Regex Tester & Validator

Detects a PHP malware backdoor that may be hidden in fake GIF89 image files. The payload harvests the HTTP Host header, checks for a 'merdo' request parameter as a trigger, fetches remote content via cURL/file_get_contents, decodes ROT13-obfuscated JSON responses, and performs header redirects to attacker-controlled URLs. Commonly found in compromised web servers for black-hat SEO redirects and cloaking.