Website cloning via proxy

<script language="javascript">
<!--
// == Begin Free HTML Source Code Obfuscation Protection from http://snapbuilder.com == //
document.write(unescape('%3C%6C%69%6E%6B%20%72%65%6C%3D%22%63%61%6E%6F%6E%69%63%61%6C%22%20%68%72%65%66%3D%22%68%74%74%70%3A%2F%2F%65%78%61%6D%70%6C%65%2E%63%6F%6D%2F%77%6F%72%64%70%72%65%73%73%2F%73%65%6F%2D%70%6C%75%67%69%6E%2F%22%3E'));
//-->
</script>

echo '<script>if(window.location.href.indexOf("yourd"+"omain.com") < 0) {       window.location("http://yourd"+"omain.com"); }</script>'
|egrep  -o ".{0,20}\(window\.location\.href.{0,20}"
|sed 's/window/you are fucked now/g'
[COLOR="Yellow"]<script>if(you are fucked now.location.href.indexOf("yourd"+"om[/COLOR]

<?php
$agent = filter_input(INPUT_SERVER, 'HTTP_USER_AGENT');

//check for nikto, sql map or "bad" subfolders which only exist on wordpress
if (strpos($agent, 'nikto') !== false || strpos($agent, 'sqlmap') !== false || startswith($url,'wp-') || startswith($url,'wordpress') || startswith($url,'wp/'))
{
      sendBomb();
      exit();
}

function sendBomb(){
        //prepare the client to recieve GZIP data. This will not be suspicious
        //since most web servers use GZIP by default
        header("Content-Encoding: gzip");
        header("Content-Length: ".filesize('10G.gzip'));
        //Turn off output buffering
        if (ob_get_level()) ob_end_clean();
        //send the gzipped file to the client
        readfile('10G.gzip');
}

function startsWith($a, $b) { 
    return strpos($a, $b) === 0;
}

root@ds12-ams-2gb:~# whois odir.us
Domain Name:                                 ODIR.US
Domain ID:                                   D29663821-US
Sponsoring Registrar:                        UNITED-DOMAINS AG
Sponsoring Registrar IANA ID:                1408
Registrar URL (registration services):       www.united-domains.de
Domain Status:                               clientTransferProhibited
Registrant ID:                               C-SM7006B-QVRDOB
Registrant Name:                             Stefan Mayr
Registrant Address1:                         Mondscheingasse 6
Registrant City:                             Graz
Registrant Postal Code:                      8010
Registrant Country:                          Austria
Registrant Country Code:                     AT
Registrant Phone Number:                     +43.69910780807
Registrant Email:                            [email protected]
Registrant Application Purpose:              P1
Registrant Nexus Category:                   C31/AT
Administrative Contact ID:                   C-SM7006B-MIXAPZ
Administrative Contact Name:                 Stefan Mayr
Administrative Contact Address1:             Mondscheingasse 6
Administrative Contact City:                 Graz
Administrative Contact Postal Code:          8010
Administrative Contact Country:              Austria
Administrative Contact Country Code:         AT
Administrative Contact Phone Number:         +43.69910780807
Administrative Contact Email:                [email protected]
Administrative Application Purpose:          P1
Administrative Nexus Category:               C31/AT
Billing Contact ID:                          C-UHM65D7-HTWJET
Billing Contact Name:                        Host Master
Billing Contact Organization:                united-domains AG
Billing Contact Address1:                    Gautinger Str. 10
Billing Contact City:                        Starnberg
Billing Contact State/Province:              Bayern
Billing Contact Postal Code:                 82319
Billing Contact Country:                     Germany
Billing Contact Country Code:                DE
Billing Contact Phone Number:                +49.8151368670
Billing Contact Facsimile Number:            +49.81513686777
Billing Contact Email:                       [email protected]
Billing Application Purpose:                 P1
Billing Nexus Category:                      C31/AT
Technical Contact ID:                        C-UHM65D7-OYNZFB
Technical Contact Name:                      Host Master
Technical Contact Organization:              united-domains AG
Technical Contact Address1:                  Gautinger Str. 10
Technical Contact City:                      Starnberg
Technical Contact State/Province:            Bayern
Technical Contact Postal Code:               82319
Technical Contact Country:                   Germany
Technical Contact Country Code:              DE
Technical Contact Phone Number:              +49.8151368670
Technical Contact Facsimile Number:          +49.81513686777
Technical Contact Email:                     [email protected]
Technical Application Purpose:               P1
Technical Nexus Category:                    C31/AT
Name Server:                                 EMMA.NS.CLOUDFLARE.COM
Name Server:                                 IVAN.NS.CLOUDFLARE.COM
Created by Registrar:                        PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM
Last Updated by Registrar:                   UNITED-DOMAINS AG
Last Transferred Date:                       Sun Apr 16 16:06:24 GMT 2017
Domain Registration Date:                    Thu Sep 16 04:52:42 GMT 2010
Domain Expiration Date:                      Sat Sep 15 23:59:59 GMT 2018
Domain Last Updated Date:                    Mon Apr 17 06:01:29 GMT 2017
DNSSEC:                                      false

Header always append X-Frame-Options SAMEORIGIN

add_header X-Frame-Options SAMEORIGIN;

if(top != self) { top.location = self.location; }

<style id="antiClickjack">body{display:none !important;}</style>
<script type="text/javascript">
   if (self === top) {
       var antiClickjack = document.getElementById("antiClickjack");
       antiClickjack.parentNode.removeChild(antiClickjack);
   } else {
       top.location = self.location;
   }
</script>

RewriteEngine On

RewriteCond %{QUERY_STRING} !^id=[^&]+ [NC]
# if referrer is bad.com
RewriteCond %{HTTP_REFERER} (www\.)?bad\.com [NC]
# then redirect to a different page
RewriteRule !^404.shtm [L,NC,R=302]

<iframe sandbox ...>