https://shoppy.gg/product/PvKQaT9

=== SESSION CHANGES SUMMARY === v.3.12

[1] DNS RESOLVER
[+] TDnsIpResolver rewritten: gethostbyname -> DNS-over-HTTPS via dns.google
[+] Class name changed: "System DNS" -> "DNS-over-HTTPS"
[+] Added TJSONObject parsing of Google DNS JSON response
[+] Uses HTTPS port 443, bypasses local DNS hijacking

[2] IP VALIDATION
[+] Added IsValidIpFormat() — pure format check (4 octets, 0-255)
[+] IsValidPublicIp() rewritten with full RFC filtering:
0.0.0.0/8, 10.0.0.0/8, 100.64.0.0/10, 127.0.0.0/8, 169.254.0.0/16,
172.16.0.0/12, 192.0.0.0/24, 192.0.2.0/24, 192.88.99.0/24,
192.168.0.0/16, 198.18.0.0/15, 198.51.100.0/24, 203.0.113.0/24,
224.0.0.0/4, 240.0.0.0/4, .0/.255 broadcast, public DNS servers
[+] IpToBytes() now safe against malformed input (checks 4 octets)
[+] IsIpInRanges() uses IsValidIpFormat() for range base addresses
(CDN ranges start with x.x.x.0)

[3] BRUTE FORCE
[+] Added DNS interception detection (counts 198.18.x.x fake IPs)
[+] Shows ASCII warning if >=50% of subdomains return fake IPs
[+] Removed duplicate entries from Subdomains array ('test', 'portal')
[+] Fake IPs are skipped, not added to results

[4] RESOLVER LIST
[+] Removed TPingIpResolver from ResolveDomain (always timed out)
[+] Reduced resolver list from 6 to 4

[5] THREAD SAFETY
[+] Added TMyThread19.LogMsg() — copies string by value before Queue
[+] Fixed variable-capture-by-reference bug in TThread.Queue loops
[+] All Resolver method calls moved OUT of Queue closures
[+] All local object variables initialized to nil at start of Execute
[+] Changed thread creation: Create(True) + Start (fixes race condition)
[+] ShowMessage removed from Execute (was VCL call from worker thread)

[6] FIND ORIGIN SERVER
[+] Signature changed: added HistoryIps parameter
[+] Removed duplicate CheckAllDnsHistory call inside function
[+] Added -1 handling from CheckSslCertificate (CDN detected)
[+] Marked IsCloudflare := True when IP excluded (SSL, VerifyOrigin)
[+] Added IsBehindProxy flag when IP excluded by host header check
[+] Renamed misleading "EDGE NODE detected" -> "No valid web response"

[7] SSL CERTIFICATE CHECK
[+] Added SNI (CkHttp_putSniHostname) — required for correct cert
[+] Added Cloudflare EDGE detection by issuer (cloudflare, we1)
[+] Added MITM/debug proxy detection by issuer:
debug, fiddler, charles, mitm, burp, portswigger, http debugger
[+] Returns -1 for CDN/MITM — signals immediate exclusion
[+] Loud ERROR block when SSL interception detected
[+] Subject vs Domain matching (exact, wildcard, subdomain)

[8] CHECK HOST HEADER
[+] Port detection relaxed: any 1xx-4xx counts as "server alive"
[+] Main domain check relaxed: only 0 or 5xx rejects the IP
[+] Added proxy/CDN detection via Server header
[+] Added default-vhost detection: same code for valid + random host = +5
[+] Proper 401/403 handling (typical for IPTV login pages)

[9] HTTP SIGNATURE CHECK
[+] Cloudflare in Server header -> CurrentScore = 0 (was -30)

[10] ADMIN PATHS CHECK
[+] 403 no longer counted (Cloudflare WAF returns 403 for all paths)
[+] Only 200 and 401 count

[11] VERIFY ORIGIN
[+] IsCdn -> Confidence := 0 (hard reset, no phantom scores)
[+] Added proxy/cdn detection in Server header

[12] CRT.SH
[+] Added retry loop: 3 attempts with 2s delay
[+] Logs HTTP status, response size, first 120 chars
[+] Guards against non-JSON responses (HTML 502 page)
[+] Clear "unavailable after 3 attempts" message

[13] IPTV PANEL DETECTION (new feature)
[+] Added CheckIptvPanel() — detects Xtream / Stalker / MAG panels
[+] 22 paths checked: player_api, panel_api, get.php, xmltv, portal,
server/load.php, stalker_portal/*, c/*, magaccess, portalstb,
version.js, xpcom.common.js, robots.txt, admin, login, etc.
[+] Multi-port scan: 80, 443, 8080, 25461 + ports from config.ini
[+] Each hit shows panel type + path + port
[+] Skips paths when Server header says cloudflare/cdn/proxy
[+] MAG requires body content check (not just path match)

[14] PARALLEL EXECUTION (IPTV)
[+] TParallel.For for all (port, path) combinations
[+] Each worker thread has its own HCkHttp instance (Chilkat is not thread-safe)
[+] Results collected under TCriticalSection
[+] Log() called sequentially after parallel block
[+] Added System.SyncObjs to uses clause

[15] LOG / OUTPUT
[+] Removed "Ping: found 0 IPs" from log (resolver removed)
[+] Fixed "📜 <IP>" spam (was showing same IP 10 times)
[+] FINAL ANALYSIS now respects IsBehindProxy flag
[+] Added "All resolved IPs are behind CDN/proxy" final verdict
[+] Clarifying line: "IP responds but no valid host header match"

[16] STRUCTURAL
[+] TMyThread19 class: LogMsg added to private section
[+] Execute, LogMsg, RequestStop in correct order at file end
[+] All early Exit checks (FStopRequested or Terminated) in place

[17] WILDCARD DNS DETECTION (round-robin aware)
[+] Counts IP frequency across all resolved subdomains
[+] Sorts by frequency, accumulates top-N IPs until 90% coverage
[+] Handles both single-IP wildcard and round-robin (2+ A-records)
[+] Emits warning: "WILDCARD DNS DETECTED" with IP list
[+] Reason: brute force is meaningless when *.domain returns same server(s)

[18] CERT SPOTTER FALLBACK
[+] Added GetSubdomains_CertSpotter() as crt.sh fallback
[+] Free API (no key required, ~100 req/hour)
[+] Triggered automatically when crt.sh returns empty
[+] Reason: crt.sh is down ~80% of the time (HTTP 502)

[19] IPTV OVERRIDE SYSTEM
[+] Added HasIptvPanel flag to TIpInfo class
[+] FindOriginServer: IPTV panel overrides failed host header check (+60)
[+] FindOriginServer: skips VerifyOrigin for IPTV IPs (avoids false reset)
[+] Reason: IPTV panels do not live on CDN edge, panel = strong origin signal

[20] DEAD vs PROXY DISTINCTION
[+] IsBehindProxy only set when server responds but is not origin
[+] Dead/filtered IPs get no flags (keeps FINAL ANALYSIS honest)
[+] Final verdict counts ProxyCount vs DeadCount separately
[+] New verdicts:
- "No direct origin revealed (behind CDN/proxy or wildcard DNS)"
- "No responsive servers found — all IPs dead or firewalled"

[21] FINAL VERDICT LOGIC (TMyThread19.Execute)
[+] Three-way check: HasDirect / HasCf / HasIptv
[+] Output varies:
- direct IPs found -> "Site NOT fully protected"
- IPTV panel found -> "IPTV panel detected, origin incomplete"
- Cloudflare only -> "Site secured behind Cloudflare"
- default -> "No direct origin revealed"

[22] HTML REPORT GENERATION
[+] GenerateHtmlReport() function — dark theme, syntax highlighted
[+] Level-based coloring: INFO/DEBUG/WARN/ERROR/HIT/SUB/HIST
[+] Section headers detection (=== xxx ===)
[+] UTF-8 with BOM, emoji support
[+] Saved to logs\report_<domain>_<timestamp>.html
[+] Triggered automatically in ThreadFinished

[23] MITM DETECTION WARNING (loud)
[+] CheckSslCertificate detects: debug, fiddler, charles, mitm, burp, portswigger, http debugger
[+] Loud ERROR block with border and "TURN OFF..." instructions
[+] Reason: without this, all HTTPS checks give fake results silently

[24] HACKERTARGET SANITIZATION
[+] Filter 127.0.0.1 (wildcard-bogus response)
[+] Filter 0.0.0.0 explicitly
[+] Reason: HackerTarget returns 127.0.0.1 for wildcard DNS domains

[25] CHECK HOST HEADER REFINEMENTS
[+] Task.Path fix in CheckIptvPanel (MAG was checking Paths[i] not current task)
[+] Relaxed main domain check: only 0 or 5xx rejects (401/403 accepted)
[+] Reason: closed login pages return 401/403 but server is real
[+] Default-vhost detection: same HTTP code for valid + random host = +5

[26] SUBDOMAINS LIST
[+] Final size: array[0..137] (137 entries)
[+] Removed: 'test' (duplicate), 'portal' (duplicate)
[+] Array declaration updated in both interface and const section

[27] IPTV DETECTION — EXTENDED RESPONSE TYPES
[+] Added XTREAM-AUTH panel type (HTTP 401 response)
[+] Added XTREAM-BAD-AUTH panel type (HTTP 512 — Xtream-specific "expired account")
[+] 512 is no longer filtered as generic 5xx error — treated as valid panel response
[+] Added #EXTM3U / #EXTINF body markers (m3u_plus playlist signatures)
[+] Added Content-Type detection: mpegurl, x-mpegurl, vnd.apple.mpegurl
[+] Added "player_api" body marker for Xtream
[+] Reason: real panels return these signatures even without credentials

[28] IPTV SCAN — CLOUDFLARE IPs NO LONGER SKIPPED
[+] Removed "if IpInfo.IsCloudflare then Continue" from IPTV scan loop
[+] Reason: Cloudflare proxies port 8080, so origin panel can be reached via CF IP
[+] Real case: gscctyryfn.top — panel responded on CF IP :8080 with #EXTM3U

[29] IPTV OVERRIDE PRIORITY
[+] Moved IPTV check BEFORE CheckHostHeader in FindOriginServer
[+] Baseline Confidence = 60 set immediately if HasIptvPanel
[+] Host header check and other signals can only increase Confidence above 60
[+] Reason: real case (neorcqds.top) — default vhost check returned +5, not 0,
so IPTV override was skipped and panel was lost (Confidence 10)

[30] RIPE / RIR PROVIDER LOOKUP
[+] Added GetIpProviderInfo() — queries RIPEstat Data API
[+] Two-step lookup:
1. network-info/data.json → ASN by IP
2. as-overview/data.json → holder + country code by ASN
[+] Returns "Holder (CC)" or "Holder" or "AS<number>"
[+] Integrated into ALL FOUND IPS log line
[+] Reason: helps identify hosting provider vs ISP vs cloud provider

[31] FAVICON CACHE
[+] Added FCachedDomain + FCachedDomainFavicon fields to TDomainResolver
[+] Domain favicon hash computed only ONCE per scan
[+] Reason: same domain was checked 4 times in logs, wasting ~70 seconds
[+] Favicon timeouts reduced: 5s → 2s
[+] Favicon paths reduced: 4 → 2 (/favicon.ico, /favicon.png)

[32] LOG THREAD SAFETY — FULL FIX
[+] TDomainResolver.Log() now uses TThread.Queue (was direct FMemo.Lines.Add)
[+] Reason: Log() and LogMsg() were writing from different threads,
long IP strings got interleaved with mid-line "[INFO] ..." messages
[+] FMemo.Update removed (VCL updates automatically)

[33] IPTV SCAN — EMPTY RESULT WARNING
[+] Added "⚪ All IPs are behind Cloudflare — nothing to scan" when no IPs scanned
[+] Reason: empty section in log looked like a bug

[34] FINAL VERDICT — RESPONSE CHECK
[+] Execute now checks IsWebServer() for each "direct" IP
[+] If none respond: "💀 Direct IPs found but none respond — likely parked/dead"
[+] If at least one responds: "⚠️ Site has direct IPs - NOT fully protected!"
[+] Reason: servpremium.net case — dead IP was reported as "not protected"

[35] WILDCARD HEADER REFINEMENT
[+] "(round-robin)" suffix shown only when TopCount > 1
[+] Single-IP wildcard gets clean header
[+] Reason: "(round-robin)" was misleading when only 1 IP was detected

[36] PROVIDER DISPLAY IN LOG
[+] "Provider: <name>" added to ALL FOUND IPS line
[+] Format: IP: <addr> - CDN: <name> - Cloudflare: <bool> - Provider: <holder (CC)> - Sources: ...
[+] Reason: quick identification of hosting type without external tools