#!/bin/bash
# Reality SNI 精准检测 v3
# 并发测试 · TLS1.3验证 · X25519 · CDN指纹 · 证书有效期 · 重定向检测
# 适用于 VLESS+REALITY 伪装域名筛选

# ═══════════════════════════════════════════════════════════════════════
# 颜色 & 样式
# ═══════════════════════════════════════════════════════════════════════
RED='\033[0;31m'; YELLOW='\033[1;33m'; GREEN='\033[0;32m'
CYAN='\033[0;36m'; BOLD='\033[1m'; DIM='\033[2m'; RESET='\033[0m'

# ═══════════════════════════════════════════════════════════════════════
# 配置
# ═══════════════════════════════════════════════════════════════════════
TIMEOUT=5       # curl 超时（秒）
SSL_TIMEOUT=6   # openssl 超时（秒）
MAX_JOBS=15     # 最大并发数

WORK_DIR=$(mktemp -d /tmp/snitest.XXXXXX)
cleanup() {
    kill $(jobs -p) 2>/dev/null
    rm -rf "${WORK_DIR}"
}
trap cleanup EXIT INT TERM

declare -A domains

# ═══════════════════════════════════════════════════════════════════════
# 🇯🇵 日本 (JP)  — 50 原有 + 50 新增 = 100 个
# ═══════════════════════════════════════════════════════════════════════
domains["🇯🇵 日本 (JP)"]=" \
    yahoo.co.jp \
    rakuten.co.jp \
    mercari.com \
    navitime.co.jp \
    location-research.co.jp \
    cookpad.com \
    delishkitchen.tv \
    nikkei.com \
    weblio.jp \
    www.fujitsu.com \
    www.toshiba.co.jp \
    www.hitachi.co.jp \
    www.smbc.co.jp \
    www.mizuho-fg.co.jp \
    www.mufg.jp \
    www.resonabank.co.jp \
    www.jal.co.jp \
    www.ana.co.jp \
    www.shiseido.co.jp \
    www.kao.co.jp \
    www.suntory.co.jp \
    www.kirin.co.jp \
    www.asahibeer.co.jp \
    www.sapporobeer.jp \
    www.calbee.co.jp \
    www.meiji.co.jp \
    www.morinaga.co.jp \
    www.lotte.co.jp \
    www.honda.co.jp \
    www.toyota.co.jp \
    www.nissan.co.jp \
    www.mazda.co.jp \
    www.subaru.jp \
    www.isuzu.co.jp \
    www.suzuki.co.jp \
    www.yamaha.com \
    panasonic.jp \
    www.sony.co.jp \
    www.sharp.co.jp \
    www.epson.jp \
    canon.jp \
    www.casio.co.jp \
    www.seiko.co.jp \
    www.citizen.jp \
    www.nitori.co.jp \
    www.tbs.co.jp \
    www.ntv.co.jp \
    www.tv-asahi.co.jp \
    www.fujitv.co.jp \
    www.ihi.co.jp \
    www.mitsubishielectric.co.jp \
    www.ricoh.com \
    www.daikin.co.jp \
    www.murata.com \
    www.keyence.com \
    www.fanuc.co.jp \
    www.yaskawa.co.jp \
    www.softbank.jp \
    www.nttdata.com \
    www.lawson.co.jp \
    www.family.co.jp \
    www.7eleven.co.jp \
    www.uniqlo.com \
    www.muji.com \
    www.matsuya.com \
    www.mitsukoshi.co.jp \
    www.isetan.co.jp \
    www.takashimaya.co.jp \
    www.daimaru.co.jp \
    www.hankyu-dept.co.jp \
    www.odakyu.jp \
    www.tobu.co.jp \
    www.keio.co.jp \
    www.seiburailway.jp \
    www.kintetsu.co.jp \
    www.meitetsu.co.jp \
    www.nankai.co.jp \
    www.sotetsu.co.jp \
    www.tokyu.co.jp \
    www.subaru-sales.co.jp \
    www.bridgestone.co.jp \
    www.yokohamatire.com \
    www.toyotires.co.jp \
    www.sumitomorubber.co.jp \
    www.asics.com \
    www.mizuno.jp \
    www.descente.co.jp \
    www.goldwin.co.jp \
    www.yonex.co.jp \
    www.shimano.com \
    www.bandainamco.co.jp \
    www.capcom.co.jp \
    www.square-enix.com \
    www.sega.jp \
    www.konami.com \
    www.nintendo.co.jp \
    www.korg.com \
    www.roland.com \
    www.audio-technica.co.jp \
    www.fostex.jp"

# ═══════════════════════════════════════════════════════════════════════
# 🇸🇬 新加坡 (SG) — 50 原有 + 50 新增 = 100 个
# ═══════════════════════════════════════════════════════════════════════
domains["🇸🇬 新加坡 (SG)"]=" \
    www.fullertonhotels.com \
    www.mewatch.sg \
    www.capitastar.com \
    www.cdl.com.sg \
    www.fareast.com.sg \
    www.mapletree.com.sg \
    www.safra.sg \
    www.carltonhotel.sg \
    www.panpacific.com \
    www.fareasthospitality.com \
    www.ionorchard.com \
    www.paragon.com.sg \
    www.sunteccity.com.sg \
    www.vivocity.com.sg \
    www.allenandgledhill.com \
    www.wongpartnership.com \
    www.beritaharian.sg \
    www.chope.co \
    www.shopback.sg \
    www.singaporeair.com \
    www.singtel.com \
    www.starhub.com \
    www.m1.com.sg \
    www.grab.com \
    www.propertyguru.com.sg \
    www.carousell.sg \
    www.redmart.com \
    www.lazada.sg \
    www.ezbuy.sg \
    www.qoo10.sg \
    www.fairprice.com.sg \
    www.coldstorage.com.sg \
    www.shengsiong.com.sg \
    www.giant.sg \
    www.dbs.com \
    www.ocbc.com \
    www.uobgroup.com \
    www.singlife.com \
    www.greateasternlife.com \
    www.prudential.com.sg \
    www.aia.com.sg \
    www.manulife.com.sg \
    www.axa.com.sg \
    www.allianz.sg \
    www.comfortdelgro.com \
    www.smrt.com.sg \
    www.sbstransit.com.sg \
    www.towertransit.sg \
    www.go-aheadsingapore.com \
    www.cdg.com.sg \
    www.capitaland.com \
    www.citydevelopments.com \
    www.frasersproperty.com \
    www.guocoland.com \
    www.oue.com.sg \
    www.uol.com.sg \
    www.singaporeland.com \
    www.wingtaiasia.com.sg \
    www.bukitsembawang.sg \
    www.allgreen.com.sg \
    www.breadtalk.com \
    www.oldchangkee.com \
    www.ya-kun.com \
    www.toastbox.com.sg \
    www.kopitiam.biz \
    www.foodjunction.com \
    www.jumboseafood.com.sg \
    www.tunglok.com \
    www.crystaljade.com \
    www.din-tai-fung.com.sg \
    www.marinabaysands.com \
    www.rwsentosa.com \
    www.shangri-la.com \
    www.raffles.com \
    www.swissotel.com \
    www.fairmont.com \
    www.hyatt.com \
    www.marriott.com \
    www.intercontinental.com \
    www.hilton.com \
    www.keppel.com \
    www.sembcorp.com \
    www.sats.com.sg \
    www.siaec.com.sg \
    www.vicom.com.sg \
    www.cdg-taxi.com.sg \
    www.sistic.com.sg \
    www.sportshub.com.sg \
    www.parco.com.sg \
    www.orchidclub.com \
    www.parkwayparade.com.sg \
    www.jurongpoint.com.sg \
    www.one15marina.com \
    www.yachtcharter.sg \
    www.changirecommends.com \
    www.jewelchangiairport.com \
    www.guidemesingapore.com"

# ═══════════════════════════════════════════════════════════════════════
# 🇹🇼 台湾 (TW) — 50 原有 + 50 新增 = 100 个
# ═══════════════════════════════════════════════════════════════════════
domains["🇹🇼 台湾 (TW)"]=" \
    yahoo.com.tw \
    ruten.com.tw \
    shopee.tw \
    etmall.com.tw \
    carousell.tw \
    costco.com.tw \
    buy123.com.tw \
    ltn.com.tw \
    udn.com \
    chinatimes.com \
    tvbs.com.tw \
    setn.com \
    cna.com.tw \
    bnext.com.tw \
    klook.com \
    pixnet.net \
    dcard.tw \
    taishinbank.com.tw \
    www.skm.com.tw \
    www.sogo.com.tw \
    www.breeze.com.tw \
    www.taipei-101.com.tw \
    www.pxmart.com.tw \
    www.carrefour.com.tw \
    www.rt-mart.com.tw \
    www.simplemart.com.tw \
    www.watsons.com.tw \
    www.cosmed.com.tw \
    www.7-11.com.tw \
    www.family.com.tw \
    www.hilife.com.tw \
    www.okmart.com.tw \
    www.pcstore.com.tw \
    www.momo.com.tw \
    www.books.com.tw \
    www.payeasy.com.tw \
    www.friday.tw \
    www.ibon.com.tw \
    www.ubus.com.tw \
    www.kingbus.com.tw \
    www.capital-bus.com.tw \
    www.kamalan.com.tw \
    www.evaair.com \
    www.china-airlines.com \
    www.starlux-airlines.com \
    www.mandarin-airlines.com \
    www.dailyair.com.tw \
    www.uni-president.com.tw \
    www.formosaplastics.com.tw \
    www.cathaylife.com.tw \
    www.fubonlife.com.tw \
    www.esunbank.com.tw \
    www.cathaybk.com.tw \
    www.ctbcbank.com \
    www.shinkongbank.com.tw \
    www.taishinholdings.com \
    www.fubon.com \
    www.cathayholdings.com \
    www.yuanta.com \
    www.sinopac.com \
    www.ezfly.com \
    www.liontravel.com \
    www.startravel.com.tw \
    www.colatour.com.tw \
    www.kkday.com \
    www.591.com.tw \
    www.104.com.tw \
    www.1111.com.tw \
    www.yes123.com.tw \
    www.pcalife.com.tw \
    www.nanshanlife.com.tw \
    www.mercurieslife.com.tw \
    www.shinkonglife.com.tw \
    www.taiwanlife.com \
    www.chinalife.com.tw \
    www.kingstone.com.tw \
    www.eslite.com \
    www.tsannkuen.com.tw \
    www.tk3c.com \
    www.e-life.com.tw \
    www.sunfar.com.tw \
    www.isunfar.com.tw \
    www.pcone.com.tw \
    www.fareast.com.tw \
    www.chonghong.com.tw \
    www.farglory.com.tw \
    www.radium.com.tw \
    www.huaku.com.tw \
    www.kindom.com.tw \
    www.highwealth.com.tw \
    www.prince.com.tw \
    www.linden.com.tw \
    www.howard-hotels.com.tw \
    www.gloriahotel.com \
    www.caesarpark.com.tw \
    www.ambassador-hotels.com \
    www.royal-hotel.com.tw \
    www.lakeshore.com.tw \
    www.fleurdechinehotel.com \
    www.fullon-hotels.com.tw \
    www.hotel-national.com.tw \
    www.grand-hilai.com.tw \
    www.regenttaiwan.com \
    www.silksplace.com \
    www.justsleep.com.tw \
    www.homehotel.com.tw \
    www.chateau.com.tw \
    www.paolyta.com.tw \
    www.hey-song.com.tw \
    www.vitalon.com.tw \
    www.i-meifoods.com.tw \
    www.kuangchuan.com"

# ═══════════════════════════════════════════════════════════════════════
# 🇭🇰 香港 (HK) — 50 原有 + 50 新增 = 100 个
# ═══════════════════════════════════════════════════════════════════════
domains["🇭🇰 香港 (HK)"]=" \
    hktvmall.com \
    price.com.hk \
    fortress.com.hk \
    broadwaylifestyle.com \
    yohohongkong.com \
    hkbookcity.com \
    carousell.com.hk \
    cathaypacific.com \
    hkexpress.com \
    www.hongkongcard.com \
    hk01.com \
    on.cc \
    hket.com \
    scmp.com \
    mingpao.com \
    stheadline.com \
    ejinsight.com \
    hsbc.com.hk \
    bochk.com \
    hangseng.com \
    hkbea.com \
    standardchartered.com.hk \
    hkt.com \
    three.com.hk \
    smartone.com \
    hkcsl.com \
    kmb.hk \
    citybus.com.hk \
    openrice.com \
    timable.com \
    www.utravel.com.hk \
    hongkongdisneyland.com \
    jobsdb.com \
    cpjobs.com \
    28hse.com \
    squarefoot.com.hk \
    hkjc.com \
    aastocks.com \
    www.sunhungkaiproperties.com \
    www.swireproperties.com \
    www.wharf.com.hk \
    www.sinoland.com \
    www.dbs.com.hk \
    www.watsons.com.hk \
    www.mannings.com.hk \
    www.sasa.com \
    www.chowsangsang.com \
    www.chowtaifook.com \
    www.lukfook.com \
    www.bossini.com \
    www.giordano.com \
    www.crocodile.com.hk \
    www.g2000.com.hk \
    www.esprit.com \
    www.i-cable.com \
    www.now.com \
    www.pccw.com \
    www.hkbn.net \
    www.hgc.com.hk \
    www.hkproperty.com \
    www.midland.com.hk \
    www.centanet.com \
    www.ricacorp.com \
    www.livi.hk \
    www.za.group \
    www.mox.com \
    www.welab.co \
    www.antbank.hk \
    www.paob.com.hk \
    www.fusionbank.com \
    www.airstarbank.com \
    www.greaterbay-airlines.com \
    www.sino.com \
    www.hendersonland.com \
    www.hld.com \
    www.ckh.com.hk \
    www.ckasset.com \
    www.nwd.com.hk \
    www.hanglung.com \
    www.hysan.com.hk \
    www.kerryprops.com \
    www.wheelockcompany.com \
    www.hopewellholdings.com \
    www.greateagle.com.hk \
    www.shuntakgroup.com \
    www.fecil.com.hk \
    www.laisun.com \
    www.vitasoy.com \
    www.garden.com.hk \
    www.harbourcity.com.hk \
    www.timessquare.com.hk \
    www.ifc.com.hk \
    www.langhamplace.com.hk \
    www.tmtplaza.com.hk \
    www.yohomall.hk \
    www.cityplaza.com \
    www.pacificplace.com.hk \
    www.festivalwalk.com.hk \
    www.landmark.hk"

# ═══════════════════════════════════════════════════════════════════════
# 🇺🇸 美国 (US) — 50 原有 + 50 新增 = 100 个
# ═══════════════════════════════════════════════════════════════════════
domains["🇺🇸 美国 (US)"]=" \
    ebay.com \
    walmart.com \
    target.com \
    bestbuy.com \
    homedepot.com \
    lowes.com \
    costco.com \
    wayfair.com \
    macys.com \
    nytimes.com \
    washingtonpost.com \
    wsj.com \
    bloomberg.com \
    reuters.com \
    cnn.com \
    foxnews.com \
    nbcnews.com \
    www.huffpost.com \
    weather.com \
    chase.com \
    bankofamerica.com \
    wellsfargo.com \
    citibank.com \
    americanexpress.com \
    att.com \
    verizon.com \
    t-mobile.com \
    comcast.com \
    charter.com \
    aa.com \
    delta.com \
    united.com \
    southwest.com \
    www.jetblue.com \
    yelp.com \
    tripadvisor.com \
    zillow.com \
    realtor.com \
    indeed.com \
    www.webmd.com \
    www.cvs.com \
    www.netflix.com \
    www.apnews.com \
    www.intel.com \
    www.amd.com \
    www.nvidia.com \
    www.qualcomm.com \
    www.ibm.com \
    www.oracle.com \
    www.salesforce.com \
    www.adobe.com \
    www.cisco.com \
    www.hp.com \
    www.dell.com \
    www.lenovo.com \
    www.nike.com \
    www.adidas.com \
    www.underarmour.com \
    www.gap.com \
    www.nordstrom.com \
    www.kohls.com \
    www.jcpenney.com \
    www.sears.com \
    www.kmart.com \
    www.walgreens.com \
    www.riteaid.com \
    www.starbucks.com \
    www.mcdonalds.com \
    www.subway.com \
    www.burgerking.com \
    www.wendys.com \
    www.pizzahut.com \
    www.dominos.com \
    www.dunkindonuts.com \
    www.kfc.com \
    www.tacobell.com \
    www.coca-cola.com \
    www.pepsico.com \
    www.kraftheinzcompany.com \
    www.generalmills.com \
    www.kelloggs.com \
    www.mondelezinternational.com \
    www.hersheyland.com \
    www.mars.com \
    www.nestleusa.com \
    www.pg.com \
    www.colgatepalmolive.com \
    www.kimberly-clark.com \
    www.jnj.com \
    www.hersheys.com \
    www.wrigley.com \
    www.tysonfoods.com \
    www.campbells.com \
    www.conagrabrands.com \
    www.generalmotors.com \
    www.ford.com \
    www.chrysler.com \
    www.tesla.com \
    www.harleydavidson.com \
    www.jeep.com"

# ═══════════════════════════════════════════════════════════════════════
# 🇬🇧 英国 (GB)  — 100 个商业/媒体/零售/酒店域名
# ═══════════════════════════════════════════════════════════════════════
domains["🇬🇧 英国 (GB)"]=" \
    www.itv.com \
    www.channel4.com \
    www.sky.com \
    www.telegraph.co.uk \
    www.independent.co.uk \
    www.standard.co.uk \
    www.thetimes.co.uk \
    www.dailymail.co.uk \
    www.express.co.uk \
    www.mirror.co.uk \
    www.marksandspencer.com \
    www.sainsburys.co.uk \
    www.tesco.com \
    www.asda.com \
    www.morrisons.com \
    www.waitrose.com \
    www.iceland.co.uk \
    www.aldi.co.uk \
    www.lidl.co.uk \
    www.coop.co.uk \
    www.johnlewis.com \
    www.next.co.uk \
    www.argos.co.uk \
    www.boots.com \
    www.superdrug.com \
    www.waterstones.com \
    www.whsmith.co.uk \
    www.halfords.com \
    www.currys.co.uk \
    www.dunelm.com \
    www.tkmaxx.com \
    www.primark.com \
    www.matalan.co.uk \
    www.newlook.com \
    www.riverisland.com \
    www.asos.com \
    www.boohoo.com \
    www.prettylittlething.com \
    www.sportsdirect.com \
    www.jdsports.co.uk \
    www.schuh.co.uk \
    www.clarks.co.uk \
    www.office.co.uk \
    www.hotelchocolat.com \
    www.hollandandbarrett.com \
    www.specsavers.co.uk \
    www.visionexpress.com \
    www.lush.com \
    www.thebodyshop.com \
    www.selfridges.com \
    www.greggs.co.uk \
    www.costa.co.uk \
    www.caffenero.com \
    www.pret.co.uk \
    www.nandos.co.uk \
    www.wagamama.com \
    www.pizzaexpress.com \
    www.zizzi.co.uk \
    www.premierinn.com \
    www.travelodge.co.uk \
    www.marstons.co.uk \
    www.greeneking.co.uk \
    www.jdwetherspoon.com \
    www.stonegategroup.co.uk \
    www.thesavoy.com \
    www.ritzlondon.com \
    www.claridges.co.uk \
    www.gordonramsayrestaurants.com \
    www.jamieoliver.com \
    www.rightmove.co.uk \
    www.zoopla.co.uk \
    www.onthemarket.com \
    www.purplebricks.co.uk \
    www.savills.co.uk \
    www.knightfrank.co.uk \
    www.foxtons.co.uk \
    www.dexters.co.uk \
    www.hamptons.co.uk \
    www.struttandparker.com \
    www.barclays.co.uk \
    www.natwest.com \
    www.lloydsbank.com \
    www.halifax.co.uk \
    www.santander.co.uk \
    www.tsb.co.uk \
    www.nationwide.co.uk \
    www.virginmoney.com \
    www.aviva.co.uk \
    www.legalandgeneral.com \
    www.prudential.co.uk \
    www.standardlife.co.uk \
    www.bupa.co.uk \
    www.theaa.com \
    www.rac.co.uk \
    www.greenflag.com \
    www.harrods.com \
    www.libertylondon.com \
    www.fortnumandmason.com \
    www.harveynichols.com"

# ═══════════════════════════════════════════════════════════════════════
# 地区顺序
# ═══════════════════════════════════════════════════════════════════════
region_order=(
    "🇯🇵 日本 (JP)"
    "🇸🇬 新加坡 (SG)"
    "🇹🇼 台湾 (TW)"
    "🇭🇰 香港 (HK)"
    "🇺🇸 美国 (US)"
    "🇬🇧 英国 (GB)"
)

# ═══════════════════════════════════════════════════════════════════════
# 工具检查
# ═══════════════════════════════════════════════════════════════════════
check_deps() {
    local missing=()
    for cmd in curl awk grep openssl dig; do
        command -v "$cmd" &>/dev/null || missing+=("$cmd")
    done
    if [[ ${#missing[@]} -gt 0 ]]; then
        echo -e "${RED}缺少依赖: ${missing[*]}${RESET}"
        echo "  macOS: brew install curl openssl bind"
        echo "  Linux: apt install curl openssl dnsutils"
        exit 1
    fi
}

# ═══════════════════════════════════════════════════════════════════════
# 页头
# ═══════════════════════════════════════════════════════════════════════
print_header() {
    echo ""
    echo -e "${BOLD}╔═══════════════════════════════════════════════════════════════════════╗${RESET}"
    echo -e "${BOLD}║     Reality SNI 精准检测 v3  —  VLESS+REALITY 伪装域名筛选          ║${RESET}"
    echo -e "${BOLD}╠═══════════════════════════════════════════════════════════════════════╣${RESET}"
    echo -e "${BOLD}║  检测项: TLS握手时间 · TLS1.3 · X25519 · H2 · CDN指纹 · 证书天数   ║${RESET}"
    echo -e "${BOLD}╚═══════════════════════════════════════════════════════════════════════╝${RESET}"
    echo ""
}

# ═══════════════════════════════════════════════════════════════════════
# 地区选择
# ═══════════════════════════════════════════════════════════════════════
select_regions() {
    echo -e "请选择要测试的地区（空格分隔序号，直接回车测试全部）："
    echo ""
    local i=1
    for region in "${region_order[@]}"; do
        echo "  [$i] $region"
        (( i++ ))
    done
    echo "  [A] 全部测试"
    echo ""
    read -r -p "请输入序号（如: 1 3 或直接回车）: " input

    selected_regions=()
    local max=${#region_order[@]}
    input="${input//$'\r'/}"
    if [[ -z "$input" || "$input" =~ ^[Aa]$ ]]; then
        selected_regions=("${region_order[@]}")
        echo -e "\n→ 测试全部地区"
    else
        for num in $input; do
            if [[ "$num" =~ ^[0-9]+$ ]] && (( num >= 1 && num <= max )); then
                selected_regions+=("${region_order[$((num-1))]}")
            else
                echo "  忽略无效输入: $num"
            fi
        done
        if [[ ${#selected_regions[@]} -eq 0 ]]; then
            echo "  未选择有效地区，测试全部。"
            selected_regions=("${region_order[@]}")
        else
            echo -n "→ 已选择: "
            for r in "${selected_regions[@]}"; do echo -n "$r  "; done
            echo ""
        fi
    fi
    echo ""
}

# ═══════════════════════════════════════════════════════════════════════
# 核心检测函数（后台子进程执行）
#
# 输出文件格式（竖线分隔）:
#   score|domain|region|ms|http_ver|http_code|redirect|cdn_flag|cdn_name|tls13|x25519|cert_days|is_self_signed
# ═══════════════════════════════════════════════════════════════════════
test_domain_full() {
    local domain="$1"
    local region="$2"
    local outfile="$3"
    
    local score=100

    # ── Step 0: IP & CDN 检测 (dig + Cymru ASN) ───────────────
    local ip="" cdn_flag="OK" cdn_name=""
    ip=$(dig +short A "$domain" 2>/dev/null | grep -E '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$' | head -n1)
    
    if [[ -n "$ip" ]]; then
        # 反向 IP 获取 ASN
        local rev_ip
        rev_ip=$(echo "$ip" | awk -F. '{print $4"."$3"."$2"."$1}')
        local asn
        asn=$(dig +short "${rev_ip}.origin.asn.cymru.com" TXT 2>/dev/null | grep -oE '^[0-9]+' | head -n1)
        if [[ -n "$asn" ]]; then
            # 根据 ASN 获取组织名称
            local as_name
            as_name=$(dig +short "AS${asn}.asn.cymru.com" TXT 2>/dev/null | grep -o ' | .*' | awk -F'| ' '{print $NF}')
            if echo "$as_name" | grep -qiE 'cloudflare|akamai|fastly|amazon|microsoft|google|incapsula|sucuri'; then
                cdn_flag="CDN"
                cdn_name=$(echo "$as_name" | awk '{print $1}')
                ((score -= 50))
            fi
        fi
    fi

    # ── Step 1: curl 一次获取握手时间 + H2 + HTTP状态码 + 响应头 ──────
    local full_out timing_raw
    full_out=$(curl -s -k -m "${TIMEOUT}" \
        --tlsv1.3 --http2 \
        --max-redirs 0 \
        -D /dev/stdout -o /dev/null \
        -w $'\n__T__%{time_appconnect}|%{http_version}|%{http_code}' \
        "https://${domain}" 2>/dev/null)

    timing_raw=$(printf '%s\n' "$full_out" | grep '^__T__' | head -1 | sed 's/^__T__//')

    local appconnect http_ver http_code headers
    appconnect=$(printf '%s' "$timing_raw" | cut -d'|' -f1)
    http_ver=$(  printf '%s' "$timing_raw" | cut -d'|' -f2)
    http_code=$( printf '%s' "$timing_raw" | cut -d'|' -f3)
    headers=$(   printf '%s\n' "$full_out"  | grep -v '^__T__')

    # 超时或无法连接
    if [[ -z "$appconnect" || "$appconnect" == "0.000000" ]]; then
        printf '%s\n' "-999|${domain}|${region}|timeout|||||||||" > "$outfile"
        return
    fi

    local ms
    ms=$(awk "BEGIN {printf \"%.1f\", ${appconnect} * 1000}")
    
    # 延迟惩罚
    local penalty
    penalty=$(awk "BEGIN {printf \"%d\", ${appconnect} * 1000 / 50}")
    ((score -= penalty))

    # ── Step 2: 重定向及HTTP状态检测 ───────────
    local redirect_flag="no"
    if [[ "$http_code" =~ ^30[12378]$ ]]; then
        redirect_flag="yes:${http_code}"
        ((score -= 20))
    elif [[ "$http_code" == "200" ]]; then
        ((score += 10))
    fi

    if [[ "$http_ver" == "2" ]]; then
        ((score += 10))
    fi

    # ── Step 3: Header CDN 备用识别 ────────────
    if [[ "$cdn_flag" == "OK" ]]; then
        if   printf '%s\n' "$headers" | grep -qiE '^cf-ray:|^server: cloudflare'; then
            cdn_flag="CDN"; cdn_name="Cloudflare"
        elif printf '%s\n' "$headers" | grep -qiE 'x-akamai|akamaighost|x-check-cacheable'; then
            cdn_flag="CDN"; cdn_name="Akamai"
        elif printf '%s\n' "$headers" | grep -qiE '^via:.*varnish|x-fastly-request-id|x-served-by:.*cache'; then
            cdn_flag="CDN"; cdn_name="Fastly"
        elif printf '%s\n' "$headers" | grep -qiE 'x-amz-cf-id:|x-amzn-requestid:|x-cache:.*cloudfront'; then
            cdn_flag="CDN"; cdn_name="AWS CloudFront"
        elif printf '%s\n' "$headers" | grep -qiE '^x-ms-|x-azure-ref|arr-disable'; then
            cdn_flag="CDN"; cdn_name="Azure"
        elif printf '%s\n' "$headers" | grep -qiE 'x-goog-|x-guploader|^server: gws'; then
            cdn_flag="CDN"; cdn_name="Google"
        elif printf '%s\n' "$headers" | grep -qiE 'x-cdn:.*incapsula|x-iinfo:|x-sucuri-id'; then
            cdn_flag="CDN"; cdn_name="Imperva/Sucuri"
        elif printf '%s\n' "$headers" | grep -qiE '^nel:.*|^report-to:.*cloudflare'; then
            cdn_flag="CDN"; cdn_name="Cloudflare(NEL)"
        fi
        
        if [[ "$cdn_flag" == "CDN" ]]; then
            ((score -= 50))
        fi
    fi

    # CDN 域名跳过 openssl 深度检测
    if [[ "$cdn_flag" == "CDN" ]]; then
        printf '%s\n' "${score}|${domain}|${region}|${ms}|${http_ver}|${http_code}|${redirect_flag}|CDN|${cdn_name}|no|no|?|?" > "$outfile"
        return
    fi

    # ── Step 4: TLS1.3 + X25519 + 证书检查 ──────
    local ssl_out tls13="no" x25519="no" cert_days="?" is_self_signed="no"
    ssl_out=$(printf 'Q\n' | timeout "${SSL_TIMEOUT}" openssl s_client \
        -connect "${domain}:443" \
        -servername "${domain}" \
        -tls1_3 \
        2>/dev/null)

    # 验证 TLS 1.3
    if printf '%s\n' "$ssl_out" | grep -qE 'Protocol[[:space:]]*:[[:space:]]*TLSv1\.3|TLSv1\.3'; then
        tls13="yes"
        ((score += 10))
    else
        ((score -= 20))
    fi

    # X25519
    if printf '%s\n' "$ssl_out" | grep -qiE 'Server Temp Key.*X25519'; then
        x25519="yes"
        ((score += 10))
    else
        ((score -= 20))
    fi

    # 证书信息
    local cert_info expiry_str exp_epoch now_epoch issuer subject
    cert_info=$(printf '%s\n' "$ssl_out" | openssl x509 -noout -enddate -issuer -subject 2>/dev/null)
    
    expiry_str=$(printf '%s\n' "$cert_info" | grep '^notAfter=' | cut -d= -f2-)
    issuer=$(printf '%s\n' "$cert_info" | grep '^issuer=' | cut -d= -f2- | sed 's/.*CN[ =]*//; s/,.*//')
    subject=$(printf '%s\n' "$cert_info" | grep '^subject=' | cut -d= -f2- | sed 's/.*CN[ =]*//; s/,.*//')
    
    if [[ -n "$issuer" && "$issuer" == "$subject" ]]; then
        is_self_signed="yes"
        ((score -= 50))
    fi

    if [[ -n "$expiry_str" ]]; then
        if [[ "$(uname)" == "Darwin" ]]; then
            exp_epoch=$(date -j -f "%b %d %T %Y %Z" "$expiry_str" +%s 2>/dev/null)
        else
            exp_epoch=$(date -d "$expiry_str" +%s 2>/dev/null)
        fi
        now_epoch=$(date +%s)
        if [[ -n "$exp_epoch" && "$exp_epoch" -gt 0 ]]; then
            cert_days=$(( (exp_epoch - now_epoch) / 86400 ))
            if (( cert_days > 30 )); then
                ((score += 5))
            elif (( cert_days < 7 )); then
                ((score -= 20))
            fi
        fi
    fi

    printf '%s\n' "${score}|${domain}|${region}|${ms}|${http_ver}|${http_code}|${redirect_flag}|OK||${tls13}|${x25519}|${cert_days}|${is_self_signed}" > "$outfile"
}

# ═══════════════════════════════════════════════════════════════════════
# 展示某地区检测结果（所有任务完成后调用）
# ═══════════════════════════════════════════════════════════════════════
display_region() {
    local region="$1"
    echo -e "\n${BOLD}┌─ ${region}${RESET}"

    # 超时域名
    local timeout_lines ok_lines
    ok_lines=$(cat "${WORK_DIR}"/r_*.txt 2>/dev/null \
        | awk -F'|' -v r="$region" '$3 == r && $1 != "-999"' \
        | sort -t'|' -k1 -nr)
    timeout_lines=$(cat "${WORK_DIR}"/r_*.txt 2>/dev/null \
        | awk -F'|' -v r="$region" '$3 == r && $1 == "-999"')

    while IFS='|' read -r score domain reg ms http_ver http_code redirect cdn_flag cdn_name tls13 x25519 cert_days is_self_signed; do
        [[ -z "$domain" ]] && continue
        printf "│  [分:%3s] %-30s " "$score" "$domain"

        if [[ "$ms" == "timeout" ]]; then
            echo -e "${DIM}⏱ 超时${RESET}"
            continue
        fi

        # 延迟 + 评级
        local emoji
        emoji=$(awk -v ms="$ms" 'BEGIN {
            if      (ms < 80)  printf "🟢"
            else if (ms < 150) printf "🟡"
            else if (ms < 300) printf "🟠"
            else               printf "🔴"
        }')
        printf "${BOLD}%6.1f ms${RESET} %s  " "$ms" "$emoji"

        # HTTP/2
        [[ "$http_ver" == "2" ]] && printf "${GREEN}H2${RESET} " || printf "${DIM}H1${RESET} "

        # TLS 1.3
        [[ "$tls13" == "yes" ]] && printf "${GREEN}TLS1.3✓${RESET} " || printf "${RED}TLS1.3✗${RESET} "

        # X25519
        if   [[ "$x25519" == "yes" ]];      then printf "${GREEN}X25519✓${RESET} "
        elif [[ "$cdn_flag" == "CDN" ]]; then printf "${DIM}X25519-${RESET} "
        else                                      printf "${YELLOW}X25519?${RESET} "
        fi

        # 证书有效期及自签
        if [[ "$is_self_signed" == "yes" ]]; then
            printf "${RED}自签证书${RESET}    "
        elif [[ "$cert_days" == "?" ]]; then
            printf "${DIM}cert:?${RESET}    "
        elif (( cert_days < 30 )); then
            printf "${RED}cert:${cert_days}d${RESET}  "
        elif (( cert_days < 90 )); then
            printf "${YELLOW}cert:${cert_days}d${RESET}  "
        else
            printf "${GREEN}cert:${cert_days}d${RESET}  "
        fi

        # 重定向
        [[ "$redirect" != "no" ]] && printf "${YELLOW}→${redirect#yes:} ${RESET}"

        # CDN
        [[ "$cdn_flag" == "CDN" ]] && printf "${RED}CDN:${cdn_name}${RESET}" || printf "${GREEN}✓自建${RESET}"

        echo ""
    done <<< "$(printf '%s\n%s\n' "$ok_lines" "$timeout_lines")"

    echo "│"
}

# ═══════════════════════════════════════════════════════════════════════
# 主流程
# ═══════════════════════════════════════════════════════════════════════
check_deps
print_header
select_regions

# 统计总域名数
total_count=0
for region in "${selected_regions[@]}"; do
    # 因为每个域名会被扩展为 2 个（裸域和 www），所以要乘 2
    for raw_domain in ${domains[$region]}; do (( total_count+=2 )); done
done

echo -e "  共 ${BOLD}${total_count}${RESET} 个域名，并发 ${BOLD}${MAX_JOBS}${RESET} 个"
echo -e "  ${DIM}预计耗时 ~$((total_count * (TIMEOUT + SSL_TIMEOUT) / MAX_JOBS / 2 + 10)) 秒${RESET}"
echo -e "  ${DIM}(CDN域名跳过 openssl，实际更快)${RESET}\n"

# 创建 semaphore FIFO（控制并发上限）
pool_fifo="${WORK_DIR}/pool.fifo"
mkfifo "$pool_fifo"
exec 9<>"$pool_fifo"
for (( i=0; i<MAX_JOBS; i++ )); do echo >&9; done

# 按地区顺序测试：区内并发，区间顺序显示
serial_idx=0
for region in "${selected_regions[@]}"; do
    echo -e "  ${CYAN}▶ 测试中: ${region}${RESET}"

    # 先收集该地区的所有去重测试域名（裸域 + www）
    declare -A region_test_domains=()
    for raw_domain in ${domains[$region]}; do
        bare="${raw_domain#www.}"
        region_test_domains["$bare"]=1
        region_test_domains["www.$bare"]=1
    done

    for domain in "${!region_test_domains[@]}"; do
        (( serial_idx++ ))
        read -u 9 _token                    # 获取并发 token（阻塞直到有空余）
        outfile="${WORK_DIR}/r_$(printf '%05d' ${serial_idx}).txt"
        (
            test_domain_full "$domain" "$region" "$outfile"
            echo >&9                        # 归还 token
        ) &
    done

    wait                                    # 等本地区所有任务完成
    echo -e "  ${GREEN}完成${RESET}"
    display_region "$region"               # 立即展示结果
done

exec 9>&-

# ═══════════════════════════════════════════════════════════════════════
# Top 10 排行榜
# 过滤: 非超时 + 非CDN + TLS1.3 + 非重定向
# ═══════════════════════════════════════════════════════════════════════
echo ""
echo -e "${BOLD}╔═══════════════════════════════════════════════════════════════════════╗${RESET}"
echo -e "${BOLD}║   🏆 最优 REALITY SNI 候选 (TLS1.3 ✓ + X25519 ✓ + 非CDN) Top 10  ║${RESET}"
echo -e "${BOLD}╚═══════════════════════════════════════════════════════════════════════╝${RESET}"

rank=1
while IFS='|' read -r score domain region ms http_ver http_code redirect cdn_flag cdn_name tls13 x25519 cert_days is_self_signed; do
    [[ -z "$domain" || "$ms" == "timeout" ]] && continue
    [[ "$cdn_flag" == "CDN"  ]]              && continue
    [[ "$tls13"    != "yes"  ]]              && continue
    [[ "$redirect" != "no"   ]]              && continue
    [[ "$rank" -gt 10 ]]                     && break

    # 构建附加标签
    local_h2=""
    [[ "$http_ver" == "2" ]] && local_h2="${GREEN}H2${RESET} " || local_h2="${DIM}H1${RESET} "
    local_x=""
    [[ "$x25519" == "yes" ]] && local_x="${GREEN}X25519✓${RESET} " || local_x="${YELLOW}X25519?${RESET} "
    local_cert=""
    if [[ "$cert_days" != "?" ]]; then
        (( cert_days < 30 )) && local_cert="${RED}cert:${cert_days}d${RESET}" \
                              || local_cert="${GREEN}cert:${cert_days}d${RESET}"
    fi

    printf "  ${BOLD}#%-2d${RESET}  [分:%3s] %-30s  ${BOLD}%6.1f ms${RESET}  " "$rank" "$score" "$domain" "$ms"
    printf "%b%b%b  ${DIM}[%s]${RESET}\n" "$local_h2" "$local_x" "$local_cert" "$region"
    (( rank++ ))
done < <(cat "${WORK_DIR}"/r_*.txt 2>/dev/null | sort -t'|' -k1 -nr)

if [[ "$rank" -eq 1 ]]; then
    echo -e "  ${YELLOW}无符合条件域名（可放宽TLS1.3要求或增大TIMEOUT）${RESET}"
fi

echo ""
echo -e "💡 ${BOLD}REALITY 伪装域名选择原则${RESET}"
echo "   ① 延迟 🟢<80ms 且 TLS1.3✓ + X25519✓ + H2  →  最优组合"
echo "   ② cert:<30d 证书即将过期，不建议长期作为 SNI"
echo "   ③ 有 →301/302 重定向的域名不适合做 REALITY 伪装"
echo "   ④ CDN 域名已从排行剔除（IP变动频繁，握手特征不稳定）"
echo "   ⑤ 大学(.edu/.ac)/政府(.gov/.go)/国企 类域名通常是自建机房"
echo ""