Today while searching in Google, a strange URL caught my attention: http://www.vwadviseurs.nl/joke/rizatriptan-10mg/. The Dutch domain sounds like a name for a legitimate advice company, but why would they have a page about a drug? Out of curiosity I clicked the link and saw an online pharmacy in English on the Dutch domain vwadviseurs.nl. Each link on this page points to a page on surfaid.me. This is all very suspicious, especially since https://www.vwadviseurs.nl looks like a sincere website for a financial company. So I decided to investigate this and found an entire web of malicious landing pages to surfaid.me.
Continue reading