Malicious Redirects
First query (normal visit):
GET / HTTP/1.1
Host: yingtrip.com
Result:
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Date: Tue, 10 Sep 2013 20:20:40 GMT
Pragma: no-cache
Server: Apache/1.3.33 (Unix) mod_ssl/2.8.22 OpenSSL/0.9.7d SE/0.5.3.4
Content-Length: 9470
Content-Type: text/html; charset=utf-8
Expires: Mon, 1 Jan 2001 00:00:00 GMT
Last-Modified: Tue, 10 Sep 2013 20:20:42 GMT
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Set-Cookie: 736f78abdb4a802825199ce3f2dd3223=mikfgd0ptk0u71hol2k3mhfbj4; path=/
X-Powered-By: PHP/5.2.17
...9470 bytes of data.
GET / HTTP/1.1
Host: yingtrip.com
Result:
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Date: Tue, 10 Sep 2013 20:20:40 GMT
Pragma: no-cache
Server: Apache/1.3.33 (Unix) mod_ssl/2.8.22 OpenSSL/0.9.7d SE/0.5.3.4
Content-Length: 9470
Content-Type: text/html; charset=utf-8
Expires: Mon, 1 Jan 2001 00:00:00 GMT
Last-Modified: Tue, 10 Sep 2013 20:20:42 GMT
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Set-Cookie: 736f78abdb4a802825199ce3f2dd3223=mikfgd0ptk0u71hol2k3mhfbj4; path=/
X-Powered-By: PHP/5.2.17
...9470 bytes of data.
Second query (visit from search engine):
GET / HTTP/1.1
Host: yingtrip.com
Referer: http://www.google.com/search?q=yingtrip.com
Result:
The result is similar to the first query. There are no suspicious redirects found.
GET / HTTP/1.1
Host: yingtrip.com
Referer: http://www.google.com/search?q=yingtrip.com
Result:
The result is similar to the first query. There are no suspicious redirects found.
Scanned pages/files
Request | Server response | Status |
http://yingtrip.com/ | 200 OK Content-Length: 9470 Content-Type: text/html | clean |
http://yingtrip.com/index.php?option=com_content&view=article&id=50&Itemid=54 | 200 OK Content-Length: 32137 Content-Type: text/html | clean |
http://yingtrip.com/index.php?option=com_content&view=article&id=49&Itemid=64 | 200 OK Content-Length: 9055 Content-Type: text/html | clean |
http://yingtrip.com/index.php?option=com_content&view=article&id=44&Itemid=53 | 200 OK Content-Length: 54684 Content-Type: text/html | clean |
http://yingtrip.com/index.php?option=com_content&view=article&id=47&Itemid=55 | 200 OK Content-Length: 30221 Content-Type: text/html | clean |
http://yingtrip.com/index.php?option=com_content&view=article&id=53&Itemid=61 | 200 OK Content-Length: 46224 Content-Type: text/html | clean |
http://yingtrip.com/index.php?option=com_content&view=article&id=46&Itemid=58 | 200 OK Content-Length: 85448 Content-Type: text/html | clean |
http://yingtrip.com/index.php?option=com_content&view=article&id=45&Itemid=57 | 200 OK Content-Length: 50535 Content-Type: text/html | clean |
http://yingtrip.com/index.php?option=com_content&view=article&id=51&Itemid=59 | 200 OK Content-Length: 7887 Content-Type: text/html | clean |
http://yingtrip.com/index.php?option=com_content&view=article&id=54&Itemid=63 | 200 OK Content-Length: 8457 Content-Type: text/html | clean |
http://yingtrip.com/index.php?option=com_content&view=article&id=52&Itemid=60 | 200 OK Content-Length: 9502 Content-Type: text/html | clean |
http://yingtrip.com/index.php?option=com_user&view=reset | 200 OK Content-Length: 7166 Content-Type: text/html | clean |
http://yingtrip.com/test404page.js | HTTP/1.1 302 Found Connection: close Date: Tue, 10 Sep 2013 20:21:00 GMT Location: https://cp.freehostia.com/404/ Server: Apache/1.3.33 (Unix) mod_ssl/2.8.22 OpenSSL/0.9.7d SE/0.5.3.4 Content-Type: text/html; charset=iso-8859-1 | clean |
https://cp.freehostia.com/404/ | HTTP/1.1 302 Found Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection: close Date: Tue, 10 Sep 2013 20:21:01 GMT Pragma: no-cache Location: /login/ Server: Apache/2.2.16 (Debian) Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html Expires: Thu, 19 Nov 1981 08:52:00 GMT Set-Cookie: WHCP=or38i6v9i7hgue9lgoa0idl9r2; path=/ X-Powered-By: PHP/5.3.3-7+squeeze16 | clean |
https://cp.freehostia.com/login/ | 200 OK Content-Length: 2898 Content-Type: text/html | clean |
https://cp.freehostia.com/js/jses.min.js?v=1375272014 | 200 OK Content-Length: 303104 Content-Type: application/javascript | clean |
http://yingtrip.com/js/jquery_plugins/jquery-fonteffect-1.0.0.min.js | HTTP/1.1 302 Found Connection: close Date: Tue, 10 Sep 2013 20:21:05 GMT Location: https://cp.freehostia.com/404/ Server: Apache/1.3.33 (Unix) mod_ssl/2.8.22 OpenSSL/0.9.7d SE/0.5.3.4 Content-Type: text/plain | clean |
http://cp.freehostia.com/test404page.js | HTTP/1.1 301 Moved Permanently Connection: close Date: Tue, 10 Sep 2013 20:21:05 GMT Location: https://cp.freehostia.com/test404page.js Server: Apache/2.2.16 (Debian) Vary: Accept-Encoding Content-Length: 331 Content-Type: text/html; charset=iso-8859-1 | clean |
https://cp.freehostia.com/test404page.js | HTTP/1.1 302 Found Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection: close Date: Tue, 10 Sep 2013 20:21:06 GMT Pragma: no-cache Location: /login/ Server: Apache/2.2.16 (Debian) Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html Expires: Thu, 19 Nov 1981 08:52:00 GMT Set-Cookie: WHCP=8nl27kvt1474gpeokbjshgqud4; path=/ X-Powered-By: PHP/5.3.3-7+squeeze16 | clean |
http://yingtrip.com/js/video-js/video.min.js | HTTP/1.1 302 Found Connection: close Date: Tue, 10 Sep 2013 20:21:06 GMT Location: https://cp.freehostia.com/404/ Server: Apache/1.3.33 (Unix) mod_ssl/2.8.22 OpenSSL/0.9.7d SE/0.5.3.4 Content-Type: text/plain | clean |
http://yingtrip.com/index.php?option=com_user&view=remind | 200 OK Content-Length: 7122 Content-Type: text/html | clean |
Safe Browsing / Blacklists
Query: http://www.google.com/safebrowsing/diagnostic?site=yingtrip.com
Result: This site is not currently listed as suspicious.
Result: This site is not currently listed as suspicious.
Query: http://yandex.com/infected?l10n=en&url=http://yingtrip.com/
Result: yingtrip.com is not infected or malware details are not published yet.
Result: yingtrip.com is not infected or malware details are not published yet.