403Webshell
Server IP : 138.197.107.151  /  Your IP : 216.73.217.7
Web Server : Apache/2.4.58 (Ubuntu)
System : Linux BloxBy-Builder 6.8.0-71-generic #71-Ubuntu SMP PREEMPT_DYNAMIC Tue Jul 22 16:52:38 UTC 2025 x86_64
User : wpbetasites_mrakzqskir ( 1022)
PHP Version : 8.3.6
Disable Function : NONE
MySQL : OFF  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : OFF  |  Sudo : ON  |  Pkexec : OFF
Directory :  /var/www/bsd-crawler-parser/viewer/__pycache__/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /var/www/bsd-crawler-parser/viewer/__pycache__/sites.cpython-312.pyc
�

K ^j,���dZddlZejd�Zejd�ZdZd�Zd�Zd�Zd	�Z	d
�Z
d�Zy)a
Site identity: one WP Engine install is one site.

WHY THE INSTALL, NOT THE DOMAIN

A log file is named for the WP Engine *install* (20260709-0017-buckfirelaw...),
but the events inside it carry the *vhost* from each request line. Those are not
the same string, and one install serves several vhosts:

    buckfirelaw     -> buckfirelaw.com, buckfirelaw.wpengine.com
    allmandlawfirm  -> allmandlaw.com,  allmandlawfirm.wpengine.com

Keying the site table on the vhost therefore lists one site twice -- once under
its real domain and once under the WP Engine holding domain. Keying on the
install lists it once, and is also the only identity that can name a site whose
log file is empty: no events means no vhost to read.

WHY THE MAPPING IS NOT GUESSED

The install name is not a substring of the domain often enough to matter: it is
truncated to 14 characters, and it is chosen by hand, so it drifts from the
domain entirely.

    amdmedicalpllc  -> amdmedicalgroup.com
    bermanandrusso  -> brslaw.com
    awsmithpepper   -> peppersprayinjury.com
    aprsplasticsur  -> apresplasticsurgery.com

Matching install to domain by string similarity gets 99 of 241 installs wrong
(41%). So nothing here guesses. The parser already writes both halves of the
answer into every event key --

    events/date=2026-07-08/site=amdmedicalgroup.com/20260709-0011-amdmedicalpllc.jsonl
                                \_ vhost                          \_ install

-- and s3data reads the pairing straight out of the key. The mapping is observed,
not inferred.
�Nz/(?:^|/)\d{8}-\d{4}-(.+?)\.apachestyle\.log\.gz$z^\d{8}-\d{4}-(.+)$)z
.wpengine.comz.wpenginepowered.comc�V�tj|�}|r|jd�SdS)zGInstall name from a raw log key (or a manifest entry). None if not one.�N)�
SOURCE_KEY_RE�search�group)�key�ms  �+/var/www/bsd-crawler-parser/viewer/sites.py�install_from_source_keyr3s'�����S�!�A��1�7�7�1�:�$��$�c�V�tj|�}|r|jd�SdS)z@Install name from an event shard stem: 20260709-0017-foo -> foo.rN)�STEM_RE�matchr)�stemr	s  r
�install_from_stemr9s%���
�
�d��A��1�7�7�1�:�$��$rc�,�|jt�S)zFTrue for a WP Engine holding domain (<install>.wpengine[powered].com).)�endswith�ALIAS_SUFFIXES)�domains r
�is_alias_domainr?s���?�?�>�*�*rc�,�|sytd�|D��}|xst|�}d�}|D]}||�|k(s�|cS|D�cgc]3}||�j|�s|j||��s�2|��5}}|rt|d���S|dScc}w)a�The one domain that best names `install`, or None if it has no events.

    Deterministic, and deliberately independent of hit counts: the label a site
    carries must not change when the date range does. Real domains win over WP
    Engine holding domains; among those, an exact match on the install name wins,
    then a prefix match, then alphabetical order as a stable tie-break.
    Nc3�8K�|]}t|�r�|���y�w�N)r)�.0�ds  r
�	<genexpr>z!primary_domain.<locals>.<genexpr>Ns����?��O�A�,>�!�?�s��c�*�|jd�dS)N�.r)�split�rs r
�basezprimary_domain.<locals>.baseQs���w�w�s�|�A��rc��t|�|fSr)�lenr s r
�<lambda>z primary_domain.<locals>.<lambda>Ys��C��F�A�;�r)rr)�sorted�
startswith�min)�install�domains�real�poolr!r�prefixeds       r
�primary_domainr-Ds������?�W�?�?�D��"�6�'�?�D�������7�g���H�� �^�a�4��7�#5�#5�g�#>�'�BT�BT�UY�Z[�U\�B]��^�H�^���8�!6�7�7���7�N��_s�3B�6Bc�"�t||�xs|S)zFWhat the site table shows. Falls back to the install for an empty log.)r-)r(r)s  r
�display_namer/]s���'�7�+�6�w�6rc��t||�}|�y|D�chc]}t|�r�|��}}tdt||hz
��Scc}w)a,How many *other* real domains this install serves, for a '+N' hint.

    Aliases are not counted -- they are the same site by definition. Genuinely
    distinct brands sharing an install (buckfirelaw serves 9) are, so the row can
    say that its number covers more than the domain on the label.
    r)r-r�maxr#)r(r)�primaryrr*s     r
�extra_domain_countr3bsP���W�g�.�G�����9�!�o�a�&8�A�9�D�9��q�#�d�g�Y�&�'�(�(��:s
�A�A)�__doc__�re�compilerrrrrrr-r/r3�rr
�<module>r8sY��$�L
���
�
�M�N�
�
�"�*�*�*�
+��;��%�%�+�
�27�
)r

Youez - 2016 - github.com/yon3zu
LinuXploit