Attacked url: http://thaisormland.se/
Attack type: SERP-hijacking (see http://ikyon.com/attack-types/ for description)
Attack detected Mon, 19 Jun 2017 05:30:15 +0200

Visitors with referer are redirected to http://automat-online.com/tracker-se-insta.php

HTTP traffic without referer:
HTTP headers sent:
HEAD / HTTP/1.1
Host: thaisormland.se
Connection: Close

HTTP headers recieved:
HTTP/1.1 502 Bad Gateway
Server: nginx
Date: Mon, 19 Jun 2017 03:30:15 GMT
Content-Type: text/html
Content-Length: 166
Connection: close


HTTP traffic with referer:
HTTP headers sent:
HEAD / HTTP/1.1
Host: thaisormland.se
Referer: http://www.google.com/search?q=thaisormland.se
Connection: Close

HTTP headers recieved:
HTTP/1.1 302 Found
Date: Mon, 19 Jun 2017 03:27:46 GMT
Content-Type: text/html;charset=UTF-8
Content-Length: 167
Connection: close
Server: nginx
Location: http://automat-online.com/tracker-se-insta.php

thaisormland.se is on 199.59.58.223
ASN for 199.59.58.223: 54290
Abusix contact information: abuse@hostwinds.com (information only)
199.59.58.223 corresponds with client-199-59-58-223.hostwindsdns.com
Abuse.net does not have any reliable address for client-199-59-58-223.hostwindsdns.com
Abuse address not found in whois.
Best guess from abuse.net: abuse@hostwindsdns.com abuse@client-199-59-58-223.hostwindsdns.com