Well, that's interesting. Did you try a different browser, since it could be a browser issue, like here:


Actually, your server response should look like this:

HTTP/1.0 301 Moved Permanently.
Connection: close.
Location: http://NEWURL
Do you see the injected code in the request??
Try to retrieve the page with curl:

bt-box# curl http://access.mycompany.com

<meta http-equiv="refresh" content="0;URL=http://newURL/">

Maybe you can try some other type of redirection like injecting this:

<body onload="document.location='http://NEWURL/'">
I hope I could help a little bit.