SEO/link-farm PDF carrier

Generated malicious PDF campaigns often use scraped text and many clickable PDF URLs to make documents appear in search results and route users through attacker-controlled or compromised link farms. The rule is gated on a small file with many external .pdf URI actions clustered on one host to avoid treating ordinary references as malware. This is social-engineering and redirect-chain evidence, not a PDF parser CVE fingerprint.