Is that the cloaking or something else?

No, it's a hacked site with added "goodies". Someone should tell them.

Actually, it's common behavior for such kws, serps like that come & go very often

Well established site with PR6, legit business, legit social media accounts, etc, selling pretzels - and viagra ? They are hacked. Site is built on .aspx, added page is html.

Links lead to site called stylessheet. com offering "Buy propecia without prescription"

Site resolve to 194.54.80.171 (171.80.54.194.static. server. ua) hosted in Ukraine, on same dns records are sites selling fake pills and meds - medcntr. net, medicsstar. com, medicstar. com, medicstar. net, medicstars. com, and all of them are registered by same company from Corea with referal url www. bizcn. com

Hacked. Those appear very often in such niches.

so what is the difference between hacking and link spamming?