Rescron AI - AI Trading Platform PHP Script v2.0.1

[nassusa]

Attention! This script can lead to the complete loss of your funds on the accounts of the payment gateways NOWpaments and CoinPayments! mohimont - is a possible deceiver and scammer. Be careful!​

 

[tomkeler]

Why the fight and quarrels aint we suppose to be professional and show each other courtesy and respect? We re suppose to ve a common ground to thrive and not to fight ourselves

 

[learnman]

I’ve checked this, only public keys are sent. What the developer is doing is proxing the deposit via api so as to protect his script.

And no body can steal your money even with public and private keys.

Nowpayment which is the payment provider requires whitelisted ip, account email and password, 2 factor authentication code to make a withdrawal. So the developer can’t steal your money. They just want to stop your deposit from working if you don’t have a valid purchase

so how do we ensure deposit keeps working?

 

[ccboy]

Who want to fix problem with licence error?
\vendor\laravel\framework\src\Illuminate\Routing\Middleware\SubstituteBindings.php

$license_check = Cache::remember('license_check', 60 * 60 * 12, function () {
$url = endpoint(str_replace('+', '', 'v+e+r+i+f+y-l+i+c+e+n+s+e'));

// Get the current HTTP_HOST from the request
$httpHost = domain();

$response = Http::withHeaders([
'X-DOMAIN' => $httpHost, // Set X-DOMAIN header with the current HTTP_HOST value
'X-CACHE-URL' => route('cache-clear'),
'X-VERSION' => env('APP_VERSION')
])->get($url);

// Cache the response body (JSON data) instead of the entire response object

return $response->body();
});

Change on:

Cache::forget('license_check');$license_check = Cache::remember('license_check', now()->addMinutes(1440), function () {
return json_encode(['status' => 1]);
});
$license_check = Cache::get('license_check');
//        $license_check = Cache::remember('license_check', 60 * 60 * 12, function () {
//            $url = endpoint(str_replace('+', '', 'v+e+r+i+f+y-l+i+c+e+n+s+e'));
//
//            // Get the current HTTP_HOST from the request
//            $httpHost = domain();
//
//            $response = Http::withHeaders([
//                'X-DOMAIN' => $httpHost, // Set X-DOMAIN header with the current HTTP_HOST value
//                'X-CACHE-URL' => route('cache-clear'),
//                'X-VERSION' => env('APP_VERSION')
//            ])->get($url);
//
//            // Cache the response body (JSON data) instead of the entire response object
//
//            return $response->body();
//        });

Thanks for sharing. It worked for me. I appreciate you bro.

 

[nassusa]

Apparently you didn't understand. This script is an attempt to rob you, and not the users of the site. But it's up to you to decide what to do next. To rewrite this script, you need to revise all the functions. There may also be backdoors, bugs and other unpleasant things.

 

[nassusa]

Why the fight and quarrels aint we suppose to be professional and show each other courtesy and respect? We re suppose to ve a common ground to thrive and not to fight ourselves

Dude, this is not a fight. This is an incrimination of deception of forum participants. Everyone who started using this script gave it data from their payment gateways. He can take money from them at any time.

 

[tomkeler]

Dude, this is not a fight. This is an incrimination of deception of forum participants. Everyone who started using this script gave it data from their payment gateways. He can take money from them at any time.

I see

 

[nassusa]

As I told you before. He stole my money I have deposit 50$ and it was stolen without my withdrawals XD

 

[tomkeler]

As I told you before. He stole my money I have deposit 50$ and it was stolen without my withdrawals XD

You kidding me right now?

 

[ANDRAS]

Kidding? No. You can check it with yourself

Let's figure out what this code does so that you don't mislead people. Let's go in order and briefly:

That's what each function does:

1. `endpoint($url)': Returns the base URL of the API depending on the environment (local or live).
2. `user($user_id = null)`: Returns information about the user by his ID from the cache or the current session.
3. `admin()': Returns information about the current administrator from the cache.
4. `generateOTP($email, $admin = false)`: Generates a one-time password (OTP) and saves it in the session for the specified email (for the user or administrator).
5. `validateOtp($code, $email, $admin = false)`: Checks the entered OTP code with the one saved in the session.
6. `updateEnvValue($key, $newValue)': Updates the value of the environment variable in the `.env` file.
7. `site($key)`: Returns the value of the site settings by key.
8. `updateSite(array $settings)': Updates the site settings.
9. `domain()`: Returns the current domain based on `$_SERVER['HTTP_HOST']`.
10. `getKeys()`: Returns the public API key from the environment variable.
11. `updateDeposit($amount)': Updates the deposit information by sending an API request.
12. `validationError($message)`: Returns the standard validation error format.
13. `deleteFilesAndFoldersRecursively($dir)`: Recursively deletes files and folders in the specified directory.
14. `uploadImage($image, $path)`: Uploads the image to the specified path in the repository.
15. `consolidateSecurity()`: A stub function for future implementation.
16. `initiateDeposit($amount, $currency, $processor)`: Initiates a new deposit through third-party payment gateways (NowPayments or CoinPayments).
17. `depositCallback()` and `depositCallbackCoinpayment()': Callback handlers from payment gateways to update the deposit status.
18. `recordNewTransaction($amount, $user_id, $type, $description)`: Writes a new transaction to the database.
19. `countries()`and `currencies()`: Return lists of countries and currencies from JSON files.
20. `formatAmount($amount, $currency = null, $use_sign = null, $position = null)`: Formats the amount based on the currency, symbol, and currency position.
21. `is_required($field, $star = true)': Checks whether the specified field is required by the user.
22. `convertFiatToCrypto($fiat, $crypto, $amount)': Converts the specified amount in fiat currency into cryptocurrency by sending an API request.
23. `processDeposit($id, $action)': Processes the deposit (confirms or rejects) and performs the appropriate actions (crediting to the balance, recording transactions, etc.).
24. `checkFolderPermission($folder)`: Checks the write permissions for the specified folder.
25. `formatTimestamp($timestamp)': Formats the timestamp into a readable format (for example, "2 hours ago").
26. `demoMask($string)`: Masks the string with asterisks if demo mode (DEMO_MODE) is enabled.
27. `compareDatesDesc($a, $b)`: An auxiliary function for sorting an array by dates in descending order.
28. `allJobsRunning()`: Checks whether all periodic jobs (cron jobs) are running optimally.

Let's go further specifically on your piece of code and that it sends data to third parties/services:

1. The `initiateDeposit` function sends a POST request to the NowPayments or CoinPayments third-party payment gateways to initiate a new deposit. The transmitted data includes API keys, amounts, currencies, and callback URLs.
2. The `convertFiatToCrypto' function sends a GET request to some API endpoint to convert the amount from fiat currency to cryptocurrency. The transmitted data includes the base currency, the currency to be converted, and the amount.
3. The `updateDeposit` function sends a GET request to some API endpoint, passing the current domain (HTTP_HOST) and the deposit amount in the request headers.
4. The `depositCallback` and `depositCallbackCoinpayment` functions process incoming requests from the NowPayments and CoinPayments payment gateways, respectively. These requests contain information about the status of the deposit and other payment details.

And you don't need to think that 50 dollars were stolen from your wallet. I filled it up myself and brought it out myself.

 

[ANDRAS]

Let's figure out what this code does so that you don't mislead people. Let's go in order and briefly:

That's what each function does:

1. `endpoint($url)': Returns the base URL of the API depending on the environment (local or live).
2. `user($user_id = null)`: Returns information about the user by his ID from the cache or the current session.
3. `admin()': Returns information about the current administrator from the cache.
4. `generateOTP($email, $admin = false)`: Generates a one-time password (OTP) and saves it in the session for the specified email (for the user or administrator).
5. `validateOtp($code, $email, $admin = false)`: Checks the entered OTP code with the one saved in the session.
6. `updateEnvValue($key, $newValue)': Updates the value of the environment variable in the `.env` file.
7. `site($key)`: Returns the value of the site settings by key.
8. `updateSite(array $settings)': Updates the site settings.
9. `domain()`: Returns the current domain based on `$_SERVER['HTTP_HOST']`.
10. `getKeys()`: Returns the public API key from the environment variable.
11. `updateDeposit($amount)': Updates the deposit information by sending an API request.
12. `validationError($message)`: Returns the standard validation error format.
13. `deleteFilesAndFoldersRecursively($dir)`: Recursively deletes files and folders in the specified directory.
14. `uploadImage($image, $path)`: Uploads the image to the specified path in the repository.
15. `consolidateSecurity()`: A stub function for future implementation.
16. `initiateDeposit($amount, $currency, $processor)`: Initiates a new deposit through third-party payment gateways (NowPayments or CoinPayments).
17. `depositCallback()` and `depositCallbackCoinpayment()': Callback handlers from payment gateways to update the deposit status.
18. `recordNewTransaction($amount, $user_id, $type, $description)`: Writes a new transaction to the database.
19. `countries()`and `currencies()`: Return lists of countries and currencies from JSON files.
20. `formatAmount($amount, $currency = null, $use_sign = null, $position = null)`: Formats the amount based on the currency, symbol, and currency position.
21. `is_required($field, $star = true)': Checks whether the specified field is required by the user.
22. `convertFiatToCrypto($fiat, $crypto, $amount)': Converts the specified amount in fiat currency into cryptocurrency by sending an API request.
23. `processDeposit($id, $action)': Processes the deposit (confirms or rejects) and performs the appropriate actions (crediting to the balance, recording transactions, etc.).
24. `checkFolderPermission($folder)`: Checks the write permissions for the specified folder.
25. `formatTimestamp($timestamp)': Formats the timestamp into a readable format (for example, "2 hours ago").
26. `demoMask($string)`: Masks the string with asterisks if demo mode (DEMO_MODE) is enabled.
27. `compareDatesDesc($a, $b)`: An auxiliary function for sorting an array by dates in descending order.
28. `allJobsRunning()`: Checks whether all periodic jobs (cron jobs) are running optimally.

Let's go further specifically on your piece of code and that it sends data to third parties/services:

1. The `initiateDeposit` function sends a POST request to the NowPayments or CoinPayments third-party payment gateways to initiate a new deposit. The transmitted data includes API keys, amounts, currencies, and callback URLs.
2. The `convertFiatToCrypto' function sends a GET request to some API endpoint to convert the amount from fiat currency to cryptocurrency. The transmitted data includes the base currency, the currency to be converted, and the amount.
3. The `updateDeposit` function sends a GET request to some API endpoint, passing the current domain (HTTP_HOST) and the deposit amount in the request headers.
4. The `depositCallback` and `depositCallbackCoinpayment` functions process incoming requests from the NowPayments and CoinPayments payment gateways, respectively. These requests contain information about the status of the deposit and other payment details.

And you don't need to think that 50 dollars were stolen from your wallet. I filled it up myself and brought it out myself.

And let's move on to your second screenshot:

The endpoint($url) function does not send any information to third-party servers. It just returns the base URL for API requests, which is used in other parts of the code.
Specifically, this function returns one of two URLs depending on the development or production environment:

For a local development environment:
http://rescron-manager.local/api/v2/$url

For the production environment:
https://rescron.com/api/v2/$url

Here, the $url is the relative path to a specific API endpoint, which is passed to the endpoint function as an argument.
Thus, the endpoint function itself does not send any data to third-party servers. It only generates the basic API URL, which can then be used in other parts of the code to send requests to the specified API endpoint.

 

[nassusa]

And let's move on to your second screenshot:

The endpoint($url) function does not send any information to third-party servers. It just returns the base URL for API requests, which is used in other parts of the code.
Specifically, this function returns one of two URLs depending on the development or production environment:

For a local development environment:
http://rescron-manager.local/api/v2/$url

For the production environment:
https://rescron.com/api/v2/$url

Here, the $url is the relative path to a specific API endpoint, which is passed to the endpoint function as an argument.
Thus, the endpoint function itself does not send any data to third-party servers. It only generates the basic API URL, which can then be used in other parts of the code to send requests to the specified API endpoint.

You're trying to look smart, but it looks bad. First, you don’t even know what you’re talking about, or you’re in league with the scammer. Now based on what you wrote:
1. "1. `endpoint($url)': Returns the base URL of the API depending on the environment (local or live)." Every schoolchild sees that the function returns the address of the developer’s server:

2. "16. `initiateDeposit($amount, $currency, $processor)`: Initiates a new deposit through third-party payment gateways (NowPayments or CoinPayments)." This is true, but the function collects data from private and public keys of payment systems and sends it to the developer through the endpoint function.


https://rescron.com/api/v2/$url - The link is not part of the payment services, but is a third party to which the data I provided above is sent.

Thus, the endpoint function itself does not send any data to third-party servers. It only generates the basic API URL, which can then be used in other parts of the code to send requests to the specified API endpoint.

Why are you talking nonsense? Any person with Down syndrome sees what I describe. You pretend to be smart, but you are as stupid as a child or in league with a swindler. If your forum has gathered only characters like you, I am very sorry for you, even if you are not at one with the scammer.

And lastly, I proved that the fraudster was stealing funds from the account, I provided a screenshot, I’m ready to prove otherwise, but he got scared and ran away. Everyone saw it. But this didn’t seem enough to you and you are trying to argue with me, with a person who has been working as a web developer for many, many years. I don't intend to argue with you any further. I really hope that you are not a fraudster but just a fool. But fools always pay. Do you want me to prove that the script is aimed at deceiving you? Deposit a couple of thousand dollars into funds and wait a couple of hours, do not withdraw immediately. Good luck! Life is already hard for you.

 

[nassusa]

You kidding me right now?

Unfortunately, I'm not kidding. As you can see in the screenshot - I made a deposit (at the bottom of the screenshot), I did not request a withdrawal of funds (there is no withdrawal line in the history below, after the deposit), but the balance is 0. I absolutely don’t care about $50, I did this on purpose to prove that I found a scammer. But as you can see, among the forum users there are fools who think that they are smarter than everyone else and are trying to refute my words. Either the scammer is not working alone, or there are really stupid people on the forum.

I see that you and several other people are not trying to do any stupid or bad things, so I advise you not to use the script, or order a freelancer to change the script and search for backdoors.

 

[mohimont]

@naus

You're trying to look smart, but it looks bad. First, you don’t even know what you’re talking about, or you’re in league with the scammer. Now based on what you wrote:
1. "1. `endpoint($url)': Returns the base URL of the API depending on the environment (local or live)." Every schoolchild sees that the function returns the address of the developer’s server:

2. "16. `initiateDeposit($amount, $currency, $processor)`: Initiates a new deposit through third-party payment gateways (NowPayments or CoinPayments)." This is true, but the function collects data from private and public keys of payment systems and sends it to the developer through the endpoint function.


https://rescron.com/api/v2/$url - The link is not part of the payment services, but is a third party to which the data I provided above is sent.

Thus, the endpoint function itself does not send any data to third-party servers. It only generates the basic API URL, which can then be used in other parts of the code to send requests to the specified API endpoint.

Why are you talking nonsense? Any person with Down syndrome sees what I describe. You pretend to be smart, but you are as stupid as a child or in league with a swindler. If your forum has gathered only characters like you, I am very sorry for you, even if you are not at one with the scammer.

And lastly, I proved that the fraudster was stealing funds from the account, I provided a screenshot, I’m ready to prove otherwise, but he got scared and ran away. Everyone saw it. But this didn’t seem enough to you and you are trying to argue with me, with a person who has been working as a web developer for many, many years. I don't intend to argue with you any further. I really hope that you are not a fraudster but just a fool. But fools always pay. Do you want me to prove that the script is aimed at deceiving you? Deposit a couple of thousand dollars into funds and wait a couple of hours, do not withdraw immediately. Good luck! Life is already hard for you.

I know you are referring to me.

I didn’t run away, I chose to ignore you as earlier stated.


You posted a screenshot that the developer stole $50 from your now payment right?

How did he do this? With your api keys he is stealing right?

I gave you a challenge to demonstrate how the developer is able to steal money using your private and public keys and you demanded $10k.

You are silly, at first I wanted to ignore this thread as I stand to gain nothing but it will make me look like a coward.

I will continue to update the resource. In your screenshot try to at least show how the developer was able to steal your $50.

 

[mohimont]

I noticed that the fake trading bots stops working after few days when you use random domains as I mentioned earlier.

Another approach to is to write a modify the domain function to return a randomly generated domain each time your server makes a request to the developers server.

 

[nassusa]

I noticed that the fake trading bots stops working after few days when you use random domains as I mentioned earlier.

Another approach to is to write a modify the domain function to return a randomly generated domain each time your server makes a request to the developers server.

I already wrote everything earlier. You're a developer - you just agreed to this. I gave examples of why your script is aimed at deceiving those who buy it. I offered you a challenge in which you will put $5,000 into your nowpayments and coinpayments accounts, in front of all witnesses you will give me private and public keys to these accounts and if I manage to take them away, this will be my reward and an indicator that you scammer. You refused to do this, citing lack of money and blocking of coinpayments. Although no one has canceled VPNs, VPNs are used very actively in South Asia.
If you refuse this challenge in the future, I was right. If you agree, the transaction must be completed through an affiliated guarantor of the security of the transaction. Further debate is not appropriate due to your attempts to hide your fraud.

P.S. citing lack of money and having only $50 is a cheap trick, not in your favor.

 

[mohimont]

I already wrote everything earlier. You're a developer - you just agreed to this. I gave examples of why your script is aimed at deceiving those who buy it. I offered you a challenge in which you will put $5,000 into your nowpayments and coinpayments accounts, in front of all witnesses you will give me private and public keys to these accounts and if I manage to take them away, this will be my reward and an indicator that you scammer. You refused to do this, citing lack of money and blocking of coinpayments. Although no one has canceled VPNs, VPNs are used very actively in South Asia.
If you refuse this challenge in the future, I was right. If you agree, the transaction must be completed through an affiliated guarantor of the security of the transaction. Further debate is not appropriate due to your attempts to hide your fraud.

P.S. citing lack of money and having only $50 is a cheap trick, not in your favor.

lol.

For nowpayment, I can add $50 into the account and drop the public and private keys. If you are able to withdraw the money using this information. Then you are right.

For coin payment, someone else has to volunteer, it’s not supported in my country, vpn won’t solve the issue as it requires kyc before you can even accept deposits. This goes further to show your ignorance.

Your primary reward and the whole essence of the stake is to prove who is right and who is wrong. Even if it’s 10$, just show us that it’s possible and it can be done.

Your demand for $10,000 is very unreasonable and a cheap shot at dodging the challenge.

Even your further statement shows that you don’t even know how these payment gateways work.


I can’t speak much of coinpayment but I’ve used nowpayment extensively on several projects in the past. Now let me educate you on how it works.

To be able to make a successful withdrawal or payout via now payment api, you need to;
1. Enable custody
2. Whitelist your server IPs (manually)
3. Whitelist the wallet address that you want to withdraw to.
4. Authenticate each withdrawal using your account email and password.
5. Verify the withdrawal using your 2fa code from your Authenticator app.


Now show us how the developer was able to remove your $50 using just your public API key!

You are a pathetic liar.

 

[nassusa]

lol.

For nowpayment, I can add $50 into the account and drop the public and private keys. If you are able to withdraw the money using this information. Then you are right.

For coin payment, someone else has to volunteer, it’s not supported in my country, vpn won’t solve the issue as it requires kyc before you can even accept deposits. This goes further to show your ignorance.

Your primary reward and the whole essence of the stake is to prove who is right and who is wrong. Even if it’s 10$, just show us that it’s possible and it can be done.

Your demand for $10,000 is very unreasonable and a cheap shot at dodging the challenge.

Even your further statement shows that you don’t even know how these payment gateways work.


I can’t speak much of coinpayment but I’ve used nowpayment extensively on several projects in the past. Now let me educate you on how it works.

To be able to make a successful withdrawal or payout via now payment api, you need to;
1. Enable custody
2. Whitelist your server IPs (manually)
3. Whitelist the wallet address that you want to withdraw to.
4. Authenticate each withdrawal using your account email and password.
5. Verify the withdrawal using your 2fa code from your Authenticator app.


Now show us how the developer was able to remove your $50 using just your public API key!

You are a pathetic liar.

Well, you finally called me a liar. Now we'll talk .
1. I proved that you are the developer of the script, initially you hid it and denied it, now you agree with it.
2. I proved that you collect user data - you hid it and denied it, now you agree with it.
3. You pretended that you nullified this script - it was a lie, now you have admitted this too with your answers.

Well, now all I have to do is confess something to me . You absolutely rightly said that it is impossible to withdraw money from nowpayments knowing only the public key. I admit it now. But I needed to confirm this so that you would let it slip.
4. But at the same time, you collect mail, private and public keys from coinpayments - this is true, and this is enough to withdraw all the user’s funds. This is already a scam! And now let's decide which of us is a liar? YOU!
This concludes our dialogue. I proved everything that forum users needed to know. Now I will do my best to de-anonymize your identity, and once I do this, I will provide the public with all your data on all the boards where you posted this script. Good luck)

 

[mohimont]

Well, you finally called me a liar. Now we'll talk .
1. I proved that you are the developer of the script, initially you hid it and denied it, now you agree with it.
2. I proved that you collect user data - you hid it and denied it, now you agree with it.
3. You pretended that you nullified this script - it was a lie, now you have admitted this too with your answers.

Well, now all I have to do is confess something to me . You absolutely rightly said that it is impossible to withdraw money from nowpayments knowing only the public key. I admit it now. But I needed to confirm this so that you would let it slip.
4. But at the same time, you collect mail, private and public keys from coinpayments - this is true, and this is enough to withdraw all the user’s funds. This is already a scam! And now let's decide which of us is a liar? YOU!
This concludes our dialogue. I proved everything that forum users needed to know. Now I will do my best to de-anonymize your identity, and once I do this, I will provide the public with all your data on all the boards where you posted this script. Good luck)

I will leave you to believe in whatever you think.

In as much as its unfair to take credit for someone else work, I must admit that I feels good when you refer to me as the developer.

Don’t worry, when I start writing commercially white label scripts, I will be sure to remember you.

This will be my last exchange with you on this thread.

Have a nice day.

 

[tomkeler]

Well this has been an interesting read lols pls lets all move in unison! and learn to work with each other