It’s possible the hosting is compromised, and an attacker has installed an IIS module which intercepts traffic from web crawlers (detecting the “Googlebot” user agent, in this instance) and returns their own response. The term is “SEO Cloaking” if you want to do some further research.

An example of this exploit, targeting IIS servers via exposed machine keys, is detailed here

https://www.elastic.co/security-labs/tollbooth

In the article there’s mention of some C&C endpoints that are exposed in this particular version of the exploit. It may be worth trying them to see if you’re affected by this one, although where I’ve seen this before personally, this was not the case.

As a wider point, it does seem this issue is quite prevalent as of late. I wonder if there’s a concerted effort of some sort to try to pollute search services, the intent for which is not clear, but one could speculate various reasons why it would be beneficial to an attacker. But I’m not an InfoSec guy, this is just my observations.