Suspicious website (pdfplumber.com) impersonating project name and redirecting users

[dexnab]

Describe the bug

This is NOT a bug in pdfplumber’s code, but I would like to report a potentially harmful website that appears to misuse the project’s name.

The domain:

https://pdfplumber.com/

appears to present itself as related to the pdfplumber library, but it is not referenced in the official repository or documentation.

The site contains SEO-style content about pdfplumber, and many (or all) links redirect users to advertisement pages (depending on the browser environment), which is unrelated to this project.

This may mislead users into thinking the site is official.

Observed behavior of the website

• The site contains generic/SEO-style content about pdfplumber.

• User interactions (e.g., clicking links) trigger automatic redirects.
  For example, it redirects to a Firefox extension store when using Firefox (OS: Ubuntu 24.04).

• The redirect behavior is inconsistent and appears to depend on device/environment.
  Potentially by redirecting to a Traffic Distribution System (TDS) on the domain "oundhertobeconsist.org".

Why this is concerning

• The domain uses the exact name of the project, which may mislead users into thinking it is official.

• It is not affiliated with the project (as far as I can tell).

• The redirect behavior suggests:

  • Deceptive traffic redirection.

  • Possible adware / malicious distribution patterns.

• The inconsistent redirect targets (depending on device) are characteristic of traffic distribution systems (TDS) often used in malicious or deceptive campaigns.

Have you tried repairing the PDF?

Not applicable.

Code to reproduce the problem

Not applicable.

PDF file

Not applicable.

Expected behavior

Users searching for “pdfplumber” should be directed only to official resources (e.g., GitHub, PyPI, documentation), and not to unrelated third-party sites that may mislead or redirect them.

Actual behavior

A third-party site using the project name:

• Appears in search results.
• Presents itself as related to pdfplumber.
• Redirects users to unrelated and potentially unsafe destinations

Screenshots

Environment

Not applicable.

Additional context

I investigated this further using browser developer tools and observed:

• JavaScript-driven redirection logic
• Behavior that varies depending on environment (device, session, etc.)

This appears to be more than just an unofficial site—it may be part of a broader redirect/ad network.

I wanted to bring this to your attention that a warning should be added to the README, or the domain should be reported to search engines / abuse channels

Please let me know if this should be reported elsewhere or handled differently.

[kcwu]

FYI, when clicked some links on the site on MacOS, it redirects to a page, which ask users to execute command like curl .... | bash. The downloaded file is a script, which upload /tmp/osalogging.zip to a remote server. It is an information-stealing malware.

[ancientwaiting]

Got your email, thank you!Will reply you asap