Prevalence of Poisoned Google Search Results of Erectile Dysfunction Medications Redirecting to Illegal Internet Pharmacies: Data Analysis Study

Introduction

Background

The inherent practicality and convenience of online shopping are proving increasingly influential in consumer’s behavior worldwide. Based on the 2020 e-commerce statistics published by Eurostat [1], 89% of all European Union (EU) citizens used the internet within the last 12 months, and 65% of individuals made an online purchase in the same period. Nonprescription medicine or dietary supplements accounted for 28% of these transactions, demonstrating consumers’ growing trust in online health- and well-being–related purchases [1]. A large-scale study [2] of changes in information-seeking behavior showed that the most frequently mentioned content is “product information” and “purchase” (30% of all responses in 1997 and 2019), followed by “Health” (18% of all responses in 1997 and 19% in 2019) [2]. Notably, user behavior had been remarkably consistent in the span of 22 years [2].

The use of internet pharmacies and the number of individuals obtaining medications and various health products online are increasing [2]. Several advantages including perceived anonymity, cost savings, and convenience motivate individuals to purchase medications online [3]. Furthermore, the lack of a valid prescription required by legal online and offline vendors is a strong driving force toward illegal online drug purchases [3]. However, several patient safety risks are linked to the procurement of medicines outside the traditional supply chain, including questionable sourcing, poor product quality, substandard and falsified medicines, improper storage, and transportation [4]. Risks are augmented by rogue internet pharmacies considered as a primary source of substandard and falsified medical products in developed countries [5-7].

The widespread availability of search engines and increased public interest in obtaining medicines online imply a major dilemma, whether consumers aiming to purchase medications from the internet are starting their online activity from relevant web pages (eg, a national authority website), or simply searching using their search engine of choice. Most likely the latter is the case. Search engines refer consumers to relevant online resources quickly. Their significance is illustrated by the fact that most trackable website traffic originates from search engines [8], and typically from Google as this platform is handling more than 90% of search queries worldwide. Online distributors choose to use several digital marketing techniques to attract customers via search engines. Website operators apply various search engine optimization (SEO) techniques to improve the visibility of their websites, a practice that is accepted and supported by search engines [9]. SEO is a complex and time-consuming procedure, especially in the international marketplace in which country- and language-specific optimization is required to reach a high-ranking position among organic query results.

For illegal medicine sellers, conventional SEO is neither cost- nor time-effective, as they are constantly threatened with regulatory closure [10]. Furthermore, paid advertisements offering prescription drugs without a prescription by unauthorized pharmacies cannot appear in any of the major paid search advertising services [11,12]. Therefore, alternative dishonest digital marketing methods including web spamming, forum abuse, and additional “black hat” SEO techniques are used by illegal drug distribution websites to promote their links in the unpaid search engine results pages (SERPs) to gain favorable search engine rankings [13,14].

As a result, the user’s query on a search engine may contain both “normal” domains (ie, those related to the query) and “compromised/deceptive” domains (ie, ones that are unrelated to the query). The latter domains are promoted in the rank using “black hat” SEO methods, undermining the value proposition of search engines, as search results are presented with deceptive views of a website with inflated relevance to selected search terms. Individuals (search engine users) are referred to low-quality content or malicious websites when clicking on a deceptive search result. Consequently, the deceptive web pages practically “poison” the search result; therefore, this technique is termed as “search engine poisoning” or “search redirection attack” [9,15].

Manipulation of search results for erectile dysfunction medications was published nearly a decade ago by Leontiadis et al [15,16] and Wang et al [17]. Sildenafil was the first commercially available phosphodiesterase type 5 (PDE5) inhibitor available since 1998, followed by vardenafil, tadalafil, and avanafil [18]. Increasing prevalence of erectile dysfunction and widespread use of PDE5 inhibitors as the first-line oral treatment worldwide [19] have resulted in growing demand, which illegal online vendors have been taking advantage of [20].

Objectives

The major aim of our study is to introduce the relatively unknown but significant and persistent issue of poisoning of search engine results (SERs) of erectile dysfunction medications in European countries. Furthermore, the study is meant to measure the scale of the problem and illustrate the redirection networks referring users (patients) to illegal internet pharmacies. Public health significance of the problem is illustrated by the estimation of the likelihood of consumers clicking on poisoned search results and the number of monthly visitors redirected to illicit pharmacy networks. Our utmost aim is to warn the general public and raise the awareness of authorities and law enforcement agencies, thus facilitating long-awaited countermeasures.

Methods

Mechanism of Search Engine Poisoning and Redirection

A search engine poisoning attack begins with an attacker hacking into a vulnerable web page. Common targets are outdated, vulnerable, or complex content management and blogging systems (eg, WordPress; see Figure 1, part 1). Once the attacker has access to the system, a new code is injected, and the hacked website will “interrupt” all incoming HTTP requests to the original web page and respond to these requests differently from the original operation [15]. Typically, users are redirected through a redirection chain, consisting of intermediate pages to a final page. The destination is the illegal pharmacy website most users are unwillingly visiting. However, users do not see the original content of the compromised website after clicking on the search results, because they are presented with the unwanted final page, as hacked websites redirect the web browsers within milliseconds. Redirection attacks—identifiable in various search engines such as Google, Bing, and Yahoo!—disregard term relevance constraints and target search terms of the actual search; however, at the same time, the original content of the hacked website (domain) becomes irrelevant to the search terms used (see Figure 1, part 2).

‎View this figure

In the case of search engine poisoning attack, it is important that compromised websites look differently, depending on the visitor, due to the so-called cloaking method [13]. The original content stuffed with keywords and links to increase page rank is shown to the automated agent/crawler (eg, Google bot), meanwhile the redirected illegitimate online vendor is displayed to the customer (see Figure 1, part 3) [16]. Currently no efficient technique capable of identifying all spam web pages is available [13]. Because of the cloaking method used by the illegitimate pharmacy operators, the automation of the content evaluation of SERs is difficult and precise detection requires manual assessment or checking.

Obtaining and Evaluating SERs in National and International Data Sets

Search engine query results and links were documented and manually evaluated to simulate and evaluate what consumers see while browsing. Manual data acquisition was necessary as automatic search queries are prohibited by search engine providers and cloaking is difficult to identify automatically. The focus of the research was on erectile dysfunction medications as a popular category affected by illegal online trade and potential source of substandard and falsified medicinal products [20,21]. Consequently, the search queries represent purchase intent (buying prescription medications online), rather than informative types of search (looking for product information). The 4 primary active pharmaceutical ingredients (APIs), sildenafil, tadalafil, vardenafil, and avanafil, were searched for using Google, the most popular search engine. Country-specific data were obtained by individualizing national search using the search terms of the “API” and the “buy” words in the language of the given country (eg, “comprar sildenafil” for Spain). Furthermore, search settings in Google have been adjusted to the preferred region. To track the evolution of the phenomena, the first 20 organic SERs were evaluated during 3 consecutive years: August and October 2019, August 2020, and November 2021 for the national data set. Meanwhile, the first 40 SERs were included in the international data set evaluated in November 2020. Accordingly, we conducted our research on 2 data sets: a long-term evaluation of Hungarian SERs and an international sample in Hungary and an additional 11 other countries (Bulgaria, Croatia, Estonia, Finland, France, Greece, Italy, Romania, Spain, Sweden, and United Kingdom) from different regions of Europe. As most (88%) users click on results appearing in the top 10 SER positions [22], by documenting the top 20 results we consider our findings representative for online queries at the time of evaluation. SER links of websites offering medicinal products for sale were included for evaluation; nonrelevant query results were excluded from our evaluation.

The documented search result data included date, country, search language, API, search phrase, URL and domain name, SER ranking, destination website URL for redirections, and website category. Two figures were used to describe the significance of the phenomena regarding search engine redirection attacks in SERs: (1) prevalence of hacked links in SERPs and (2) cumulative click-through rate (CTR). Both measures correlate with the likelihood of users—intentionally or unintentionally—visiting illegal pharmacies. Prevalence is calculated by dividing the number of infected links by the total number of evaluated links in SERPs. Based on Google’s organic search ranking, CTR is a probability value of clicking on a given link assigned to each measured SER position. On the first page of the search (Google) result, 1-10 CTR per ranking values were determined based on the analysis by Sistrix [22], while further CTRs for 11-40 SER positions were computed with the equation of the exponential trend line connecting the first 1-10 SERP datapoints (y=26,76e^–0.258x, where y is the predicted CTR and x is the SER rank; R²=0.927). Cumulative CTRs express the sum of CTR values regarding all documented positions in SERPs.

Compromised sites redirecting to international illegal medicine retailers have been classified into 3 categories referencing the redirection’s life cycle based on Leontiadis et al [16]. First, the compromised site is likely a future redirect (hacked website content with or without links; however, no automatic redirection is yet observed). Second, active redirection to an international illegal medicinal product vendor via a compromised site. Lastly, inactive redirection, that is, sites used to be redirecting, but no longer redirecting, because they are not accessible at the time of evaluation, displaying 404 error code, or similar.

Graph Visualization, Legitimacy, and Traffic Analysis Regarding Destination Websites

Compromised SERP links leading to international illegal medicinal product vendors via redirection (active links) were evaluated and networks have been generated with Gephi [23], an open-source graph visualization and analysis tool. The national and international data sets were visualized as directed graphs illustrating the source and destination website domains. Multiple links from the same domain accounted for increased weight of the edge. The average degree (average number of edges per node in the graph), the in-degree (number of connecting edges), and the page rank (importance score of a node within a directed graph) of nodes were computed.

Destination websites offering products for sale in the national data set were categorized as follows: legitimate online pharmacies, illegal medicine retailers (rogue online pharmacies), or dietary supplement seller (nonpharmacy web shops). Destination website categories were not defined for EU countries, so only links with redirection to illegal online sellers were documented regarding the international data set. Destination website legitimacy was checked at LegitScript [24] and categorized as approved, unlicensed, or rogue (illegitimate). The estimated number of monthly unique visitors of the root domain for all regions at the time of evaluation is provided by SEMrush traffic analytics [25].

Data were analyzed using SPSS Statistics 26 for Windows (IBM Corp.) and MS Excel (Microsoft Inc.).

Ethical Considerations

There were no ethical issues, as only publicly available data obtained from SEs and websites were documented and evaluated. Furthermore, no customer or personal data were measured, recorded, or stored in this study.

Results

Compromised Websites Among SERPs of Medications for Treating Erectile Dysfunction in Hungary Between 2019 and 2021

The results show that during our 3-year observation period, there were no legitimate internet pharmacy websites among the evaluated SERPs. A decrease in the number of compromised sites linking visitors to illegitimate medicine sellers has been observed during our study period, while inaccessible broken links have increased. Similarly, the number of national rogue online pharmacies has increased in SERs up through 2021. All active ingredients have been affected by poisoning, with avanafil showing a somewhat diminished prevalence (Table 1).

Although most of the compromised websites were “true redirects” transferring individuals to international online sellers, we occasionally came across hacked sites without redirection. For example, in these cases, the rogue online pharmacy was operating under a subpage of the hacked domain, or the medication-related text was filled with keywords and links (so-called keyword stuffing and link building), indicating “black-hat” SEO techniques.

Such pages are likely to rank higher in search engines and develop redirects as time passes. In other instances, the web page we were looking for did not exist on the website’s server. Pages not accessible (eg, 404 error) at the time of evaluation could be related to website administrators identifying the malicious redirect code inserted into a website. According to our observation, hacking is followed by the malicious redirection life cycle, which consists of future (inactive pages ready to become active), active, and finally inactive stages.

The complexity of the graphs decreased (the average degree changed from 1.17 to 0.667), between August 2019 and October 2021 (Figure 2). A majority (11/14, 79%) of the evaluated online pharmacies were categorized as rogue by LegitScript. We identified 5 destination online pharmacy websites in the link network at each evaluation date, except for October 2021. Initially, destination domains (eg, acs-pharmacy.com and evo-pharmacy.com) received numerous incoming links from SERs and played a central role in the network. By the end of the 3-year evaluation period, illegal pharmacy websites in-degree and page rank values underwent substantial reduction (Table 2). Website traffic analytics by SEMrush indicated a high number of monthly visitors (range 370-155,400) for important nodes with high page-rank values within the graph. This value illustrates the destination site’s global visitor count in the given month of evaluation.

‎View this figure

International Relevance of Compromised SERPs in Europe 2020

A total of 1920 search results were evaluated in November 2020, in accordance with the results of the aforementioned 4 APIs listed in the top 40 results on the SERP pages throughout 12 European countries. Of those, 380 (19.79%) search query results were compromised, with a majority (n=342, 90%) of the links of the 230 infected source domains redirecting individuals to 73 international illegal medicinal product vendors. The remaining SER links were leading to compromised sites without redirection (6/380, 1.6%) or not accessible web pages/sites (32/380, 8.4%). Descriptive graph statistics of the international data set, website legitimacy category, and traffic history regarding destination online pharmacies with at least five referring links are depicted in Table 3.

The most influential destination domain in the international redirection graph was “ezshopremedieshere.com,” with 79 referring links from search queries in most (8/12, 66%) of the evaluated European countries, and 61,400 unique global visitors in November 2020. Although several destination websites had numerous incoming links, the average in-degree value was 1.11, as most nodes had only 1 (30/79, 38%) or 2 (12/79, 15%) compromised referrals from search engines (Figure 3). The number of monthly global visitors per domain was the highest for “forecastarrays.us,” “cheapshopmed.com,” and “haiyuanpenguan.com,” attaining 566,100, 135,100, and 128,300 visitors, respectively, according to SEMrush traffic analytics. Interestingly, these high-traffic domains had only a small number (1-3) of incoming links from SERs and only 1 European country was affected in each case (Finland, Estonia, and Croatia, respectively). The “cheapshopmed.com” domain is a rogue online pharmacy in the LegitScript database. However, the “forecastarrays.us” and “haiyuanpenguan.com” domains contain compromised pages, including their intended content, and they can be accessed after redirection with an embedded online pharmacy content, so the visitor count of these domains is likely to include nonmedicinal purchase intention also. Website traffic estimation was available for 40 destination domains, with 35 having pharmacy-specific domain names (including terms, such as Rx, pharm, meds, pills). These 35 active online pharmacy domains, accessible from 12 European countries via compromised links in search engine queries, included a total of 473,118 unique visitors during November 2020.

‎View this figure

The EU countries are affected differently by redirection links within SERPs, leading to illegitimate online pharmacy websites (Figure 4). In the “Methods” section, we proposed 2 metrics to illustrate the magnitude of the problem manifested throughout European countries. The proportion of the hacked pages as a percentage of the total search query results and the cumulative CTR percentages were calculated to illustrate the issue of the compromised websites in a complex manner in each country’s SERP. It is important to view cumulative CTR and the number of compromised websites as both unique and complementary factors. To state an example, if a country’s SERP has several websites lower down the list, the cumulative CTR will be minimal. However, these websites pose a potential risk of rising surreptitiously quickly through the ranks and gaining higher CTRs.

‎View this figure

Compromised links redirecting to active online pharmacies were present in search query results of all evaluated countries. The prevalence of compromised links in national SERs was the highest in Spain (62/160, 38.8%), Hungary (52/160, 32.5%), Italy (46/160, 28.8%), and France (37/160, 23.1%), whereas it was the lowest in Finland (12/160, 7.5%), Croatia (10/160, 6.3%), and Bulgaria (2/160, 1.3%). Cumulative CTR values computed for APIs indicated the highest potential impact and danger of search engine redirection attacks for avanafil in Spain (41.0%), sildenafil in Estonia (80.9%), tadalafil in Hungary (51.1%), and vardenafil in Greece (29.7%). Prevalence and cumulative CTR metrics were relatively high for all APIs in Hungary and Spain, indicating a larger number of infected SER links with relatively high-ranking positions in search queries. Accordingly, consumers searching for erectile dysfunction medications online are more likely affected by online medicine purchase opportunities presented by illegal online pharmacies applying search engine redirection attack as a marketing technique in these countries. Although SERs in Romania, Finland, and Greece contain a substantial number of compromised links, because of low rankings, the cumulative CTR vales are low, indicating that consumers are less likely to click on compromised links leading to the destination illegal online pharmacy websites. The complete redirection network is illustrated in Figure 3.

Hacked websites are not specialized in active ingredients and target domains. Of the observed 230 infected source domains, many (n=65, 28.3%) promote various APIs. Although the majority (160/230, 69.6%) of source infections drive traffic to a single destination, many redirect individuals to various online pharmacy websites (range 1-6; mean 1.49 redirection links of independent destination domains).

Discussion

Principal Findings

The evolution of online advertising methods and specialization have led to the development of affiliate networks, an established method for legitimate merchants in which sponsors pay a commission to advertisers delivering traffic to their websites. Unfortunately, illegal online pharmacies are also a typical example of affiliate networks and search engine poisoning is a tool linked to affiliates to convert visitors from search engines. A robust number of independent affiliates, acting as advertisers or traffic brokers, received high (30%-40%) commissions for promoting illegal medication vendors and delivering traffic to the sponsor websites in which medications are sold to customers [14]. This affiliate program business model has numerous advantages for its participants. Sponsors (destination illegal pharmacy websites) do not have to heavily invest in marketing campaigns. Even more advantageous is that they free themselves from direct exposure to the criminal risks associated with large-scale advertising. Affiliates generate sales for sponsors by only focusing on attracting customers without developing web shops, customer service, etc. Online pharmaceutical sales are one of the oldest and largest affiliate program markets, with an estimated turnover of 500,000-600,000 customers, 700,000 billed orders, and US $73,000,000-85,000,000 revenue per 3-year period (2007-2010) analyzed by McCoy et al [14] referencing 2 major affiliate networks (Glavmed and SpamIt). By evaluating the change of new customer acquisitions, the authors concluded that affiliate programs attract new customers at a steady rate (approximately 3300/week). Thus, the market of counterfeit pharmaceuticals was not saturated, suggesting latent customer demand [14]. Furthermore, the same data set provides evidence for customer loyalty and satisfaction regarding online pharmacies, as repeat purchases constitute more than 20% of overall revenue. Our previous findings also indicate that a vast number of online pharmacies operate illegally and offer medicines to buyers in the long run [10].

It has been estimated that the number of men experiencing erectile dysfunction worldwide can reach 332 million by 2025 [19]. Erectile dysfunction medications containing PDE5 inhibitors are highly prone to falsification with proven potential health risk for patients. Analytical investigation of these products often shows the presence of dangerous excipients of nonpharmaceutical origin or quality, more than 1 undeclared PDE5s, and active ingredient amounts higher than declared values often surpassing the maximum therapeutic dose [5]. Previous research [26] regarding patient safety risks assessment of the online market of medicinal products revealed that Google search results include several suspicious links. By clicking on these SERs, the visitor is apparently redirected to an unlicensed drug distribution page by initially clicking on the link of a legitimate, yet irrelevant domain. This unfair online marketing of search redirection attack is thought to play a decisive role in the illegal internet pharmaceutical marketplace. Although search engine redirection attacks leading visitors to illegal online pharmacy networks have been previously published [9,16], we did not find relevant publications in medical informatics journals during the past decade. Admittedly, search engine redirection attacks are not limited to Google, the most popular search engine. The same phenomena could be identified in Microsoft Bing and Yahoo!. Seemingly, this unsolved issue has sunk into oblivion. This study was aimed to describe, map, and highlight its national and international significance.

Nearly half of search results were redirecting individuals to illicit medicine vendor sites during our national results obtained in 2019, with compromised websites being dominant in SERPs. This finding correlates with a previous study by Leontiadis et al [16], highlighting how redirections constitute the most significant proportion of results for the query set implemented in this study. Although the prevalence of compromised links in SERs and the complexity of the graphs have decreased in our national data set between August 2019 and October 2021, the danger has not dissipated. Consumers searching for ivermectin during the COVID-19 pandemic were more likely to find links redirecting to illegal medicine retailers that represent 73.3% of SER links within the first 30 search results in Google in March 2021 [26]. Despite the attempts to prevent this “black hat” SEO technique proposed a decade ago, limited success can be observed [9], and we are facing a constant issue that has not been solved for a relatively lengthy period.

Our international search query data set obtained from a representative sample of SERs among 12 European countries illustrates the international significance of search engine poisoning. All evaluated countries are affected, as at least one of four active ingredients for the treatment of erectile dysfunction was offered for sale via compromised links. The overall prevalence of hacked links in SERs was highest among Spain, Hungary, Italy, and France. Among 1920 manually evaluated links, we documented 380 compromised results from a total of 230 websites (domains) leading to 73 illegal online medicine vendors. The majority of these illegal online pharmacies (41/73, 56%) received only 1 or 2 compromised links. Meanwhile, the top 3 domains with the highest in-degree property received more than one-third of all incoming links. These findings support earlier studies stating that illicit advertising business is dominated by only a handful of big-league players [16].

An important implication regarding our findings is that search-redirection attackers use a complex system with potentially vulnerable elements to convert traffic to their illegitimate destination websites. We conclude that such practices can be disrupted by various stakeholders in a number of ways (Textbox 1).

Most likely, if any 1 or more than 1 of the aforesaid measures are considered, the redirection network collapses, and infected source websites will not appear, nor will they rank high in the search results. Lastly, they will not actively redirect to illegitimate online pharmacy domains.

A common feature of the aforesaid measures is the undisrupted continuity of the system, as it most likely requires time to build up such a complex network among numerous stakeholders. Findings of previously published literature suggest that the median survival time of a source infection is 19 days; however, some claim a lot lengthier time (17% of infections lasted at least six months, while 8% survived for more than 1 year) [16]. Our findings also corroborate this, as 4 compromised pages in our national data set remained in the top 20 results for more than 2 years, between August 2019 and October 2021.

As the number of infected websites appearing in SERPs and all other compromised websites within the redirection chain is considerably high and the number of destination websites are relatively low, it is reasonable to take measures against the latter by shutting down websites and domains. However, the efficacy of this intervention does not seem to be efficient enough, considering the fact that the Operation Pangea coordinated by Interpol has taken down more than 150,000 websites between 2008 and 2020. Despite this large-scale removal, an extremely large number of links (113,020 websites and online marketplaces) were subsequently closed down in 2021 [29,30], demonstrating the substantial scale and recurrence of this issue, which remains unresolved.

Limitations

Admittedly, our study bears several limitations, for instance, the search query results of only 1 search engine have been summarized; however, we believe that the validity of our methodology can be explained by the dominant market share of the search engine. Furthermore, as opposed to brand-name queries, API-based search may offer varied results; however, Google’s complex algorithm is likely to provide results for related searches. API was used because our aim was to find all relevant websites, regardless of their original and generic names, varying from country to country, including unapproved generics and falsified medicines. Legitimacy of all final destination websites cannot be evaluated objectively, as there is no reliable database to evaluate all websites. However, we assumed all online medicine vendors using search engine redirection attack to attract customers and offer prescription medicines for sale most likely bear malicious intent and can be categorized as illegitimate online pharmacies.

In conclusion, our results illustrate that the phenomena of search engine poisoning have been persistent during the past decade and affiliate networks linked to illegitimate online pharmacies are flourishing. This supports the presumption that uncoordinated interventions aiming at ceasing illicit medicinal online purchases by authorities and individual stakeholders are not yet sufficient. It is a problem that has not been solved for more than a decade. Importantly, uncontrolled illegal sale of medications has many unfavorable consequences for the health of consumers and the safety of the pharmaceutical supply chain. Detecting and eliminating malicious links promoting illegal online pharmacies in search engines are of great importance with regard to cybersecurity and patient safety.