I cannot find anywhere on our site where this code is referenced. More importantly it does not appear when navigating directly to our URL, it only appears when coming from a search engine (including Google and Yahoo, but notable NOT anonymous search like duckduckgo).
In IE with high security settings the user gets a prompt that content is being blocked. Firefox and Chrome display warnings as well.
The error appears like this in dev tools: "Mixed Content: The page at [removed] was loaded over HTTPS, but requested an insecure script 'http://ariadnnakiss.pw/m/zLZlP-SXnQrHhT_q_ywsOKj-.js?QB2M=6w5Q7T2e2a&P-0mA5Ga=cd99J0t91&_=12-1d-13-6&DyfkA=as426S9Uy3e&h=t7'. This request has been blocked; the content must be served over HTTPS."
The URL in question is ariadnnakiss, which I cannot find much information on beyond a whois lookup.
Any ideas why this would occur only when reaching the site via search?