Seen this suspicious SE redirect code: http://killmalware.com/biyoranking.com/
When we decode the hex code we get:
/最安値「エクオール」サプリを買う前に必ず読む
which is Japanese for
Lowest price “Equ*l” Be sure to read before purchasing a supplement
So we can establish we are dealing with pharma spam.
The hidden iFrame destination site has low risk: https://sitecheck.sucuri.net/results/yossy512.analytics.qlook.net/analyze.htm
and will land at -https://accaii.com/qlook.html
pol