Prevalence of Poisoned Google Search Results of Erectile Dysfunction Medications Redirecting to Illegal Internet Pharmacies: Data Analysis Study

Abstract

Background: Illegal online pharmacies function as affiliate networks, in which search engine results pages (SERPs) are poisoned by several links redirecting site visitors to unlicensed drug distribution pages upon clicking on the link of a legitimate, yet irrelevant domain. This unfair online marketing practice is commonly referred to as search redirection attack, a most frequently used technique in the online illegal pharmaceutical marketplace.

Objective: This study is meant to describe the mechanism of search redirection attacks in Google search results in relation to erectile dysfunction medications in European countries and also to determine the local and global scales of this problem.

Methods: The search engine query results regarding 4 erectile dysfunction medications were documented using Google. The search expressions were "active ingredient" and "buy" in the language of 12 European countries, including Hungary. The final destination website legitimacy was checked at LegitScript, and the estimated number of monthly unique visitors was obtained from SEMrush traffic analytics. Compromised links leading to international illegal medicinal product vendors via redirection were analyzed using Gephi graph visualization software.

Results: Compromised links redirecting to active online pharmacies were present in search query results of all evaluated countries. The prevalence was highest in Spain (62/160, 38.8%), Hungary (52/160, 32.5%), Italy (46/160, 28.8%), and France (37/160, 23.1%), whereas the lowest was in Finland (12/160, 7.5%), Croatia (10/160, 6.3%), and Bulgaria (2/160, 1.3%), as per data recorded in November 2020. A decrease in the number of compromised sites linking visitors to illegitimate medicine sellers was observed in the Hungarian data set between 2019 and 2021, from 41% (33/80) to 5% (4/80), respectively. Out of 1920 search results in the international sample, 380 (19.79%) search query results were compromised, with the majority (n=342, 90%) of links redirecting individuals to 73 international illegal medicinal product vendors. Most of these illegal online pharmacies (41/73, 56%) received only 1 or 2 compromised links, whereas the top 3 domains with the highest in-degree link value received more than one-third of all incoming links. Traffic analysis of 35 pharmacy specific domains, accessible via compromised links in search engine queries, showed a total of 473,118 unique visitors in November 2020.

Conclusions: Although the number of compromised links in SERPs has shown a decreasing tendency in Hungary, an analysis of the European search query data set points to the global significance of search engine poisoning. Our research illustrates that search engine poisoning is a constant threat, as illegitimate affiliate networks continue to flourish while uncoordinated interventions by authorities and individual stakeholders remain insufficient. Ultimately, without a dedicated and comprehensive effort on the part of search engine providers for effectively monitoring and moderating SERPs, they may never be entirely free of compromised links leading to illegal online pharmacy networks.

Keywords: Europe; compromised websites; erectile dysfunction medications; illegal medicines; internet pharmacies; patient safety; search engine redirection.

Figure 1

Illustrative figure of how users pass through a redirection chain from the search result page to the final destination illegal online pharmacy website.

Figure 2

Visual graph of SERP links of compromised websites and illegal online medicine vendors accessed via search redirection attack visited in August 2019 (left) and August 2020 (right). SERP: search engine results page.

Figure 3

Graph of compromised websites (n=230) and illegal online medicine vendors (n=73) accessed via search redirection attack in 12 European countries visited in November 2020. Node size—represented by circles—illustrate the in-degree property of a domain in the graph. Small red nodes show compromised website domains in SERs and destination websites are labeled with blue. The edge—representing links—are colored based on the API name used in search queries (blue for sildenafil, green for vardenafil, yellow for tadalafil, and orange for avanafil). API: active pharmaceutical ingredient; SER: search engine result.

Figure 4

Cumulative click-through rate (CTR) prevalence of redirection links within search engine result pages leading to illegitimate online pharmacy websites search queries in 12 European countries.