To make this answer more general, I removed the actual domains: the links tend to expire shortly when the administrator of the compromised site responds to the problem.
I'm curious about this specific case. --
What happens next may also vary depending on the conditions, to complicate the investigation. The next site may be configured to give the actual payload only when an actual browser access it, or only if the browser's user agent matches something that could be exploited. It may give different contents when user agent is e.g.
curl/7.52.1, so obfuscating the user agent using
curl -A may become handy. The next URL
http://example.net/?s=27012018&a=401336&c=cpcdiet gives an empty reply to
curl, while Google Chrome gets a new HTTP redirect:
which has the following content (indentation added for readability):
stylesheet URL has just a placeholder CSS containing only
dns-prefetch URL leads currently to an
script finally redirects to a site titled Pharmacy online-store, selling Viagra.
The final location is a domain registered to a private person from Russia; high probability for scam.
What potential security flaws could I have been exposed to by simply slicking on an unknown link, and doing nothing else?
This has a huge potential to be harmful in general, but it depends on how your browser reacts and is the exploit targeted against a vulnerability in this particular environment.
This investigation revealed that you could have lost money by ordering Viagra on a (probably fake) pharmacy site, but it could well have been worse, too.