Maybe I'm just not seeing the underlying problem? But I think it's pretty straightfoward:
"When searching for something directly from the address bar, ..."
If the user types in Bing.com, and Opera redirects to ysrcunow that is a serious breach of trust.
The user does not appreciate receiving the wrong domain name.

My solution wouldn't be a problem with certificates, because it would just be in the hosts file. But, my solution wouldn't work, because (AFAIK), you can't ricochet host name to host name in the hosts file, just host name to IP.

While they say it's fixed, the larger questions still loom.

But, as I mentioned earlier, Opera's security team has removed this redirection.

The problem is solved.

I'm concerned as to where, exactly, the substitution is being done.

If they (Opera) are snatching your URL request and replacing it, that's really not kosher., and I would be really pissed off at this behaviour.

If it's being done through some config/JSON files, at least that would be something we could look at, and maybe figure out and play Hobb with - only slightly better than it all being done behind the curtain.

Both are considered borderline evil, in my book.

Bing search is fine while ysrcunow.com is stil blocked.

Thanks to the security team!

FWIW I am a sysadmin for nearly 22 years, but I'm not retired yet. You are a lucky one!

I find this behavior suspicious, and it has raised concerns among several security agents, firewall, antivirus, etc. Could there be a malicious configuration in your product?

Ultimately, this is the easiest and most reasonable. Of course it means you'll have to apply this change to all machines you have Opera on. This easy fix will help those who are concerned with this.

So on all OSes, there is a config file named: "hosts". On Unix style OSes (like Linux), it's path is:
/etc/hosts

On Windows OSes, the path is:
c:\Windows\System32\Drivers\etc\hosts

You have to be the root user to edit it. Open the file in your favorite text editor, and append this line:
0.0.0.0 ysrcunow.com

Basically, your browsers and such need to resolve the spelled-out-website-name into an IP numerical address, and then it reaches out to the website using that value. The first thing it does is look in the "hosts" file for the numerical address - if found, it uses it ... otherwise, it reaches out to the your DNS server (like a phonebook of the Internet) for the translation.

Basically, the address "0.0.0.0" is a dead address, ie, it resolves to "nothing", so your browser will NOT be directed to the actual website.

That's it. Good luck to all. I will post this here, and to another thread regarding this concern. The user leocg will probably comment, but doesn't matter. I've also seen this person posting out to a Reddit thread (with a slightly different username, but similar pattern: gomesleo).

(Sidenote: FWIW, I'm a software engineer with 35+ years experience (now retired ... I'm also a published author of four computer books), and spent quite a while with the security team. This is very questionable. After I'm done posting, I will be gone from this forum, and will uninstall Opera from all four of my machines, and will pass on the info to many others).

If this is by design on Opera's part (which is implied by its presence in the default_partner_content.json file of multiple users), Opera ought to provide users with a clear explanation of what is going on and why.

I asked Opera. It's indeed legit, intentional and by design. The redirect is so https://ysrcunow.com/ gets credit for Bing searches. https://ysrcunow.com/ must be a partner now or something.

I run a Linux OS, openSuse Tumbleweed, and have Opera installed:
(Opera One 104.0.4944.33, Stable,
Freedesktop.org SDK 22.08 (Flatpak), Chromium version:118.0.5993.96).

I did a global search for the filename in my home sub-dir.

:~> find . -name default_partner_content* -ls

It found three occurrences of the file, in various Opera sub-directories. Only one of those three files had the entry
(71 occurrences!):

"bing_attributed_ysrcunow",

And the URL:

"search_url": "https://ysrcunow.com/results.aspx?gd=RD1003896&searchsource=58&q={searchTerms}",

A quick Google search revealed about 4-5 websites, showing a low rating of that URL, plus the Reddit thread.

Somewhat disturbing, indeed !! Thanks for posting

I tried to modify the file, but it is impossible, the browser doesn't work anymore.

My antivirus is always "on".

As I said, it's something from the Opera Browser itself. I found it in the file C: > User > [USER] > AppData > Local > Programs > Opera > 104.0.4944.33 > resources > default_partner_content.json

It should be written "bing" and only "bing", I don't understand what is that "_attributed_ysrcunow" and I don't want it.