You likely found this page because the following obfuscated PHP code appeared somewhere inside your website after a compromise.
I encountered this exact payload inside a Laravel application where it
had been written to storage/maintenance.php. Once present, it began
generating large numbers of fake pages designed for search engines.
This repository/gist contains a cleaned and readable version of the code so that developers and security researchers can inspect how it works.
DO NOT RUN THIS CODE.
This script is part of a common class of PHP SEO spam malware. Its purpose is to hijack a legitimate website and use it to publish large numbers of search-engine-optimised pages controlled by an external attacker.
The script itself does not contain the spam content. Instead, it acts as a loader and proxy that communicates with a remote command server and displays whatever content that server instructs it to serve.
The script communicates with the following endpoint:
https://cdn.aihack.top/api/proxy/handle.php
It sends information about the infected server including:
- request headers
- host name
- request URI
- user agent
- server environment data
This information is encoded and sent to the command server, which responds with instructions or content.
Because the content is controlled remotely, attackers can change what your site serves at any time without modifying the infected file.
The malware dynamically generates URLs such as:
/product/<slug>{=html}-<id>{=html}.html
/category/<name>{=html}.html
/p/<id>{=html}.html
/sitemap.xml
These pages are not part of the real application.
They exist purely to host spam content for search engines, often promoting:
- gambling sites
- counterfeit ecommerce stores
- pharmaceuticals
- adult or scam websites
The goal is to abuse the authority of the compromised domain to rank these pages in search results.
The script attempts to modify or create several files in the web root:
robots.txt
.htaccess
.rewrite_status
For example, it may inject a malicious sitemap entry into robots.txt
so search engines begin crawling the fake pages automatically.
It may also attempt to create rewrite rules so the spam URLs appear legitimate.
The malware contains logic that converts query parameters into static-looking URLs.
Example transformation:
?product=123
becomes:
/product/item-123.html
This makes the generated pages look like real site content and improves their chances of ranking in search engines.
The script inspects request information such as the User-Agent header.
In many cases, these malware kits serve different content depending on whether the visitor appears to be:
- a search engine crawler
- a security scanner
- a regular website visitor
This technique, known as cloaking, allows attackers to manipulate search engine indexing while avoiding detection by site owners.
If this script exists anywhere on your server, it means the system has been compromised and an attacker has gained the ability to write files to your application.
Simply deleting the file is often not enough, because the original access point may still exist.
Possible causes include:
- vulnerable file upload endpoints
- compromised credentials
- outdated dependencies
- hidden web shells
- other infected websites on the same server
A full investigation and cleanup of the server is recommended.
This code is provided for analysis and educational purposes only.
Running it on a production system would allow it to contact the attacker's command server and potentially serve malicious content through your website.
Do not execute this code.