Attacked url: http://arbetsfformedlingen.se/
Attack type: SERP-hijacking (see http://ikyon.com/attack-types/ for description)
Attack detected Fri, 16 Jun 2017 01:41:02 +0200

Visitors with referer are redirected to http://bidr.trellian.com/r2.php?e=cF8L0S4UvzZFbF2sJTBoT1U1o%2BKUv4rftM00p6NhWhDQCJgFbeYuagN%2BN8TTVHDO389ja1HNjELY4VnT5YRV8MJOGV2OFn69TER6snWS7MWsUzWjGJsk%2B7CjZMWGpeYfbxg8%2Bb5pMjxTncOhrpqarxHdvtP0PNfFqDkmoqnHEHw45dO9pk0UeJ5we86WInyUsZK%2BFbUXFXltOmfxyNyrwgOADOoHPQgIusXZxxuuG1EN6Tl4GeoBLlQ%2BxqwZUEiePn87tfRvaatn2l3W9BD9N%2FHcMRmYLNv5VpoK8VzpGYXbpQnfCae%2Fga5lk6Ha%2BORCzVV9Q4K6v5RItPOtOS1lb8GrlfSlk%2FetjcToawkX3pZCcDXiNoNHP8Tl3H4%2BxQ9druznnzLhBpK1lQQw59L4dmjhqzBITXDDH2UxtzZ99PTqX%2FV1pkIG8u71jRLvdm8tMPtq%2Fzbus9cpqPFOLiso3JtojC9BD84rdpi%2BmuqAEzEoJAlKAce1csdNzXpsxMR3o2VYhSuAQH8lNY9r1z4WTBrVOFE1wwFFHeKH82f7G1jqp6p239WewUVHsahniBttVuhWVzcQfMFG%2BtlejfoZRCiiskAsvmqR

HTTP traffic without referer:
HTTP headers sent:
HEAD / HTTP/1.1
Host: arbetsfformedlingen.se
Connection: Close

HTTP headers recieved:
HTTP/1.1 302 Found
Date: Thu, 15 Jun 2017 23:41:02 GMT
Server: Apache
X-Powered-By: PHP/5.4.45-0+deb7u8
Set-Cookie: __tad=1497570062.1743508; expires=Sun, 13-Jun-2027 23:41:02 GMT
Location: http://ww11.arbetsfformedlingen.se/
Connection: close
Content-Type: text/html; charset=UTF-8


HTTP traffic with referer:
HTTP headers sent:
HEAD / HTTP/1.1
Host: arbetsfformedlingen.se
Referer: http://www.google.com/search?q=arbetsfformedlingen.se
Connection: Close

HTTP headers recieved:
HTTP/1.1 302 Found
Date: Thu, 15 Jun 2017 23:41:01 GMT
Server: Apache
X-Powered-By: PHP/5.6.30-0+deb8u1
Set-Cookie: __tad=1497570061.8278854; expires=Sun, 13-Jun-2027 23:41:01 GMT; Max-Age=315360000
Location: http://bidr.trellian.com/r2.php?e=cF8L0S4UvzZFbF2sJTBoT1U1o%2BKUv4rftM00p6NhWhDQCJgFbeYuagN%2BN8TTVHDO389ja1HNjELY4VnT5YRV8MJOGV2OFn69TER6snWS7MWsUzWjGJsk%2B7CjZMWGpeYfbxg8%2Bb5pMjxTncOhrpqarxHdvtP0PNfFqDkmoqnHEHw45dO9pk0UeJ5we86WInyUsZK%2BFbUXFXltOmfxyNyrwgOADOoHPQgIusXZxxuuG1EN6Tl4GeoBLlQ%2BxqwZUEiePn87tfRvaatn2l3W9BD9N%2FHcMRmYLNv5VpoK8VzpGYXbpQnfCae%2Fga5lk6Ha%2BORCzVV9Q4K6v5RItPOtOS1lb8GrlfSlk%2FetjcToawkX3pZCcDXiNoNHP8Tl3H4%2BxQ9druznnzLhBpK1lQQw59L4dmjhqzBITXDDH2UxtzZ99PTqX%2FV1pkIG8u71jRLvdm8tMPtq%2Fzbus9cpqPFOLiso3JtojC9BD84rdpi%2BmuqAEzEoJAlKAce1csdNzXpsxMR3o2VYhSuAQH8lNY9r1z4WTBrVOFE1wwFFHeKH82f7G1jqp6p239WewUVHsahniBttVuhWVzcQfMFG%2BtlejfoZRCiiskAsvmqR
Connection: close
Content-Type: text/html; charset=UTF-8

arbetsfformedlingen.se is on 103.224.212.198
ASN for 103.224.212.198: 133618
Abusix contact information: abuse@trellian.com (information only)
103.224.212.198 corresponds with lb-212-198.above.com
Abuse.net does not have any reliable address for lb-212-198.above.com
Abuse address not found in whois.
Best guess from abuse.net: abuse@above.com abuse@lb-212-198.above.com