repository before its content, reputation, or discoverability is affected further.
What This Case Taught Us
The strongest lesson from these findings is that a repository security problem may first appear outside the repository itself. In this case, one clue came from Google search results. Another came from opening a suspicious page under an EPrints document path.
For our team, those discoveries pointed to two parts of the same responsibility: protecting the files an institution publishes and protecting the trust people place in its domain. It is not enough to remove an unwanted result from search. The underlying repository and server environment must also be checked, so the same content cannot simply return.
The material presented in this article documents suspicious search listings and a gambling-themed page on separate EPrints domains. The screenshots alone do not reveal an entry point or a complete restoration timeline. That is why our technical examples show how investigators validate, preserve, and verify evidence rather than inventing a specific exploit or server log.
Conclusion
An EPrints repository is part of an institution’s research infrastructure. When unrelated pages appear under its domain, the problem is not just how the website looks. It can affect the credibility of the repository and make it harder for users to trust the content they find.
This case shows why careful detection and platform-specific investigation matter. By combining search-result checks with an understanding of EPrints document handling and server configuration, our team was able to recognize the warning signs and identify the areas that require attention. For repository managers, finding the problem early is an important first step toward a safe and lasting recovery.
Concerned About Your EPrints Repository? Let Our Team Help
If your repository is showing unusual search results, unexpected pages, suspicious files, or signs of unauthorized access, Open Journal Theme can help you investigate the issue and plan the next steps. Our team works with EPrints installation, hosting, maintenance, upgrades, and technical support, with a focus on keeping academic content accessible and protected.
