Säkrare hemsida med .sehttp://luv.nu/ (103.224.182.249) - Serp-hijackingAttacked url: http://luv.nu/<br>Attack type: SERP-hijacking (see http://ikyon.com/attack-types/ for description)<br>Attack detected Tue, 11 Jul 2017 23:56:43 +0200<br><br>Visitors with referer are redirected to http://bidr.trellian.com/r2.php?e=cF8L0S4UvzZFbF2sJTBoT%2Bzwn10jVoD41mCkxmFpFIXsSqdGeHfRLtbj4EgsFUSNO9YqjzrvwGIZ3jWlQ0rZzE5gCn8XMgcxISpmnJXUoeJV1IQUHbzcKzsg8rvrjY0fqKmEfAyChkHbb8ZEbKqlbiSfr56AHaB5Nnhrabbd%2BAcex9SMh7yklqA2YGKifrGmPtBGvZL%2FXYbjhb6Pnxtm%2F3GW16X%2FPpx%2Fo%2FaAiGIMOhLGTcMxKOhf4FxeuuahtMhYPNcP3nqZj9s1xBHHnwq0J3oP0tahmkRHD4vkk6C5Lu0ECyLRtAFDSB%2F229DRtWvPq9G0RhSpYkwpNe%2FLs8Vmn7CgLN1gQSPMts0rqBM6w474eq7Ic0axjQynk%2BvD8n9ot3%2B8s3gZiNUQ7mfxIWzrgHb5noz6nm3%2FmXM2XdfkwSm1ou6qhuLln4CTtn%2FwIoiQLSKXviGM7QIAvbHlxO8n8N5AIBtU%2FYnaTJUSQl0cY%2FplOgAUkYfxP5BKSlJLlZpJEyuVewqUytb3C9UHDB3daA%3D%3D <br><br>HTTP traffic without referer:<br>HTTP headers sent:<br>HEAD / HTTP/1.1 <br>Host: luv.nu <br>Connection: Close <br> <br>HTTP headers recieved:<br>HTTP/1.1 302 Found <br>Date: Tue, 11 Jul 2017 21:56:50 GMT <br>Server: Apache <br>X-Powered-By: PHP/5.6.30-0+deb8u1 <br>Set-Cookie: __tad=1499810210.2188065; expires=Fri, 09-Jul-2027 21:56:50 GMT; Max-Age=315360000 <br>Location: http://ww11.luv.nu/ <br>Connection: close <br>Content-Type: text/html; charset=UTF-8 <br> <br><br>HTTP traffic with referer:<br>HTTP headers sent:<br>HEAD / HTTP/1.1 <br>Host: luv.nu <br>Referer: http://www.google.com/search?q=luv.nu <br>Connection: Close <br> <br>HTTP headers recieved:<br>HTTP/1.1 302 Found <br>Date: Tue, 11 Jul 2017 21:56:49 GMT <br>Server: Apache <br>X-Powered-By: PHP/5.6.30-0+deb8u1 <br>Set-Cookie: __tad=1499810209.7956473; expires=Fri, 09-Jul-2027 21:56:49 GMT; Max-Age=315360000 <br>Location: http://bidr.trellian.com/r2.php?e=cF8L0S4UvzZFbF2sJTBoT%2Bzwn10jVoD41mCkxmFpFIXsSqdGeHfRLtbj4EgsFUSNO9YqjzrvwGIZ3jWlQ0rZzE5gCn8XMgcxISpmnJXUoeJV1IQUHbzcKzsg8rvrjY0fqKmEfAyChkHbb8ZEbKqlbiSfr56AHaB5Nnhrabbd%2BAcex9SMh7yklqA2YGKifrGmPtBGvZL%2FXYbjhb6Pnxtm%2F3GW16X%2FPpx%2Fo%2FaAiGIMOhLGTcMxKOhf4FxeuuahtMhYPNcP3nqZj9s1xBHHnwq0J3oP0tahmkRHD4vkk6C5Lu0ECyLRtAFDSB%2F229DRtWvPq9G0RhSpYkwpNe%2FLs8Vmn7CgLN1gQSPMts0rqBM6w474eq7Ic0axjQynk%2BvD8n9ot3%2B8s3gZiNUQ7mfxIWzrgHb5noz6nm3%2FmXM2XdfkwSm1ou6qhuLln4CTtn%2FwIoiQLSKXviGM7QIAvbHlxO8n8N5AIBtU%2FYnaTJUSQl0cY%2FplOgAUkYfxP5BKSlJLlZpJEyuVewqUytb3C9UHDB3daA%3D%3D <br>Connection: close <br>Content-Type: text/html; charset=UTF-8<br><br>luv.nu is on 103.224.182.249<br>ASN for 103.224.182.249: 133618<br>Abusix contact information: abuse@trellian.com (information only)<br>103.224.182.249 corresponds with lb-182-249.above.com<br>Abuse.net does not have any reliable address for lb-182-249.above.com<br>Abuse address not found in whois.<br>Best guess from abuse.net: abuse@lb-182-249.above.com abuse@above.com1499844094http://bloei.nu/ (103.224.182.249) - Serp-hijackingAttacked url: http://bloei.nu/<br>Attack type: SERP-hijacking (see http://ikyon.com/attack-types/ for description)<br>Attack detected Tue, 11 Jul 2017 22:06:11 +0200<br><br>Visitors with referer are redirected to http://bidr.trellian.com/r2.php?e=cF8L0S4UvzZFbF2sJTBoT%2Bzwn10jVoD4w8Yx4r26cxNI2hMD2ruWt88NhvjWtVJi5ie6XAgm5XszaOkNEcEKCO%2FOH7AgFeUPqb5m5zprMOBwn2NJHIIpQ05t3Fd07iODbY5z4ggNUEpixefeFZQGH1cAr0lb%2Bogyv98xP%2Fec0FiHdVwRvYImKs9Wdeu4CaDXDrA3LOIppg2%2BvB6AueGOlPwPfty7eMPSJpQN7%2BRkCqU1k7higSsU%2BxDvDk0TA1Bpu5LLbGiIMBmPJSdA6GR%2BLer3nS4rie1aqVqBH5Lv2soC8e1abZiRZZ%2Bka6aO%2BRNiFxeAfle2xQR%2BgsIPTQD%2BIgQBTpoChabq8D8494pjx5qI0BFGHrqaj8%2BT8ZyckI%2B80M7izQ%2BYKxCS7E56R18aNT%2BUMp96rPbgCXrR4OFNZ2RDIgKytNFqgCPRVrqFxBbnFHsOHbkWEHTx1vTGBSZ8zVCSmUCxf%2FEbBaJDq39aipLNuk8PZvWFtNakaZsZ2bmIZKttxU93hel82XOzB8rp0Umh0yo9aKwb <br><br>HTTP traffic without referer:<br>HTTP headers sent:<br>HEAD / HTTP/1.1 <br>Host: bloei.nu <br>Connection: Close <br> <br>HTTP headers recieved:<br>HTTP/1.1 302 Found <br>Date: Tue, 11 Jul 2017 20:06:11 GMT <br>Server: Apache <br>X-Powered-By: PHP/5.6.30-0+deb8u1 <br>Set-Cookie: __tad=1499803571.7055870; expires=Fri, 09-Jul-2027 20:06:11 GMT; Max-Age=315360000 <br>Location: http://ww11.bloei.nu/ <br>Connection: close <br>Content-Type: text/html; charset=UTF-8 <br> <br><br>HTTP traffic with referer:<br>HTTP headers sent:<br>HEAD / HTTP/1.1 <br>Host: bloei.nu <br>Referer: http://www.google.com/search?q=bloei.nu <br>Connection: Close <br> <br>HTTP headers recieved:<br>HTTP/1.1 302 Found <br>Date: Tue, 11 Jul 2017 20:06:10 GMT <br>Server: Apache <br>X-Powered-By: PHP/5.6.30-0+deb8u1 <br>Set-Cookie: __tad=1499803571.8590828; expires=Fri, 09-Jul-2027 20:06:11 GMT; Max-Age=315360000 <br>Location: http://bidr.trellian.com/r2.php?e=cF8L0S4UvzZFbF2sJTBoT%2Bzwn10jVoD4w8Yx4r26cxNI2hMD2ruWt88NhvjWtVJi5ie6XAgm5XszaOkNEcEKCO%2FOH7AgFeUPqb5m5zprMOBwn2NJHIIpQ05t3Fd07iODbY5z4ggNUEpixefeFZQGH1cAr0lb%2Bogyv98xP%2Fec0FiHdVwRvYImKs9Wdeu4CaDXDrA3LOIppg2%2BvB6AueGOlPwPfty7eMPSJpQN7%2BRkCqU1k7higSsU%2BxDvDk0TA1Bpu5LLbGiIMBmPJSdA6GR%2BLer3nS4rie1aqVqBH5Lv2soC8e1abZiRZZ%2Bka6aO%2BRNiFxeAfle2xQR%2BgsIPTQD%2BIgQBTpoChabq8D8494pjx5qI0BFGHrqaj8%2BT8ZyckI%2B80M7izQ%2BYKxCS7E56R18aNT%2BUMp96rPbgCXrR4OFNZ2RDIgKytNFqgCPRVrqFxBbnFHsOHbkWEHTx1vTGBSZ8zVCSmUCxf%2FEbBaJDq39aipLNuk8PZvWFtNakaZsZ2bmIZKttxU93hel82XOzB8rp0Umh0yo9aKwb <br>Connection: close <br>Content-Type: text/html; charset=UTF-8<br><br>bloei.nu is on 103.224.182.249<br>ASN for 103.224.182.249: 133618<br>Abusix contact information: abuse@trellian.com (information only)<br>103.224.182.249 corresponds with lb-182-249.above.com<br>Abuse.net does not have any reliable address for lb-182-249.above.com<br>Abuse address not found in whois.<br>Best guess from abuse.net: abuse@lb-182-249.above.com abuse@above.com1499843986http://mon.nu/ (103.224.182.249) - Serp-hijackingAttacked url: http://mon.nu/<br>Attack type: SERP-hijacking (see http://ikyon.com/attack-types/ for description)<br>Attack detected Tue, 11 Jul 2017 19:47:13 +0200<br><br>Visitors with referer are redirected to http://bidr.trellian.com/r2.php?e=cF8L0S4UvzZFbF2sJTBoT%2Bzwn10jVoD495iPG7T0uJTPAfnP2U4mjSHjc22eLMBWMs43vNVRsHXSetXxOQaXDlx9RWpfRl9QdlieE3ztq4CIBF6ub715awxlC8ZNBWGVeFB0qpZCozoYTqP504inxZ8gM51cbMq233Fif2X4F2QZnk4%2B3Gw9hL6ejF4kHjTGArbketyRTtI443D%2FRCnuKe2qXEnrrkyGKehJz1xMTZ8Whx1UfWpksEf8rNEtOYKOQt18zkhLhvS8Pj1lSzctmSfir9y7qPECLYYyDJ3KkY4Zk2cjmXMsVm%2FihuGBDqSHDfZMJsOqPL8K7owaqotwLIrCEfj5%2Bq0IdYHDaeVxM3x55eEycR2opbYJ6YHNkCf1TW02uO5TMso3aT5%2BK%2B83hfMgKw%2BGjySoIVeLdrk6xhHH%2FZMTyW%2Ftqla%2FwqrUa87Bsw4UTscaxLe329wAtKBB0ja%2BbJf3ocaRowNPsU9mz%2F1dIv%2FzfiGu6oZ9mDxG3bxqPmPYPJ1vNmwOC3otiCUMQVmQwFMnZNMy <br><br>HTTP traffic without referer:<br>HTTP headers sent:<br>HEAD / HTTP/1.1 <br>Host: mon.nu <br>Connection: Close <br> <br>HTTP headers recieved:<br>HTTP/1.1 302 Found <br>Date: Tue, 11 Jul 2017 17:47:13 GMT <br>Server: Apache <br>X-Powered-By: PHP/5.6.30-0+deb8u1 <br>Set-Cookie: __tad=1499795233.8446400; expires=Fri, 09-Jul-2027 17:47:13 GMT; Max-Age=315360000 <br>Location: http://ww38.mon.nu/ <br>Connection: close <br>Content-Type: text/html; charset=UTF-8 <br> <br><br>HTTP traffic with referer:<br>HTTP headers sent:<br>HEAD / HTTP/1.1 <br>Host: mon.nu <br>Referer: http://www.google.com/search?q=mon.nu <br>Connection: Close <br> <br>HTTP headers recieved:<br>HTTP/1.1 302 Found <br>Date: Tue, 11 Jul 2017 17:47:12 GMT <br>Server: Apache <br>X-Powered-By: PHP/5.6.30-0+deb8u1 <br>Set-Cookie: __tad=1499795232.3322523; expires=Fri, 09-Jul-2027 17:47:12 GMT; Max-Age=315360000 <br>Location: http://bidr.trellian.com/r2.php?e=cF8L0S4UvzZFbF2sJTBoT%2Bzwn10jVoD495iPG7T0uJTPAfnP2U4mjSHjc22eLMBWMs43vNVRsHXSetXxOQaXDlx9RWpfRl9QdlieE3ztq4CIBF6ub715awxlC8ZNBWGVeFB0qpZCozoYTqP504inxZ8gM51cbMq233Fif2X4F2QZnk4%2B3Gw9hL6ejF4kHjTGArbketyRTtI443D%2FRCnuKe2qXEnrrkyGKehJz1xMTZ8Whx1UfWpksEf8rNEtOYKOQt18zkhLhvS8Pj1lSzctmSfir9y7qPECLYYyDJ3KkY4Zk2cjmXMsVm%2FihuGBDqSHDfZMJsOqPL8K7owaqotwLIrCEfj5%2Bq0IdYHDaeVxM3x55eEycR2opbYJ6YHNkCf1TW02uO5TMso3aT5%2BK%2B83hfMgKw%2BGjySoIVeLdrk6xhHH%2FZMTyW%2Ftqla%2FwqrUa87Bsw4UTscaxLe329wAtKBB0ja%2BbJf3ocaRowNPsU9mz%2F1dIv%2FzfiGu6oZ9mDxG3bxqPmPYPJ1vNmwOC3otiCUMQVmQwFMnZNMy <br>Connection: close <br>Content-Type: text/html; charset=UTF-8<br><br>mon.nu is on 103.224.182.249<br>ASN for 103.224.182.249: 133618<br>Abusix contact information: abuse@trellian.com (information only)<br>103.224.182.249 corresponds with lb-182-249.above.com<br>Abuse.net does not have any reliable address for lb-182-249.above.com<br>Abuse address not found in whois.<br>Best guess from abuse.net: abuse@above.com abuse@lb-182-249.above.com1499843826http://knaser.nu/ (103.224.182.249) - Serp-hijackingAttacked url: http://knaser.nu/<br>Attack type: SERP-hijacking (see http://ikyon.com/attack-types/ for description)<br>Attack detected Tue, 04 Jul 2017 00:14:47 +0200<br><br>Visitors with referer are redirected to http://bidr.trellian.com/r2.php?e=cF8L0S4UvzZFbF2sJTBoTyhEAxOsUZ48LA6FrUCOWOla8cSfE5qdGZjyOS4Lro1MqrXvmYi3ln2z%2BiMJ%2FEOCwGovaX4ECa8ILPb6kXf77I7qKPXXiMidmyrKoDE2GcwJWrzssS1%2BbSLZbhP6OSxVqrRkdXitCTQVq4VBxJEPQTz5Voh8Gl7oGudRp%2Bzuv%2B6v4HXuATnRVHQDAnzT2vtG6AmIxfHTL5DqnkdNShoSzrBFLPdUzgNhseNhid%2FyQ%2FBZENUClagSIZrE1SxviTXbYcmsb3ZySWs0M9Ex7rTrdlZGCpFuV1rClNKrozbPCz6TURBUVIG7ecZ47Jgr1p8FlDzdlfjfyIm20c0rC6ZWdobcK2%2BdAfcXMutnd0yLiLj9YBmuN47dfsBY6NjP%2B%2FBsd45ODDCpV1azQOQnEsSULkY5xlR6flZc%2BaoWKRUs0zR7kcMZFpKv3a0kq3XzwIFZbIjoLsSpuvP1CJsGePe94S1FK40flJkMVsW%2BYnRCfKLbRRd4ClezkxTaJVpE84dNGOIz%2FZkFCbIGaeYdsw6YcUQ%3D <br><br>HTTP traffic without referer:<br>HTTP headers sent:<br>HEAD / HTTP/1.1 <br>Host: knaser.nu <br>Connection: Close <br> <br>HTTP headers recieved:<br>HTTP/1.1 302 Found <br>Date: Mon, 03 Jul 2017 22:14:52 GMT <br>Server: Apache <br>X-Powered-By: PHP/5.6.30-0+deb8u1 <br>Set-Cookie: __tad=1499120092.5188312; expires=Thu, 01-Jul-2027 22:14:52 GMT; Max-Age=315360000 <br>Location: http://ww11.knaser.nu/ <br>Connection: close <br>Content-Type: text/html; charset=UTF-8 <br> <br><br>HTTP traffic with referer:<br>HTTP headers sent:<br>HEAD / HTTP/1.1 <br>Host: knaser.nu <br>Referer: http://www.google.com/search?q=knaser.nu <br>Connection: Close <br> <br>HTTP headers recieved:<br>HTTP/1.1 302 Found <br>Date: Mon, 03 Jul 2017 22:14:51 GMT <br>Server: Apache <br>X-Powered-By: PHP/5.6.30-0+deb8u1 <br>Set-Cookie: __tad=1499120091.8875415; expires=Thu, 01-Jul-2027 22:14:51 GMT; Max-Age=315360000 <br>Location: http://bidr.trellian.com/r2.php?e=cF8L0S4UvzZFbF2sJTBoTyhEAxOsUZ48LA6FrUCOWOla8cSfE5qdGZjyOS4Lro1MqrXvmYi3ln2z%2BiMJ%2FEOCwGovaX4ECa8ILPb6kXf77I7qKPXXiMidmyrKoDE2GcwJWrzssS1%2BbSLZbhP6OSxVqrRkdXitCTQVq4VBxJEPQTz5Voh8Gl7oGudRp%2Bzuv%2B6v4HXuATnRVHQDAnzT2vtG6AmIxfHTL5DqnkdNShoSzrBFLPdUzgNhseNhid%2FyQ%2FBZENUClagSIZrE1SxviTXbYcmsb3ZySWs0M9Ex7rTrdlZGCpFuV1rClNKrozbPCz6TURBUVIG7ecZ47Jgr1p8FlDzdlfjfyIm20c0rC6ZWdobcK2%2BdAfcXMutnd0yLiLj9YBmuN47dfsBY6NjP%2B%2FBsd45ODDCpV1azQOQnEsSULkY5xlR6flZc%2BaoWKRUs0zR7kcMZFpKv3a0kq3XzwIFZbIjoLsSpuvP1CJsGePe94S1FK40flJkMVsW%2BYnRCfKLbRRd4ClezkxTaJVpE84dNGOIz%2FZkFCbIGaeYdsw6YcUQ%3D <br>Connection: close <br>Content-Type: text/html; charset=UTF-8<br><br>knaser.nu is on 103.224.182.249<br>ASN for 103.224.182.249: 133618<br>Abusix contact information: abuse@trellian.com (information only)<br>103.224.182.249 corresponds with lb-182-249.above.com<br>Abuse.net does not have any reliable address for lb-182-249.above.com<br>Abuse address not found in whois.<br>Best guess from abuse.net: abuse@lb-182-249.above.com abuse@above.com1499173243http://sekai.nu/ (103.224.182.249) - Serp-hijackingAttacked url: http://sekai.nu/<br>Attack type: SERP-hijacking (see http://ikyon.com/attack-types/ for description)<br>Attack detected Mon, 03 Jul 2017 17:53:35 +0200<br><br>Visitors with referer are redirected to http://bidr.trellian.com/r2.php?e=cF8L0S4UvzZFbF2sJTBoTyhEAxOsUZ482nD8nVHIqHHq4UuPObwuA02zE1TIjKyvjvzvwCjLZRlzOiTiE1abu4iUQGTRh9xdAH86pEQakdzXshUJlh9ecQnynP5nALLYLGIOabD8gdV%2B51Th5mZd6%2FC5YxU2lZWaF9QNXsRgYTtsW3gz36CdoKKaKaB9x%2BOiDJzwOzBXnlcRv2LpRHAcTYE67QonaxnPhLlx%2F1lNxkG869hruqJrt9L0fF6kv8L38deIh3k352bHIlhUQNVzBvsjqfRM6ahVPlJGNTl2Y0kIiHHXcRDgvxCwW9PvznwiStDiXP3PAup9jaqEzp7XxlyDhdqmU4YIfoSzQHTiyuCOf7B56az36nN0LBCA0666VWh4lG%2FjYpk84b6d5vpPSc5gu9hMSA7CjpF3KxpsjFxW8PuZ0vniXM0eI7bihJ70j1jx6OQWthqGGn0L2Id9LXqo7h7UpFNKR6vwDv6j2Eg5ksWoWky2G%2BjEjvAbAKtByGII5RS%2FvvHd1DnDvkHv9MMdGuUQQiNm <br><br>HTTP traffic without referer:<br>HTTP headers sent:<br>HEAD / HTTP/1.1 <br>Host: sekai.nu <br>Connection: Close <br> <br>HTTP headers recieved:<br>HTTP/1.1 302 Found <br>Date: Mon, 03 Jul 2017 15:53:35 GMT <br>Server: Apache <br>X-Powered-By: PHP/5.6.30-0+deb8u1 <br>Set-Cookie: __tad=1499097215.3217619; expires=Thu, 01-Jul-2027 15:53:35 GMT; Max-Age=315360000 <br>Location: http://ww11.sekai.nu/ <br>Connection: close <br>Content-Type: text/html; charset=UTF-8 <br> <br><br>HTTP traffic with referer:<br>HTTP headers sent:<br>HEAD / HTTP/1.1 <br>Host: sekai.nu <br>Referer: http://www.google.com/search?q=sekai.nu <br>Connection: Close <br> <br>HTTP headers recieved:<br>HTTP/1.1 302 Found <br>Date: Mon, 03 Jul 2017 15:53:34 GMT <br>Server: Apache <br>X-Powered-By: PHP/5.6.30-0+deb8u1 <br>Set-Cookie: __tad=1499097215.3633069; expires=Thu, 01-Jul-2027 15:53:35 GMT; Max-Age=315360000 <br>Location: http://bidr.trellian.com/r2.php?e=cF8L0S4UvzZFbF2sJTBoTyhEAxOsUZ482nD8nVHIqHHq4UuPObwuA02zE1TIjKyvjvzvwCjLZRlzOiTiE1abu4iUQGTRh9xdAH86pEQakdzXshUJlh9ecQnynP5nALLYLGIOabD8gdV%2B51Th5mZd6%2FC5YxU2lZWaF9QNXsRgYTtsW3gz36CdoKKaKaB9x%2BOiDJzwOzBXnlcRv2LpRHAcTYE67QonaxnPhLlx%2F1lNxkG869hruqJrt9L0fF6kv8L38deIh3k352bHIlhUQNVzBvsjqfRM6ahVPlJGNTl2Y0kIiHHXcRDgvxCwW9PvznwiStDiXP3PAup9jaqEzp7XxlyDhdqmU4YIfoSzQHTiyuCOf7B56az36nN0LBCA0666VWh4lG%2FjYpk84b6d5vpPSc5gu9hMSA7CjpF3KxpsjFxW8PuZ0vniXM0eI7bihJ70j1jx6OQWthqGGn0L2Id9LXqo7h7UpFNKR6vwDv6j2Eg5ksWoWky2G%2BjEjvAbAKtByGII5RS%2FvvHd1DnDvkHv9MMdGuUQQiNm <br>Connection: close <br>Content-Type: text/html; charset=UTF-8<br><br>sekai.nu is on 103.224.182.249<br>ASN for 103.224.182.249: 133618<br>Abusix contact information: abuse@trellian.com (information only)<br>103.224.182.249 corresponds with lb-182-249.above.com<br>Abuse.net does not have any reliable address for lb-182-249.above.com<br>Abuse address not found in whois.<br>Best guess from abuse.net: abuse@above.com abuse@lb-182-249.above.com1499173157http://shpilka.nu/ (103.224.182.249) - Serp-hijackingAttacked url: http://shpilka.nu/<br>Attack type: SERP-hijacking (see http://ikyon.com/attack-types/ for description)<br>Attack detected Mon, 03 Jul 2017 11:40:28 +0200<br><br>Visitors with referer are redirected to http://bidr.trellian.com/r2.php?e=cF8L0S4UvzZFbF2sJTBoT4H%2FTForGCHASivPljoKCpHSJX2G9FYwhKC842rHgEuFBegrZJiacPXPVm35WBl5WGZXWDWqfoGDhRISVrh2%2FoV18l15hugoznCHovR9Bsl5NYNm3pmg066eMB4LHZBUVzzH2s%2BjhhPkFyRBXk1yswh22WqcvXqPfnzpnKg%2BW4N0vRVwKg5J3CAEP8WIRhg8z46tkWboEOrHB4kHoSwbcR5Hyc6uYsvV8DTxt013j17utW179PJfJ3cM4kbl8QeDd9PW8acxnIgp84J54ada09lihXhs1ZRNtCTATv8QTVmFGlLTsmD9LJVOxpTnubwYGvgkVY8rAj4Kdj0RLCEDrhMbI5PqT7Wfnkcc4DWUsAk44%2FNjXJ6qyHF3KR325SOOZvnq0F9RlR4TFHXAyrruZVYaPcX9wIzDzGctHMP8Ssz5TeLS5UbmvR1b30xGDqWHhfEoJeviBytmYUZR8D1XGGEp%2FZVi%2Bp6Eo1rNyk3lxl0ED6HGnKxKzHjKpAdkLUpeMtWKeRr1a6NA <br><br>HTTP traffic without referer:<br>HTTP headers sent:<br>HEAD / HTTP/1.1 <br>Host: shpilka.nu <br>Connection: Close <br> <br>HTTP headers recieved:<br>HTTP/1.1 302 Found <br>Date: Mon, 03 Jul 2017 09:40:33 GMT <br>Server: Apache <br>X-Powered-By: PHP/5.6.30-0+deb8u1 <br>Set-Cookie: __tad=1499074833.4675662; expires=Thu, 01-Jul-2027 09:40:33 GMT; Max-Age=315360000 <br>Location: http://ww1.shpilka.nu/ <br>Connection: close <br>Content-Type: text/html; charset=UTF-8 <br> <br><br>HTTP traffic with referer:<br>HTTP headers sent:<br>HEAD / HTTP/1.1 <br>Host: shpilka.nu <br>Referer: http://www.google.com/search?q=shpilka.nu <br>Connection: Close <br> <br>HTTP headers recieved:<br>HTTP/1.1 302 Found <br>Date: Mon, 03 Jul 2017 09:40:32 GMT <br>Server: Apache <br>X-Powered-By: PHP/5.6.30-0+deb8u1 <br>Set-Cookie: __tad=1499074832.4433155; expires=Thu, 01-Jul-2027 09:40:32 GMT; Max-Age=315360000 <br>Location: http://bidr.trellian.com/r2.php?e=cF8L0S4UvzZFbF2sJTBoT4H%2FTForGCHASivPljoKCpHSJX2G9FYwhKC842rHgEuFBegrZJiacPXPVm35WBl5WGZXWDWqfoGDhRISVrh2%2FoV18l15hugoznCHovR9Bsl5NYNm3pmg066eMB4LHZBUVzzH2s%2BjhhPkFyRBXk1yswh22WqcvXqPfnzpnKg%2BW4N0vRVwKg5J3CAEP8WIRhg8z46tkWboEOrHB4kHoSwbcR5Hyc6uYsvV8DTxt013j17utW179PJfJ3cM4kbl8QeDd9PW8acxnIgp84J54ada09lihXhs1ZRNtCTATv8QTVmFGlLTsmD9LJVOxpTnubwYGvgkVY8rAj4Kdj0RLCEDrhMbI5PqT7Wfnkcc4DWUsAk44%2FNjXJ6qyHF3KR325SOOZvnq0F9RlR4TFHXAyrruZVYaPcX9wIzDzGctHMP8Ssz5TeLS5UbmvR1b30xGDqWHhfEoJeviBytmYUZR8D1XGGEp%2FZVi%2Bp6Eo1rNyk3lxl0ED6HGnKxKzHjKpAdkLUpeMtWKeRr1a6NA <br>Connection: close <br>Content-Type: text/html; charset=UTF-8<br><br>shpilka.nu is on 103.224.182.249<br>ASN for 103.224.182.249: 133618<br>Abusix contact information: abuse@trellian.com (information only)<br>103.224.182.249 corresponds with lb-182-249.above.com<br>Abuse.net does not have any reliable address for lb-182-249.above.com<br>Abuse address not found in whois.<br>Best guess from abuse.net: abuse@lb-182-249.above.com abuse@above.com1499087730http://essential.nu/ (103.224.182.249) - Serp-hijackingAttacked url: http://essential.nu/<br>Attack type: SERP-hijacking (see http://ikyon.com/attack-types/ for description)<br>Attack detected Sun, 02 Jul 2017 21:46:02 +0200<br><br>Visitors with referer are redirected to http://bidr.trellian.com/r2.php?e=cF8L0S4UvzZFbF2sJTBoT4H%2FTForGCHA5q%2B6HFJVDpJymrbwVyU3YguZzyAi%2FzNYyA6B%2Fzo1odxeDZjpbsSex1U5%2BEEp3NEIN8hsIAK9n2klFE5mYY7lAiOQcQdhL0fuCIr9zu%2BNw%2BMfeHFPdD4r1RPN3ZHcT8QcjuGGebhncH33PiyG1u7A8d3F1%2FiUkJzAewq%2BDae64QI%2BDTbyEb1J23THDM7o4wZigZP3N1oEF4ILsPQ4HLa6A64u%2F6N%2FrNHKvwM3Qoxbs0SHZ6XDeyY2RWrRmJju78fi04aegxtKlEk5RT444iAFE5%2FclYKkizKj%2FB9FHSIraa2V6mxd0zmSxtXnKxUhpiD7aJp%2FJ8lm%2F9JSa4YHS0sdu14zFsfgiG5lDJSadc2TEfKcfwyobFmwTY4Be6KOugiY7nNbdF5Mpsw6i59%2BPxlgzpq2KQ%2BRdga04sxAZF8CKDk3ITKzTjlkmezcDNBbS5VbeL0jTJqOZX9gCwwqE0K%2BYa66qCQ3KVqXtD0TIlsyKEpildYvf1Uhf8%2FrYoyBXev%2Bmxyz0USivamhUbcXjW7Ciw%3D%3D <br><br>HTTP traffic without referer:<br>HTTP headers sent:<br>HEAD / HTTP/1.1 <br>Host: essential.nu <br>Connection: Close <br> <br>HTTP headers recieved:<br>HTTP/1.1 302 Found <br>Date: Sun, 02 Jul 2017 19:46:06 GMT <br>Server: Apache <br>X-Powered-By: PHP/5.6.30-0+deb8u1 <br>Set-Cookie: __tad=1499024766.3033949; expires=Wed, 30-Jun-2027 19:46:06 GMT; Max-Age=315360000 <br>Location: http://ww11.essential.nu/ <br>Connection: close <br>Content-Type: text/html; charset=UTF-8 <br> <br><br>HTTP traffic with referer:<br>HTTP headers sent:<br>HEAD / HTTP/1.1 <br>Host: essential.nu <br>Referer: http://www.google.com/search?q=essential.nu <br>Connection: Close <br> <br>HTTP headers recieved:<br>HTTP/1.1 302 Found <br>Date: Sun, 02 Jul 2017 19:46:05 GMT <br>Server: Apache <br>X-Powered-By: PHP/5.6.30-0+deb8u1 <br>Set-Cookie: __tad=1499024765.2784098; expires=Wed, 30-Jun-2027 19:46:05 GMT; Max-Age=315360000 <br>Location: http://bidr.trellian.com/r2.php?e=cF8L0S4UvzZFbF2sJTBoT4H%2FTForGCHA5q%2B6HFJVDpJymrbwVyU3YguZzyAi%2FzNYyA6B%2Fzo1odxeDZjpbsSex1U5%2BEEp3NEIN8hsIAK9n2klFE5mYY7lAiOQcQdhL0fuCIr9zu%2BNw%2BMfeHFPdD4r1RPN3ZHcT8QcjuGGebhncH33PiyG1u7A8d3F1%2FiUkJzAewq%2BDae64QI%2BDTbyEb1J23THDM7o4wZigZP3N1oEF4ILsPQ4HLa6A64u%2F6N%2FrNHKvwM3Qoxbs0SHZ6XDeyY2RWrRmJju78fi04aegxtKlEk5RT444iAFE5%2FclYKkizKj%2FB9FHSIraa2V6mxd0zmSxtXnKxUhpiD7aJp%2FJ8lm%2F9JSa4YHS0sdu14zFsfgiG5lDJSadc2TEfKcfwyobFmwTY4Be6KOugiY7nNbdF5Mpsw6i59%2BPxlgzpq2KQ%2BRdga04sxAZF8CKDk3ITKzTjlkmezcDNBbS5VbeL0jTJqOZX9gCwwqE0K%2BYa66qCQ3KVqXtD0TIlsyKEpildYvf1Uhf8%2FrYoyBXev%2Bmxyz0USivamhUbcXjW7Ciw%3D%3D <br>Connection: close <br>Content-Type: text/html; charset=UTF-8<br><br>essential.nu is on 103.224.182.249<br>ASN for 103.224.182.249: 133618<br>Abusix contact information: abuse@trellian.com (information only)<br>103.224.182.249 corresponds with lb-182-249.above.com<br>Abuse.net does not have any reliable address for lb-182-249.above.com<br>Abuse address not found in whois.<br>Best guess from abuse.net: abuse@lb-182-249.above.com abuse@above.com1499087648http://mua.nu/ (103.224.182.249) - Serp-hijackingAttacked url: http://mua.nu/<br>Attack type: SERP-hijacking (see http://ikyon.com/attack-types/ for description)<br>Attack detected Tue, 27 Jun 2017 18:16:48 +0200<br><br>Visitors with referer are redirected to http://bidr.trellian.com/r2.php?e=cF8L0S4UvzZFbF2sJTBoT52gR5xz5JzTbIdpQowmsk9GifF8HaEAzFA059rar8XC3ARiU5qy%2BrEHAizhOt2saAJyulSIPWeUfxFbDEXTdTb0s%2FBttX6OVKxW7SjtJJlfD1Dm5O4esEx1Ck5qjyhyq1MUdl5jDsxZqy0POVYoLmXmC1uv4o8di3QwvmFQYrMwzVOzT6p2GXf5EYJu72SeIHz0HoFDbbjC3zZaQWI3i%2FRvL7XC2I1%2BKIPcerbOs6VYa5606izqs4TQjl22UzBk%2B7fuP%2Bv6EQGvJ1%2BZJjs6N7WnuTEsj0Vg4eNvCHI2OCrl4sUfS6V%2BsTMjQk%2BiB9m%2FjY6Whdzl2w8yaqTdC9JqKXC0eRbtTMohJbOetPDYTa0qbtvwHI1AEPcJZvxgK%2FXhqwjpbGuBLcp4pcE0RawDT6HDcXspgjwkxqgswehCFnmrEbZEJNLCKpmzu8Ie20%2By16eR2FPG6Sx57XQX3OLOY8gXP5DMJv9DscgbZI3j9JMdnOk%2Fb%2FaP54iIIYbf%2B%2FCReROrBKu9RUwy <br><br>HTTP traffic without referer:<br>HTTP headers sent:<br>HEAD / HTTP/1.1 <br>Host: mua.nu <br>Connection: Close <br> <br>HTTP headers recieved:<br>HTTP/1.1 302 Found <br>Date: Tue, 27 Jun 2017 16:16:48 GMT <br>Server: Apache <br>X-Powered-By: PHP/5.6.30-0+deb8u1 <br>Set-Cookie: __tad=1498580208.2247940; expires=Fri, 25-Jun-2027 16:16:48 GMT; Max-Age=315360000 <br>Location: http://ww11.mua.nu/ <br>Connection: close <br>Content-Type: text/html; charset=UTF-8 <br> <br><br>HTTP traffic with referer:<br>HTTP headers sent:<br>HEAD / HTTP/1.1 <br>Host: mua.nu <br>Referer: http://www.google.com/search?q=mua.nu <br>Connection: Close <br> <br>HTTP headers recieved:<br>HTTP/1.1 302 Found <br>Date: Tue, 27 Jun 2017 16:16:47 GMT <br>Server: Apache <br>X-Powered-By: PHP/5.6.30-0+deb8u1 <br>Set-Cookie: __tad=1498580207.1602645; expires=Fri, 25-Jun-2027 16:16:47 GMT; Max-Age=315360000 <br>Location: http://bidr.trellian.com/r2.php?e=cF8L0S4UvzZFbF2sJTBoT52gR5xz5JzTbIdpQowmsk9GifF8HaEAzFA059rar8XC3ARiU5qy%2BrEHAizhOt2saAJyulSIPWeUfxFbDEXTdTb0s%2FBttX6OVKxW7SjtJJlfD1Dm5O4esEx1Ck5qjyhyq1MUdl5jDsxZqy0POVYoLmXmC1uv4o8di3QwvmFQYrMwzVOzT6p2GXf5EYJu72SeIHz0HoFDbbjC3zZaQWI3i%2FRvL7XC2I1%2BKIPcerbOs6VYa5606izqs4TQjl22UzBk%2B7fuP%2Bv6EQGvJ1%2BZJjs6N7WnuTEsj0Vg4eNvCHI2OCrl4sUfS6V%2BsTMjQk%2BiB9m%2FjY6Whdzl2w8yaqTdC9JqKXC0eRbtTMohJbOetPDYTa0qbtvwHI1AEPcJZvxgK%2FXhqwjpbGuBLcp4pcE0RawDT6HDcXspgjwkxqgswehCFnmrEbZEJNLCKpmzu8Ie20%2By16eR2FPG6Sx57XQX3OLOY8gXP5DMJv9DscgbZI3j9JMdnOk%2Fb%2FaP54iIIYbf%2B%2FCReROrBKu9RUwy <br>Connection: close <br>Content-Type: text/html; charset=UTF-8<br><br>mua.nu is on 103.224.182.249<br>ASN for 103.224.182.249: 133618<br>Abusix contact information: abuse@trellian.com (information only)<br>103.224.182.249 corresponds with lb-182-249.above.com<br>Abuse.net does not have any reliable address for lb-182-249.above.com<br>Abuse address not found in whois.<br>Best guess from abuse.net: abuse@above.com abuse@lb-182-249.above.com1498637293http://afterhours.nu/ (103.224.182.249) - Serp-hijackingAttacked url: http://afterhours.nu/<br>Attack type: SERP-hijacking (see http://ikyon.com/attack-types/ for description)<br>Attack detected Sun, 25 Jun 2017 16:28:10 +0200<br><br>Visitors with referer are redirected to http://bidr.trellian.com/r2.php?e=cF8L0S4UvzZFbF2sJTBoT6sSzkBksKiZZT3omkWGOc9cr2zjTywsWbuV2WVd9XiZTFU23V6vt3wY9DSQsrjMonSehP3KvQvPI%2Br5uL8goaRA%2BfiRcthsbfKfY5WNhmFreUWO2O5rfGhmqJVC2r0I16vJP3SXpCRCrXqJ41pvS6oCmHRbQ1kDXQ2tfzT3eh8se6srI4E64TKJ64SlPyxF%2BLB4TVqmz04URbamjpFhI%2BWNKclSJOy%2BWRFUyMeY1%2BdgglKDXZdkL%2FVhR4%2FJATPtD20rFL7NeRAmBwSvKh27ndYxdMxdwHA93Ugon86OTbFmhtyIkRLmVV0Iyexft9kDVK7%2F4M1AGVF0llya8LUg1Y8lY05WTsWQpI9QEaJZcsQW5C04wyL5JAYooayVrpAdll9iDNRyrHy3TpUIo4WHW7Do8jdlKUAAC97m2CBPP0BzOJE4X6mPj44apfV%2FCp0I8sKIyqQRf%2B6tkz9oqGjRAez9Il%2FzCHdxnErXLrNq4wggYA6yt9lu7%2F0%2FB%2FJCDaWyAhd7LK4%2BA%2BdbEyP8wLv1gl0QzVtMI3CejHedbRnhUbEr <br><br>HTTP traffic without referer:<br>HTTP headers sent:<br>HEAD / HTTP/1.1 <br>Host: afterhours.nu <br>Connection: Close <br> <br>HTTP headers recieved:<br>HTTP/1.1 302 Found <br>Date: Sun, 25 Jun 2017 14:28:13 GMT <br>Server: Apache <br>X-Powered-By: PHP/5.6.30-0+deb8u1 <br>Set-Cookie: __tad=1498400893.2797023; expires=Wed, 23-Jun-2027 14:28:13 GMT; Max-Age=315360000 <br>Location: http://ww11.afterhours.nu/ <br>Connection: close <br>Content-Type: text/html; charset=UTF-8 <br> <br><br>HTTP traffic with referer:<br>HTTP headers sent:<br>HEAD / HTTP/1.1 <br>Host: afterhours.nu <br>Referer: http://www.google.com/search?q=afterhours.nu <br>Connection: Close <br> <br>HTTP headers recieved:<br>HTTP/1.1 302 Found <br>Date: Sun, 25 Jun 2017 14:28:12 GMT <br>Server: Apache <br>X-Powered-By: PHP/5.6.30-0+deb8u1 <br>Set-Cookie: __tad=1498400893.5033887; expires=Wed, 23-Jun-2027 14:28:13 GMT; Max-Age=315360000 <br>Location: http://bidr.trellian.com/r2.php?e=cF8L0S4UvzZFbF2sJTBoT6sSzkBksKiZZT3omkWGOc9cr2zjTywsWbuV2WVd9XiZTFU23V6vt3wY9DSQsrjMonSehP3KvQvPI%2Br5uL8goaRA%2BfiRcthsbfKfY5WNhmFreUWO2O5rfGhmqJVC2r0I16vJP3SXpCRCrXqJ41pvS6oCmHRbQ1kDXQ2tfzT3eh8se6srI4E64TKJ64SlPyxF%2BLB4TVqmz04URbamjpFhI%2BWNKclSJOy%2BWRFUyMeY1%2BdgglKDXZdkL%2FVhR4%2FJATPtD20rFL7NeRAmBwSvKh27ndYxdMxdwHA93Ugon86OTbFmhtyIkRLmVV0Iyexft9kDVK7%2F4M1AGVF0llya8LUg1Y8lY05WTsWQpI9QEaJZcsQW5C04wyL5JAYooayVrpAdll9iDNRyrHy3TpUIo4WHW7Do8jdlKUAAC97m2CBPP0BzOJE4X6mPj44apfV%2FCp0I8sKIyqQRf%2B6tkz9oqGjRAez9Il%2FzCHdxnErXLrNq4wggYA6yt9lu7%2F0%2FB%2FJCDaWyAhd7LK4%2BA%2BdbEyP8wLv1gl0QzVtMI3CejHedbRnhUbEr <br>Connection: close <br>Content-Type: text/html; charset=UTF-8<br><br>afterhours.nu is on 103.224.182.249<br>ASN for 103.224.182.249: 133618<br>Abusix contact information: abuse@trellian.com (information only)<br>103.224.182.249 corresponds with lb-182-249.above.com<br>Abuse.net does not have any reliable address for lb-182-249.above.com<br>Abuse address not found in whois.<br>Best guess from abuse.net: abuse@above.com abuse@lb-182-249.above.com1498482200http://trend7tra.nu/ (103.224.182.249) - Serp-hijackingAttacked url: http://trend7tra.nu/<br>Attack type: SERP-hijacking (see http://ikyon.com/attack-types/ for description)<br>Attack detected Tue, 20 Jun 2017 02:32:11 +0200<br><br>Visitors with referer are redirected to http://bidr.trellian.com/r2.php?e=cF8L0S4UvzZFbF2sJTBoT4XKo%2Fgxkdz1HmTwvZPcuyosKYU5dp8wQNyyWJiqx%2FIeX2roPJiCEM2WXXnrAD7IXUp9GSFOjrM68lvAVePinx0NuKHHsEZRAzgSU112p3L5NAIvRwr%2F9SGr9r4VSbVwqd5WzK42JAFS2hyPkyPk6KnTnvKLacCVLp1jokeCe2RwY24kGu%2BhX%2BAUclStNK%2FqH%2BFo%2F86Q7oENXXU7PN6dZiU4MABoDQp6c8BQBN%2Bq5hnEfLpDvQCkbDfjQaKJPNIYDE%2FXJBE5mh3U6ARh%2BpdRmR%2FANzIwRIfsDrZP5QR0iOUrjJOeMWamPFJ0G1r3gL0LIevOgQIrVNUMPSgCfd6FD4Vhxa8n4MGNDIs8rjscKdBlLoHGEDPH3eCrTe4tUUaYXjrpcDetSH7ms6GLXez7HNHxEZDfOsLlAKIrt19YLoY6ReX1KxYkdgp4BWPdiZ1muLHuoaI0DK4O9JkrowbS0vJFpFyfv%2Fpzd7RQa2dnnAxV%2BdtSVLfjo%2BAuIKGxO92i1VVZzvxsWGDHg5hWLGW2lZ8ifbZKmP58UA%3D%3D <br><br>HTTP traffic without referer:<br>HTTP headers sent:<br>HEAD / HTTP/1.1 <br>Host: trend7tra.nu <br>Connection: Close <br> <br>HTTP headers recieved:<br>HTTP/1.1 302 Found <br>Date: Tue, 20 Jun 2017 00:32:12 GMT <br>Server: Apache <br>X-Powered-By: PHP/5.6.30-0+deb8u1 <br>Set-Cookie: __tad=1497918732.1088573; expires=Fri, 18-Jun-2027 00:32:12 GMT; Max-Age=315360000 <br>Location: http://ww11.trend7tra.nu/ <br>Connection: close <br>Content-Type: text/html; charset=UTF-8 <br> <br><br>HTTP traffic with referer:<br>HTTP headers sent:<br>HEAD / HTTP/1.1 <br>Host: trend7tra.nu <br>Referer: http://www.google.com/search?q=trend7tra.nu <br>Connection: Close <br> <br>HTTP headers recieved:<br>HTTP/1.1 302 Found <br>Date: Tue, 20 Jun 2017 00:32:11 GMT <br>Server: Apache <br>X-Powered-By: PHP/5.6.30-0+deb8u1 <br>Set-Cookie: __tad=1497918731.6918405; expires=Fri, 18-Jun-2027 00:32:11 GMT; Max-Age=315360000 <br>Location: http://bidr.trellian.com/r2.php?e=cF8L0S4UvzZFbF2sJTBoT4XKo%2Fgxkdz1HmTwvZPcuyosKYU5dp8wQNyyWJiqx%2FIeX2roPJiCEM2WXXnrAD7IXUp9GSFOjrM68lvAVePinx0NuKHHsEZRAzgSU112p3L5NAIvRwr%2F9SGr9r4VSbVwqd5WzK42JAFS2hyPkyPk6KnTnvKLacCVLp1jokeCe2RwY24kGu%2BhX%2BAUclStNK%2FqH%2BFo%2F86Q7oENXXU7PN6dZiU4MABoDQp6c8BQBN%2Bq5hnEfLpDvQCkbDfjQaKJPNIYDE%2FXJBE5mh3U6ARh%2BpdRmR%2FANzIwRIfsDrZP5QR0iOUrjJOeMWamPFJ0G1r3gL0LIevOgQIrVNUMPSgCfd6FD4Vhxa8n4MGNDIs8rjscKdBlLoHGEDPH3eCrTe4tUUaYXjrpcDetSH7ms6GLXez7HNHxEZDfOsLlAKIrt19YLoY6ReX1KxYkdgp4BWPdiZ1muLHuoaI0DK4O9JkrowbS0vJFpFyfv%2Fpzd7RQa2dnnAxV%2BdtSVLfjo%2BAuIKGxO92i1VVZzvxsWGDHg5hWLGW2lZ8ifbZKmP58UA%3D%3D <br>Connection: close <br>Content-Type: text/html; charset=UTF-8<br><br>trend7tra.nu is on 103.224.182.249<br>ASN for 103.224.182.249: 133618<br>Abusix contact information: abuse@trellian.com (information only)<br>103.224.182.249 corresponds with lb-182-249.above.com<br>Abuse.net does not have any reliable address for lb-182-249.above.com<br>Abuse address not found in whois.<br>Best guess from abuse.net: abuse@lb-182-249.above.com abuse@above.com1497971084http://christina-aguilera.nu/ (103.224.182.249) - Serp-hijackingAttacked url: http://christina-aguilera.nu/<br>Attack type: SERP-hijacking (see http://ikyon.com/attack-types/ for description)<br>Attack detected Mon, 19 Jun 2017 02:42:58 +0200<br><br>Visitors with referer are redirected to http://bidr.trellian.com/r2.php?e=cF8L0S4UvzZFbF2sJTBoT9c2HXXKlhVjyecYeRbyGG%2BvX0m4jYju3btOinrsg5SYMmTfE6EO5FWwvrP3bZeRf%2BW0OPMkA%2BKVns%2FPxdRZW3h8tGfVrzFRzh1rQWBglrsqikMe8Q2j6h9OFP9N7ibUDdiOhTF9RRU9bpfAyOv%2FlgnDQTTOpUmaQGvh4s0581h8FUwJq2lXTFZWHFXORjY0VG6VuXqGqVqR18TBR3MpzLEbaLfacey4wh%2Ban8Piawip23Kn%2B5qvC7ybIqENGnVuBGgJ1Gm8tNiUHR8kpQPe%2B9PUYcv1iAFsM3cDAqsQlCHbi0mimv8lEw8dpY3t5lL5DgBumJvBa4WrCHtMGZoaojTLBLc1bNVYiof0exp8%2B8p8MdCgNMwDlGljbGfuD2ykoND%2Fx1UWOzeCllML2DdeLGpcwSHfOpJTXxjkN2mongoiInv6S49fGQEhvfdTQ89kwosG9PdtU0XjaI6fmpWwac2JDGx5Om0AtpWGPihLXyA906EPFIyRbpSohksOk7VNy50Vb3bwngdXOEek0iw5ceeQEMVJQolFsyLbWrEatVNIlolLuRzVvfmcG0BKDiF9Q8W1J9N8Jcsg <br><br>HTTP traffic without referer:<br>HTTP headers sent:<br>HEAD / HTTP/1.1 <br>Host: christina-aguilera.nu <br>Connection: Close <br> <br>HTTP headers recieved:<br>HTTP/1.1 302 Found <br>Date: Mon, 19 Jun 2017 00:42:58 GMT <br>Server: Apache <br>X-Powered-By: PHP/5.4.45-0+deb7u8 <br>Set-Cookie: __tad=1497832978.4204740; expires=Thu, 17-Jun-2027 00:42:58 GMT <br>Location: http://ww11.christina-aguilera.nu/ <br>Connection: close <br>Content-Type: text/html; charset=UTF-8 <br> <br><br>HTTP traffic with referer:<br>HTTP headers sent:<br>HEAD / HTTP/1.1 <br>Host: christina-aguilera.nu <br>Referer: http://www.google.com/search?q=christina-aguilera.nu <br>Connection: Close <br> <br>HTTP headers recieved:<br>HTTP/1.1 302 Found <br>Date: Mon, 19 Jun 2017 00:42:57 GMT <br>Server: Apache <br>X-Powered-By: PHP/5.6.30-0+deb8u1 <br>Set-Cookie: __tad=1497832977.5696951; expires=Thu, 17-Jun-2027 00:42:57 GMT; Max-Age=315360000 <br>Location: http://bidr.trellian.com/r2.php?e=cF8L0S4UvzZFbF2sJTBoT9c2HXXKlhVjyecYeRbyGG%2BvX0m4jYju3btOinrsg5SYMmTfE6EO5FWwvrP3bZeRf%2BW0OPMkA%2BKVns%2FPxdRZW3h8tGfVrzFRzh1rQWBglrsqikMe8Q2j6h9OFP9N7ibUDdiOhTF9RRU9bpfAyOv%2FlgnDQTTOpUmaQGvh4s0581h8FUwJq2lXTFZWHFXORjY0VG6VuXqGqVqR18TBR3MpzLEbaLfacey4wh%2Ban8Piawip23Kn%2B5qvC7ybIqENGnVuBGgJ1Gm8tNiUHR8kpQPe%2B9PUYcv1iAFsM3cDAqsQlCHbi0mimv8lEw8dpY3t5lL5DgBumJvBa4WrCHtMGZoaojTLBLc1bNVYiof0exp8%2B8p8MdCgNMwDlGljbGfuD2ykoND%2Fx1UWOzeCllML2DdeLGpcwSHfOpJTXxjkN2mongoiInv6S49fGQEhvfdTQ89kwosG9PdtU0XjaI6fmpWwac2JDGx5Om0AtpWGPihLXyA906EPFIyRbpSohksOk7VNy50Vb3bwngdXOEek0iw5ceeQEMVJQolFsyLbWrEatVNIlolLuRzVvfmcG0BKDiF9Q8W1J9N8Jcsg <br>Connection: close <br>Content-Type: text/html; charset=UTF-8<br><br>christina-aguilera.nu is on 103.224.182.249<br>ASN for 103.224.182.249: 133618<br>Abusix contact information: abuse@trellian.com (information only)<br>103.224.182.249 corresponds with lb-182-249.above.com<br>Abuse.net does not have any reliable address for lb-182-249.above.com<br>Abuse address not found in whois.<br>Best guess from abuse.net: abuse@above.com abuse@lb-182-249.above.com1497853543http://hjarntorget.nu/ (103.224.182.249) - Serp-hijackingAttacked url: http://hjarntorget.nu/<br>Attack type: SERP-hijacking (see http://ikyon.com/attack-types/ for description)<br>Attack detected Mon, 19 Jun 2017 01:07:55 +0200<br><br>Visitors with referer are redirected to http://bidr.trellian.com/r2.php?e=cF8L0S4UvzZFbF2sJTBoT9c2HXXKlhVjirmy8PGgNC2YvwLwaVR04yKZFU3%2FqqQ30HQz7YtD00Iy%2BGEJJLEYx2yw0qf7E%2Fxl90%2F31089ZbY57NKNkrNwT9qxx2fkdvRXezCyXIhEkSHGdJw99bEsDNXKloD5aQ9aBUwNq9lruKb3EISl9kmrhGRJ%2BsV%2Bp6vKM1IhIf%2FJYhwr6Wcfav%2BjO6zaH4mhAhfglJa%2F7ep7WlJR3DNAGOxZgQNmq7JlsrT5NpruMZW8kiScUdLfKRnNTBZJTljYZ7GbztIbbSpTAJmyvTg9os3llK6h7GERleAt54hPc7Qk1juBIlJQlcTtsPlKvsULrt3y%2BJsmVOGCoyWYLIq5MTcpZI2Dpdw%2BH1gkNyc8Y4yl3qkXpKJYZ9hqW7ruy%2FcU%2BkiNatqt7gfxwuxmTZrGlcpDhkEjni%2BOAPE8QnyesnrNl6Le0afUFsGoI%2B8x5bvl54qbKWalrHxQYS09VOZbkeeJy4%2FEKJcerr5B6BYso9d4sTFTAi6hdux%2FQfHlkam%2BQrXrgt7GK93vKHTmV%2BI5iHwUQg%3D%3D <br><br>HTTP traffic without referer:<br>HTTP headers sent:<br>HEAD / HTTP/1.1 <br>Host: hjarntorget.nu <br>Connection: Close <br> <br>HTTP headers recieved:<br>HTTP/1.1 302 Found <br>Date: Sun, 18 Jun 2017 23:07:56 GMT <br>Server: Apache <br>X-Powered-By: PHP/5.6.30-0+deb8u1 <br>Set-Cookie: __tad=1497827276.2772061; expires=Wed, 16-Jun-2027 23:07:56 GMT; Max-Age=315360000 <br>Location: http://ww11.hjarntorget.nu/ <br>Connection: close <br>Content-Type: text/html; charset=UTF-8 <br> <br><br>HTTP traffic with referer:<br>HTTP headers sent:<br>HEAD / HTTP/1.1 <br>Host: hjarntorget.nu <br>Referer: http://www.google.com/search?q=hjarntorget.nu <br>Connection: Close <br> <br>HTTP headers recieved:<br>HTTP/1.1 302 Found <br>Date: Sun, 18 Jun 2017 23:07:55 GMT <br>Server: Apache <br>X-Powered-By: PHP/5.6.30-0+deb8u1 <br>Set-Cookie: __tad=1497827275.2614831; expires=Wed, 16-Jun-2027 23:07:55 GMT; Max-Age=315360000 <br>Location: http://bidr.trellian.com/r2.php?e=cF8L0S4UvzZFbF2sJTBoT9c2HXXKlhVjirmy8PGgNC2YvwLwaVR04yKZFU3%2FqqQ30HQz7YtD00Iy%2BGEJJLEYx2yw0qf7E%2Fxl90%2F31089ZbY57NKNkrNwT9qxx2fkdvRXezCyXIhEkSHGdJw99bEsDNXKloD5aQ9aBUwNq9lruKb3EISl9kmrhGRJ%2BsV%2Bp6vKM1IhIf%2FJYhwr6Wcfav%2BjO6zaH4mhAhfglJa%2F7ep7WlJR3DNAGOxZgQNmq7JlsrT5NpruMZW8kiScUdLfKRnNTBZJTljYZ7GbztIbbSpTAJmyvTg9os3llK6h7GERleAt54hPc7Qk1juBIlJQlcTtsPlKvsULrt3y%2BJsmVOGCoyWYLIq5MTcpZI2Dpdw%2BH1gkNyc8Y4yl3qkXpKJYZ9hqW7ruy%2FcU%2BkiNatqt7gfxwuxmTZrGlcpDhkEjni%2BOAPE8QnyesnrNl6Le0afUFsGoI%2B8x5bvl54qbKWalrHxQYS09VOZbkeeJy4%2FEKJcerr5B6BYso9d4sTFTAi6hdux%2FQfHlkam%2BQrXrgt7GK93vKHTmV%2BI5iHwUQg%3D%3D <br>Connection: close <br>Content-Type: text/html; charset=UTF-8<br><br>hjarntorget.nu is on 103.224.182.249<br>ASN for 103.224.182.249: 133618<br>Abusix contact information: abuse@trellian.com (information only)<br>103.224.182.249 corresponds with lb-182-249.above.com<br>Abuse.net does not have any reliable address for lb-182-249.above.com<br>Abuse address not found in whois.<br>Best guess from abuse.net: abuse@above.com abuse@lb-182-249.above.com1497853533http://lokeli.nu/ (103.224.182.249) - Serp-hijackingAttacked url: http://lokeli.nu/<br>Attack type: SERP-hijacking (see http://ikyon.com/attack-types/ for description)<br>Attack detected Fri, 16 Jun 2017 09:27:18 +0200<br><br>Visitors with referer are redirected to http://bidr.trellian.com/r2.php?e=cF8L0S4UvzZFbF2sJTBoT1U1o%2BKUv4rfz%2FuOa2iv45AADC%2Fo1aGSloLw7wHp8YHxF5c10xsQonJ%2BKZynZT1wprRkc7VhWD2Hr4hq%2FdYXGsEAK5bzbxEEEjFmWfb%2BrIqXsmwVTAZhqHMErREnh4XYe7cixKH7NU4zz%2BoxcD8HFN3gUy3oHB1jNlo0R7C5m3SdfmsiB2Wap1cFYvpXCWQxgbM%2FVqb%2B6L8SQ%2BC0CZc8vMEQARabeOt6bR2Pc%2F5iVOYSBTdAp6JZxb0hLNTGZEyJOGLStxxuPkXxdBDI4TR%2FbjtPTrAPjCCXifdohODtb3xgIZeUUT4NwCld17YB5MtmlozwGg27dbPHHMYTU0Y9kFjxvspbONltJASk3DqRP2NlBJzMAQON3LdhM5cr35f57j6aseM35m7NeP9dlvAKIGHjyxVF2zGk3OePCvYolAu3Fa4hIdF%2FBXCcpHiyDhAfmK1rJ63w1jrju8Ghq1wbJNBw%2FCwFG1bwbWTbBOSsxyWzCuc75Q8JOCKbtFJVHUQdHMX%2BNdttS2aW7kW2dxZaQSU%3D <br><br>HTTP traffic without referer:<br>HTTP headers sent:<br>HEAD / HTTP/1.1 <br>Host: lokeli.nu <br>Connection: Close <br> <br>HTTP headers recieved:<br>HTTP/1.1 302 Found <br>Date: Fri, 16 Jun 2017 07:27:18 GMT <br>Server: Apache <br>X-Powered-By: PHP/5.4.45-0+deb7u8 <br>Set-Cookie: __tad=1497598038.2634970; expires=Mon, 14-Jun-2027 07:27:18 GMT <br>Location: http://ww11.lokeli.nu/ <br>Connection: close <br>Content-Type: text/html; charset=UTF-8 <br> <br><br>HTTP traffic with referer:<br>HTTP headers sent:<br>HEAD / HTTP/1.1 <br>Host: lokeli.nu <br>Referer: http://www.google.com/search?q=lokeli.nu <br>Connection: Close <br> <br>HTTP headers recieved:<br>HTTP/1.1 302 Found <br>Date: Fri, 16 Jun 2017 07:27:17 GMT <br>Server: Apache <br>X-Powered-By: PHP/5.6.30-0+deb8u1 <br>Set-Cookie: __tad=1497598037.8003537; expires=Mon, 14-Jun-2027 07:27:17 GMT; Max-Age=315360000 <br>Location: http://bidr.trellian.com/r2.php?e=cF8L0S4UvzZFbF2sJTBoT1U1o%2BKUv4rfz%2FuOa2iv45AADC%2Fo1aGSloLw7wHp8YHxF5c10xsQonJ%2BKZynZT1wprRkc7VhWD2Hr4hq%2FdYXGsEAK5bzbxEEEjFmWfb%2BrIqXsmwVTAZhqHMErREnh4XYe7cixKH7NU4zz%2BoxcD8HFN3gUy3oHB1jNlo0R7C5m3SdfmsiB2Wap1cFYvpXCWQxgbM%2FVqb%2B6L8SQ%2BC0CZc8vMEQARabeOt6bR2Pc%2F5iVOYSBTdAp6JZxb0hLNTGZEyJOGLStxxuPkXxdBDI4TR%2FbjtPTrAPjCCXifdohODtb3xgIZeUUT4NwCld17YB5MtmlozwGg27dbPHHMYTU0Y9kFjxvspbONltJASk3DqRP2NlBJzMAQON3LdhM5cr35f57j6aseM35m7NeP9dlvAKIGHjyxVF2zGk3OePCvYolAu3Fa4hIdF%2FBXCcpHiyDhAfmK1rJ63w1jrju8Ghq1wbJNBw%2FCwFG1bwbWTbBOSsxyWzCuc75Q8JOCKbtFJVHUQdHMX%2BNdttS2aW7kW2dxZaQSU%3D <br>Connection: close <br>Content-Type: text/html; charset=UTF-8<br><br>lokeli.nu is on 103.224.182.249<br>ASN for 103.224.182.249: 133618<br>Abusix contact information: abuse@trellian.com (information only)<br>103.224.182.249 corresponds with lb-182-249.above.com<br>Abuse.net does not have any reliable address for lb-182-249.above.com<br>Abuse address not found in whois.<br>Best guess from abuse.net: abuse@lb-182-249.above.com abuse@above.com1497625693http://stacimodel.nu/ (103.224.182.249) - Serp-hijackingAttacked url: http://stacimodel.nu/<br>Attack type: SERP-hijacking (see http://ikyon.com/attack-types/ for description)<br>Attack detected Fri, 16 Jun 2017 01:55:13 +0200<br><br>Visitors with referer are redirected to http://bidr.trellian.com/r2.php?e=cF8L0S4UvzZFbF2sJTBoT1U1o%2BKUv4rfPmHOZFsO4WelaDW1cuxX2qYaXTzC3S4WmOT2n%2Bf7H1ALFf1LUtelpqODhzE6J3AMrm8PGGzJ%2FfexrEWgAlLkmVS615Wlq2pAxMgClSWgoAaubH6JsU92G%2BopvXGn7Y4cDI1hlz3pI%2BhkP353sqpM6jkytpfy37AZHZ3qSiyaAeH%2FRdluZYNXaYWxAceYvebyI5PWQmuiDAccRRjWkKE16OeQu6uaqrho1eE7MNu4L3BnVgRPlkwlU3cvDZ7i9JzcNKfTLmTOT4og65CPNE7b2aP9EUGaQ2hxJ2Xsn7xKumSPK14ZgVzOrFwdYujWKrZVPlW%2B7xSw%2BXeDbC568vc9edShuy7eeHUYo4NGQg3XT8X9yLTS5C3PpTZ9BasJOIeZ8aNLim%2BPXabgcZCDhJLyxIJO8Xx0tTXt8Eqwwx7dnreQuaHbT7e3PEOx8Ri5%2BV%2FqPtjhEslDpg7FBg2dJogSQatDIkFLe0cQCbrfzeozWvq8g1dAeY0RLtoW4flGbJuU4w%2B09bfEhoO4xopWIuhqhHSVzLTIf05W <br><br>HTTP traffic without referer:<br>HTTP headers sent:<br>HEAD / HTTP/1.1 <br>Host: stacimodel.nu <br>Connection: Close <br> <br>HTTP headers recieved:<br>HTTP/1.1 302 Found <br>Date: Thu, 15 Jun 2017 23:55:13 GMT <br>Server: Apache <br>X-Powered-By: PHP/5.6.30-0+deb8u1 <br>Set-Cookie: __tad=1497570913.7451621; expires=Sun, 13-Jun-2027 23:55:13 GMT; Max-Age=315360000 <br>Location: http://ww11.stacimodel.nu/ <br>Connection: close <br>Content-Type: text/html; charset=UTF-8 <br> <br><br>HTTP traffic with referer:<br>HTTP headers sent:<br>HEAD / HTTP/1.1 <br>Host: stacimodel.nu <br>Referer: http://www.google.com/search?q=stacimodel.nu <br>Connection: Close <br> <br>HTTP headers recieved:<br>HTTP/1.1 302 Found <br>Date: Thu, 15 Jun 2017 23:55:12 GMT <br>Server: Apache <br>X-Powered-By: PHP/5.6.30-0+deb8u1 <br>Set-Cookie: __tad=1497570912.8571105; expires=Sun, 13-Jun-2027 23:55:12 GMT; Max-Age=315360000 <br>Location: http://bidr.trellian.com/r2.php?e=cF8L0S4UvzZFbF2sJTBoT1U1o%2BKUv4rfPmHOZFsO4WelaDW1cuxX2qYaXTzC3S4WmOT2n%2Bf7H1ALFf1LUtelpqODhzE6J3AMrm8PGGzJ%2FfexrEWgAlLkmVS615Wlq2pAxMgClSWgoAaubH6JsU92G%2BopvXGn7Y4cDI1hlz3pI%2BhkP353sqpM6jkytpfy37AZHZ3qSiyaAeH%2FRdluZYNXaYWxAceYvebyI5PWQmuiDAccRRjWkKE16OeQu6uaqrho1eE7MNu4L3BnVgRPlkwlU3cvDZ7i9JzcNKfTLmTOT4og65CPNE7b2aP9EUGaQ2hxJ2Xsn7xKumSPK14ZgVzOrFwdYujWKrZVPlW%2B7xSw%2BXeDbC568vc9edShuy7eeHUYo4NGQg3XT8X9yLTS5C3PpTZ9BasJOIeZ8aNLim%2BPXabgcZCDhJLyxIJO8Xx0tTXt8Eqwwx7dnreQuaHbT7e3PEOx8Ri5%2BV%2FqPtjhEslDpg7FBg2dJogSQatDIkFLe0cQCbrfzeozWvq8g1dAeY0RLtoW4flGbJuU4w%2B09bfEhoO4xopWIuhqhHSVzLTIf05W <br>Connection: close <br>Content-Type: text/html; charset=UTF-8<br><br>stacimodel.nu is on 103.224.182.249<br>ASN for 103.224.182.249: 133618<br>Abusix contact information: abuse@trellian.com (information only)<br>103.224.182.249 corresponds with lb-182-249.above.com<br>Abuse.net does not have any reliable address for lb-182-249.above.com<br>Abuse address not found in whois.<br>Best guess from abuse.net: abuse@above.com abuse@lb-182-249.above.com1497625498http://charmed.nu/ (103.224.182.249) - Serp-hijackingAttacked url: http://charmed.nu/<br>Attack type: SERP-hijacking (see http://ikyon.com/attack-types/ for description)<br>Attack detected Mon, 12 Jun 2017 17:51:53 +0200<br><br>Visitors with referer are redirected to http://bidr.trellian.com/r2.php?e=cF8L0S4UvzZFbF2sJTBoT3gQkIDbz2IDQRvfiNsp5UMsXpzlFEiFYLybykHVCDNwS%2FBHvA%2B4anJ8XZjYUVArbG9E7W9PWQtoP9OTn4RIY3yFpd8hRuyk2soaQ11bxPi3WBPD%2FKL0vQCSuF6Gi4y8bSdi1iMpQPelQk8wgCSack3qM57e2WbzucgCQuTeYd9D7e86g7bTsLRIZpIT%2FMpyejIfa%2B%2FZ%2FDiAaPDBJJ2skqITpEsbl9ZJwZ1wrteT0vWz7WyzPK7FaL%2BxuEx6sCeP3wVEX9GRriUdkXO3L79Nc2vbfVilGfZOUjEWHDy2VNyEeGjZEv7EK019Ca9MR5kweXqKJ1x3V1Yi88CPXuyLqHZFACUnZbKT%2Bfy4T5qaNpanU8Th%2BeswNGLYIvIEqsAQu%2BQ4%2BnFBLekXGgcgncDdoOdbITHYyajzk5X%2FqnQy281bo3h7dw0iF9FoP2zsx2y1F5FVwj9fDywR66KTNDy5p0MglXv%2BH62dX%2FUMt4oHHPyn%2B1w2MZXaew5WAVSGPzHApWgIVZ3N9vPHmg2xdW4Naoc%3D <br><br>HTTP traffic without referer:<br>HTTP headers sent:<br>HEAD / HTTP/1.1 <br>Host: charmed.nu <br>Connection: Close <br> <br>HTTP headers recieved:<br>HTTP/1.1 302 Found <br>Date: Mon, 12 Jun 2017 15:52:01 GMT <br>Server: Apache <br>X-Powered-By: PHP/5.6.30-0+deb8u1 <br>Set-Cookie: __tad=1497282721.3563296; expires=Thu, 10-Jun-2027 15:52:01 GMT; Max-Age=315360000 <br>Location: http://ww11.charmed.nu/ <br>Connection: close <br>Content-Type: text/html; charset=UTF-8 <br> <br><br>HTTP traffic with referer:<br>HTTP headers sent:<br>HEAD / HTTP/1.1 <br>Host: charmed.nu <br>Referer: http://www.google.com/search?q=charmed.nu <br>Connection: Close <br> <br>HTTP headers recieved:<br>HTTP/1.1 302 Found <br>Date: Mon, 12 Jun 2017 15:52:00 GMT <br>Server: Apache <br>X-Powered-By: PHP/5.4.45-0+deb7u8 <br>Set-Cookie: __tad=1497282720.2852846; expires=Thu, 10-Jun-2027 15:52:00 GMT <br>Location: http://bidr.trellian.com/r2.php?e=cF8L0S4UvzZFbF2sJTBoT3gQkIDbz2IDQRvfiNsp5UMsXpzlFEiFYLybykHVCDNwS%2FBHvA%2B4anJ8XZjYUVArbG9E7W9PWQtoP9OTn4RIY3yFpd8hRuyk2soaQ11bxPi3WBPD%2FKL0vQCSuF6Gi4y8bSdi1iMpQPelQk8wgCSack3qM57e2WbzucgCQuTeYd9D7e86g7bTsLRIZpIT%2FMpyejIfa%2B%2FZ%2FDiAaPDBJJ2skqITpEsbl9ZJwZ1wrteT0vWz7WyzPK7FaL%2BxuEx6sCeP3wVEX9GRriUdkXO3L79Nc2vbfVilGfZOUjEWHDy2VNyEeGjZEv7EK019Ca9MR5kweXqKJ1x3V1Yi88CPXuyLqHZFACUnZbKT%2Bfy4T5qaNpanU8Th%2BeswNGLYIvIEqsAQu%2BQ4%2BnFBLekXGgcgncDdoOdbITHYyajzk5X%2FqnQy281bo3h7dw0iF9FoP2zsx2y1F5FVwj9fDywR66KTNDy5p0MglXv%2BH62dX%2FUMt4oHHPyn%2B1w2MZXaew5WAVSGPzHApWgIVZ3N9vPHmg2xdW4Naoc%3D <br>Connection: close <br>Content-Type: text/html; charset=UTF-8<br><br>charmed.nu is on 103.224.182.249<br>ASN for 103.224.182.249: 133618<br>Abusix contact information: abuse@trellian.com (information only)<br>103.224.182.249 corresponds with lb-182-249.above.com<br>Abuse.net does not have any reliable address for lb-182-249.above.com<br>Abuse address not found in whois.<br>Best guess from abuse.net: abuse@lb-182-249.above.com abuse@above.com1497349108http://direct-tv.nu/ (103.224.182.249) - Serp-hijackingAttacked url: http://direct-tv.nu/<br>Attack type: SERP-hijacking (see http://ikyon.com/attack-types/ for description)<br>Attack detected Mon, 12 Jun 2017 17:32:56 +0200<br><br>Visitors with referer are redirected to http://bidr.trellian.com/r2.php?e=cF8L0S4UvzZFbF2sJTBoT3gQkIDbz2IDrxaUxwexr1LbazqmySZecH4f%2BgYEhISMxlQXumg6uSIhZONBKXUN4Dy7JCgw09spaXBIQmRpRp3QOONsyfZ3z%2BBOOr87VYQsf%2FuqhIlBM7%2BDG%2FDZ7BsLLTu%2BHSH5JZKztxCdhZ%2Bqiehp0KJp9BL97PKkMj%2FznphehCkAjN5i0rWRdcO3GUnbST%2FoS6vsSpmbjsptrEDzfJjveMK5vwKjACpVaL7bcVS0R2Wxesuv3%2FL4g8lQLL%2Fycfd0gFzJbqDITRLUX8yRGraAC3tKWR0vcIdAZPWazc3dW%2BXZ6QfyXW6XBxq0bLtJTBOc8OuHlu2ljTle1x9Q%2BWhtX1pExAzQfSz0uv7apFXn9RY8cLyNFriJbnU1IoX%2FimHPIhgUYwl0cL0FYIDprSU2fm8YkqOaiF4FHsme4mKuHvR9P7BwRAQkiX9C1oET%2B3lY6ETGhyESwMpv1aPW00M9XG5mymHuoBPm9SsjLFYMRBP98jMOQzX0bIHRh6L6jxXjonoZE2MYcaKw5PBXLdxuuQSZiko9jQ%3D%3D <br><br>HTTP traffic without referer:<br>HTTP headers sent:<br>HEAD / HTTP/1.1 <br>Host: direct-tv.nu <br>Connection: Close <br> <br>HTTP headers recieved:<br>HTTP/1.1 302 Found <br>Date: Mon, 12 Jun 2017 15:33:04 GMT <br>Server: Apache <br>X-Powered-By: PHP/5.4.45-0+deb7u8 <br>Set-Cookie: __tad=1497281584.6493442; expires=Thu, 10-Jun-2027 15:33:04 GMT <br>Location: http://ww11.direct-tv.nu/ <br>Connection: close <br>Content-Type: text/html; charset=UTF-8 <br> <br><br>HTTP traffic with referer:<br>HTTP headers sent:<br>HEAD / HTTP/1.1 <br>Host: direct-tv.nu <br>Referer: http://www.google.com/search?q=direct-tv.nu <br>Connection: Close <br> <br>HTTP headers recieved:<br>HTTP/1.1 302 Found <br>Date: Mon, 12 Jun 2017 15:33:03 GMT <br>Server: Apache <br>X-Powered-By: PHP/5.6.30-0+deb8u1 <br>Set-Cookie: __tad=1497281583.6164757; expires=Thu, 10-Jun-2027 15:33:03 GMT; Max-Age=315360000 <br>Location: http://bidr.trellian.com/r2.php?e=cF8L0S4UvzZFbF2sJTBoT3gQkIDbz2IDrxaUxwexr1LbazqmySZecH4f%2BgYEhISMxlQXumg6uSIhZONBKXUN4Dy7JCgw09spaXBIQmRpRp3QOONsyfZ3z%2BBOOr87VYQsf%2FuqhIlBM7%2BDG%2FDZ7BsLLTu%2BHSH5JZKztxCdhZ%2Bqiehp0KJp9BL97PKkMj%2FznphehCkAjN5i0rWRdcO3GUnbST%2FoS6vsSpmbjsptrEDzfJjveMK5vwKjACpVaL7bcVS0R2Wxesuv3%2FL4g8lQLL%2Fycfd0gFzJbqDITRLUX8yRGraAC3tKWR0vcIdAZPWazc3dW%2BXZ6QfyXW6XBxq0bLtJTBOc8OuHlu2ljTle1x9Q%2BWhtX1pExAzQfSz0uv7apFXn9RY8cLyNFriJbnU1IoX%2FimHPIhgUYwl0cL0FYIDprSU2fm8YkqOaiF4FHsme4mKuHvR9P7BwRAQkiX9C1oET%2B3lY6ETGhyESwMpv1aPW00M9XG5mymHuoBPm9SsjLFYMRBP98jMOQzX0bIHRh6L6jxXjonoZE2MYcaKw5PBXLdxuuQSZiko9jQ%3D%3D <br>Connection: close <br>Content-Type: text/html; charset=UTF-8<br><br>direct-tv.nu is on 103.224.182.249<br>ASN for 103.224.182.249: 133618<br>Abusix contact information: abuse@trellian.com (information only)<br>103.224.182.249 corresponds with lb-182-249.above.com<br>Abuse.net does not have any reliable address for lb-182-249.above.com<br>Abuse address not found in whois.<br>Best guess from abuse.net: abuse@lb-182-249.above.com abuse@above.com1497349007