Another Safari hijack: "http://undeps.vizvaz.com" ?

I think it is just the site - there is a redirect sequence that looks like this:

[12:03:07.760] GET http://www.clinical.bioiatriki.gr/index.php?option=com_content&view=article&id=2 8&Itemid=30 [HTTP/1.1 302 OK 332ms]

[12:03:08.133] GET http://qertea.instanthq.com/ [HTTP/1.1 302 Found 377ms]

[12:03:08.513] GET http://undeps.vizvaz.com/ [HTTP/1.1 200 OK 2582ms]

This was via firefox - if I use lynx (character based browser) with a lynx user agent string, I get to www.clinical.bioiatriki.gr no problem.

If you follow the details here : you may see that a page request at that site, when referred from google, is given a 302 found/moved response & redirected to a second site, which similarly redirects to undeps.vivaz.

That's due to an issue with their website being compromised.

Yes, it's the site.

It is odd that the redirect only happens via the google.gr provided link, entering the link directly seems to cause no problems.

Especially considering that the google.gr cached version is correct.

Maybe someone who can decipher obfuscated urls can see it: "http://www.google.gr/url?sa=t&rct=j&q=%CF%85%CF%80%CE%BF%CE%B4%CE%BF%CF%87%CE%AD %CE%B1%CF%82%20%CF%84%CE%B7%CF%82%20%CE%BA%CE%B9%CE%BD%CE%AC%CF%83%CE%B7%CF%82%2 0%CF%84%CF%85%CF%81%CE%BF%CF%83%CE%AF%CE%BD%CE%B7%CF%82%20ret&source=web&cd=5&ca d=rja&ved=0CEYQFjAE&url=http%3A%2F%2Fwww.clinical.bioiatriki.gr%2Findex.php%3Fop tion%3Dcom_content%26view%3Darticle%26id%3D28%26Itemid%3D30&ei=IUb9UfjYM5TO9ASYt oHAAw&usg=AFQjCNH_xDJRb17YQWG8iNUSw0a0rDEqbA"

Not uncommon - http://blog.aw-snap.info/2011/01/redirect-to-malicious-site.html

I've forwarded this issue to Google, since it only happens via the url they provide in the search results.

It's also reproducible via Chrome, Firefox and Safari.

Yes, this seems to be a hack against google's spiders, not a browser hijack of any type.

No, it isn't. - Report it to the site owners, by all means, since they've been hacked, partly due to seemingly persisting with a version of Joomla that was superseded in January 2011.

Modifications to the website, not google code, redirect the visitor if the referer header matches something - in this case a click from google. But some are random, or redirect one google search every now & then, or maybe only if the search query was of a certain kind.