A 4-Month Planned Dual-Leverage
SEO Poisoning Attack Against
a Japanese Medical Corporation

On April 4, 2026, an Indonesia-based criminal organization began constructing attack infrastructure targeting Medi Face, Ltd. (株式会社メディフェイス / 医療法人鳳應会グループ), a Japanese medical information services company — more than 120 days before the attack was executed. At 19:33 JST on August 12, 2026, the attack was triggered: PHP webshells were used to seize server-wide control, and SEO redirect code directing users to Indonesian illegal online gambling sites was injected into more than 130 pages across 21 domains.

This paper analyzes the attack in technical detail. What sets this campaign apart is that it was not simply "financially motivated SEO spam." It was a dual-leverage design: simultaneously generating affiliate revenue and constructing permanent false evidence that the victim corporation operates an illegal online casino — a structural threat of a qualitatively different order. Moreover, the technical sophistication of the attacker's infrastructure demands the kind of grudging professional respect that security researchers reserve for genuinely impressive — if criminal — engineering.

The sole purpose is public education and cross-organizational defense.

Why a Medical Corporation Was Targeted

Medi Face, Ltd. and the 医療法人鳳應会グループ (Houokai Medical Group), led by CEO Toru Chikazawa (近澤徹), operate medical information services and online clinic platforms including medi-face.co.jp and FRAISE CLINIC. The attackers conducted detailed reconnaissance more than 120 days in advance, pre-built counterfeit sites impersonating the group's brand names ("medi-face," "fraise-clinic"), and only then executed the attack. This was not an opportunistic compromise or an automated scan — it was a high-sophistication, target-specific organized crime operation.

1.1 Why We Are Publishing This

We publish this document for a single reason: we do not want this to happen to anyone else. Identifying perpetrators, prosecution, and legal remedies are not the purpose of this paper. The facts documented here are a knowledge asset for every medical institution, website operator, and security researcher who needs to be prepared for this class of attack.

The attackers' cloaking architecture was specifically designed so that investigation from within Japan can confirm almost none of the evidence (see Section 5). The eyes and knowledge of the global security community are the only effective countermeasure against this class of crime.

Why This Is Targeted Organized Crime — Not an Opportunistic Attack

Six independent evidence items establish that this was a planned, targeted operation.

2.1 Attack Timeline (Second-Level Precision)

The 5-Layer Attack Infrastructure: Bulletproof Design and Redundant Architecture

One of the most technically notable features of this attack is the precision of its infrastructure design. Rather than relying on any single server or service, the attackers adopted a "bulletproof" architecture with multiple layers and two independent redundant chains. If any one node is taken down or reported, the remaining chain continues operating.

3.1 Chain A — medi-face Route

3.2 Chain B — fraise-clinic Route (Independent Redundant System)

3.3 Logical Layer Architecture

Technical Analysis of Brand-Impersonation Cloudflare Pages

The attackers created brand-impersonating Pages (medi-face.pages.dev, fraise-clinic.pages.dev) using a Cloudflare account entirely separate from — and unknown to — the victim corporation, specifically designed to be mistaken for the victim's official online presence.

4.1 medi-face.pages.dev — Technical Analysis

4.2 fraise-clinic.pages.dev/DETIKBET — Technical Analysis

Complete Code Analysis of the Cloaking Engine

// ===================== CLOAKING ENGINE (actual source code) =====================
// Source: jutsu-seribu-bayangan.pages.dev (attacker-controlled Cloudflare Pages)
// Retrieved: 2026-08-13
// Design: 3-layer filtering — Layer1: Device → Layer2: Country → Layer3: Routing

(function() {
    // ★ Configuration values (this is the attacker's "evidence")
    const TARGET_URL   = "https://terreagoodboy.store/register?ref=MKPA2AD00002";
    const FALLBACK_URL = "https://jutsu-seribu-bayangan.pages.dev/"; // loops to itself = evidence destruction

    // ─── Layer 1: Device Detection ─────────────────────────────────────────────
    // Only Android / iPhone pass. PCs, tablets, and bots are immediately
    // sent to fallback without country detection.
    // → An investigator accessing via PC is routed to the harmless loop instantly.
    function detectDevice() {
        const ua = navigator.userAgent || navigator.vendor || window.opera || '';
        if (/android/i.test(ua))       return 'Android';
        if (/iPhone|iPod/i.test(ua))   return 'iPhone';
        if (/iPad/i.test(ua))          return 'iPad';
        return 'Other'; // PC → immediate fallback
    }

    // ─── Layer 2: Country Detection (Triple Failover + 3-Second Timeout) ───────
    // Only Indonesia ("ID") passes. Japan, US, Europe, VPN users → fallback.
    // Three IP geolocation APIs tried in cascade; if all fail → fallback.
    // → Even a researcher using a VPN cannot pass unless the IP reads as Indonesia.
    function detectCountryWithTimeout(callback) {
        let isResolved = false;
        let timeoutId  = null;

        function resolveCountry(code) {
            if (isResolved) return;
            isResolved = true;
            if (timeoutId) clearTimeout(timeoutId);
            callback(code);
        }

        // If no determination within 3 seconds → "unknown" → fallback (fail-safe)
        timeoutId = setTimeout(() => resolveCountry('unknown'), 3000);

        // API ①: ipapi.co (primary)
        fetch('https://ipapi.co/json/')
            .then(r => r.json()).then(d => resolveCountry(d.country_code || ''))
            .catch(() => {
                // API ②: ip-api.com (fallback 1)
                fetch('https://ip-api.com/json/')
                    .then(r => r.json()).then(d => resolveCountry(d.countryCode || ''))
                    .catch(() => {
                        // API ③: ipinfo.io (fallback 2)
                        fetch('https://ipinfo.io/json')
                            .then(r => r.json()).then(d => resolveCountry(d.country || ''))
                            .catch(() => resolveCountry('unknown')); // all APIs down → fallback
                    });
            });
    }

    // ─── Layer 3: Final Routing Decision ──────────────────────────────────────
    function processCloaking() {
        const device = detectDevice();

        // All PCs (including iPad) → immediate fallback (investigators / researchers cannot pass)
        if (device !== 'Android' && device !== 'iPhone') {
            window.location.replace(FALLBACK_URL);
            return;
        }

        // Mobile only: run country check
        detectCountryWithTimeout(function(countryCode) {
            const isIndonesia = (countryCode.toUpperCase() === 'ID');
            if (isIndonesia) {
                // ✅ Indonesian mobile → gambling site (affiliate revenue generated)
                window.location.replace(TARGET_URL);
            } else {
                // ⛔ Japanese / Western / unknown → loops to itself (leaves no evidence)
                window.location.replace(FALLBACK_URL);
            }
        });
    }

    processCloaking(); // entry point
})();

5.1 Behavior by Visitor Type

Ten Advanced Anti-Detection and Evasion Techniques

We analyze each technique employed in this attack from a security engineering perspective. Those demonstrating particularly high technical craftsmanship are marked ★ Grudging Respect — a professional acknowledgment of the adversary's engineering even while condemning the application.

Game-Theoretic Analysis: The Dual-Leverage Dominant Strategy

Analyzing this attack within the framework of John von Neumann's (1903–1957) extensive-form game theory reveals that the attackers' strategy is a design that transcends simple financial theft. We describe this in purely mathematical terms, free of emotional framing.

7.1 Dual Leverage: A Dominant Strategy With Two Independent Payoff Streams

This attack was designed to generate two independent revenue streams from a single infrastructure investment:

7.2 Cloaking as Artificial Information Asymmetry

In Harsanyi's (1967) incomplete information game theory, information asymmetry fundamentally alters the structure of a game. The cloaking system in this attack artificially constructed the following asymmetry:

7.3 The Defender's Optimal Response: Complete Public Disclosure as the Equilibrium Strategy

Table 1: Payoff matrix (subgame perfect equilibrium analysis) — Defender's dominant response is "Full Disclosure + Legal Action"

By backward induction, the defender's dominant strategy is complete public disclosure. The attacker's "nuclear button" — the option to falsely report the victim as an illegal casino operator to authorities — loses all its leverage value the moment its existence becomes fully public knowledge. The publication of this paper is the execution of that equilibrium strategy.

Confirmed IoCs — Full Indicator List

The following IoCs are released to the security community. Free use for defensive, research, and investigative purposes is explicitly permitted.

182.10.98.57     # Indonesia — Primary operator, initial webshell activation (19:33:27 JST)
103.20.83.86     # Indonesia — Highest frequency access throughout attack
114.10.65.118    # Indonesia — Telkom Indonesia
103.236.188.241  # Indonesia
180.243.11.97    # Indonesia — Telkom Indonesia (Telkomsel)
31.56.30.60      # Iran — Secondary operator (joined 20:37 JST)
103.141.164.246  # Unknown — Additional participant
2400:9800::/32   # Telkomsel IPv6 range (Indonesia)

m4udd0syastvp1d.online          # NameCheap · 2026-04-04 · IP: 198.54.120.152 · Redirect node
bringmetolife.store              # NameCheap · 2026-04-05 · Gambling dest · Affiliate: cSyJDyLy
terreagoodboy.store              # NameCheap · updated 2026-08-09 · IPs: 45.194.53.52 / 45.194.53.26
jutsu-seribu-bayangan.pages.dev  # Cloudflare Pages (attacker acct) · Cloaking engine A
wewillrockyou.pages.dev          # Cloudflare Pages (attacker acct) · Cloaking engine B
medi-face.pages.dev              # Cloudflare Pages (attacker acct) · BRAND IMPERSONATION A
fraise-clinic.pages.dev          # Cloudflare Pages (attacker acct) · BRAND IMPERSONATION B

Gambling Affiliate ID #1:       cSyJDyLy         (bringmetolife.store)
Gambling Affiliate ID #2:       MKPA2AD00002     (terreagoodboy.store)
Google Search Console Token:    2Z_wOjQcGzVd53eRds3fVWKSAaDsyNsUl7AsNymx4tc
ImageKit.io Account:            dewi11           (ik.imagekit.io/dewi11/)
Imgur Image ID:                 lyf87zA.png      (uploaded 2026-04-28)
Registrar Privacy Shield:       Withheld for Privacy ehf (Reykjavik, Iceland)
Common Nameserver:              nile.ns.cloudflare.com / sasha.ns.cloudflare.com
C2 Channel:                     Telegram (confirmed via Referer: web.telegram.org)

fgh.php          # Initial shell — direct access without reconnaissance
yomanx498.php    # Secondary shell (redundancy)
n0bgxdjskd.php   # Secondary shell
mails.php        # Shell with mail-mimicking filename
follder.php      # Shell with typo-based obfuscation
carrier/sshy.php # Shell in subdirectory

Conclusion: What This Case Demonstrates About 2020s Cybercrime

This incident represents an archetypal case study in the evolution of cybercrime, notable in the following respects:

1. Democratization of APT-grade Techniques: Advance reconnaissance, premeditated planning, staged infrastructure construction, and multi-operator division of labor — previously associated with nation-state actors — are now routinely adopted by financially motivated criminal organizations.
2. Weaponization of Legitimate Infrastructure: Cloudflare Pages, Google AMP, ImageKit, Imgur, and Telegram are all legitimate, highly-reputable services. Traditional IP-reputation-based defenses are structurally ineffective against this class of attack.
3. Investigative Neutralization by Design: A cloaking architecture that makes evidence structurally invisible to Japanese investigators is a new challenge that requires international investigative cooperation across internet boundaries. This is not a technical gap that can be closed unilaterally.
4. Dual-Use Threat Structure: Simultaneously realizing SEO revenue and legal leverage from a single infrastructure is a new threat category that transcends conventional cybercrime taxonomies.

And finally: complete transparency is the optimal defense. The leverage value of the "false evidence" the attackers constructed evaporates the moment it becomes fully public knowledge. This document is the record of that moment — and a public-benefit gift intended to prevent the next victim.