Malicious landing page on
Today while searching in Google, a strange URL caught my attention: The Dutch domain sounds like a name for a legitimate advice company, but why would they have a page about a drug? Out of curiosity I clicked the link and saw an online pharmacy in English on the Dutch domain Each link on this page points to a page on This is all very suspicious, especially since looks like a sincere website for a financial company. So I decided to investigate this and found an entire web of malicious landing pages to

More than one landing page to

I suspected the website was hacked and a landing page for was added. The first thing I did was to contact the owner of to notify them about it. Then I asked myself how Google could index this page. So I searched for “” and found more landing pages to on*.

Web of landing pages to

box4rx malicious links to landing pages
cirkus_se malicious landing page

But more importantly I found two websites linking to these landing pages: and They contain a few pages with long ugly lists of links to pharmacy products on other websites, which is one of. I opened some of the other links and saw similar landing pages to I realized I found an entire web of landing pages!

How it works

The higher the organic position of a website in Google, the more visitors it gets. For a web shop this means more revenue. More links pointing to a websites generally means a higher organic position (Link building). In this case landing pages where added to vulnerable websites to increase the organic position of The homepages were not altered to prevent the webmaster from noticing it, so the landing pages would not be removed.

But the hidden malicious landing pages must be indexed by Google. An easy way to do this is to link to them from websites that already have been indexed. does not link to them itself as reciprocal links have little or no value for a higher organic position. So and are used for this.

Hacker safe?

I browsed around and got to the Checkout page. According to the bar below it should be safe to order here, but somehow it doesn’t feel so… hacker safe