JMIR Publications

ABSTRACT

Background:

Illegal online pharmacies function as affiliate networks, in which search engine results pages (SERPs) are “poisoned” by several links redirecting site visitors to unlicensed drug distribution pages by initially clicking on the link of a legitimate, yet irrelevant domain. This unfair online marketing practice is commonly-referred to, search-redirection attack, portraying a decisive role in the illegal internet pharmaceutical marketplace.

Objective:

In our current study, we describe the mechanism, map and present national and international significance of search redirection attacks.

Methods:

Notably, our search engine query results regarding four erectile disfunction medications were documented and evaluated using Google with search terminology using “active ingredient” and “buy” in the language of the evaluated country, including Hungary and eleven other European countries, from 2019 through 2021. The final destination website legitimacy was checked at Legitscript.com, and the estimated number of monthly unique visitors was obtained from Semrush.com traffic analytics. Compromised links leading to international illegal medicinal product vendors via redirection were analyzed using Gephi graph visualization software.

Results:

Compromised links redirecting to active online pharmacies were present in search query results of all evaluated countries. The prevalence was highest in Spain (n=62, 18.1%), Hungary (n=52, 15.2%), Italy (n=46, 13.5%) while the lowest in Finland (n=12, 3.5%), Croatia (n=10, 2.9%) and Bulgaria (n=2, 0.6%) recorded in November 2020. A decrease in the number of compromised sites linking visitors to illegitimate medicine sellers were observed in the Hungarian dataset between 2019 and 2021, from 41.3% to 5.0%, respectively. Out of 1920 search results in the international sample, 380 (19.8%) search query results were compromised, with the majority (n=342, 91.1%) of links redirecting individuals to 73 international illegal medicinal product vendors. The majority of these illegal online pharmacies (53.2%) received only one or two compromised links, meanwhile, the top three domains with the highest in-degree link value received more than one-third of all incoming links. Traffic analysis of 35 pharmacy specific domains, accessible via compromised links in search engine queries, showed a total of 473,118 unique visitors in November 2020.

Conclusions:

Although the prevalence of compromised links in SERPs has shown a decreasing tendency in Hungary, an international search query dataset emphasizes the international significance of search engine poisoning. Our research illustrates that search engine poisoning is a constant threat as illegitimate affiliate networks continue to flourish as uncoordinated interventions by authorities and individual stakeholders remain insufficient. Ultimately, without a dedicated and comprehensive effort on the part of search engine providers to effectively monitor and moderate SERPs, they may never be entirely free of compromised links leading to illegal online pharmacy networks.