<?php
// Global Bot Blocker - Blocks bots across the entire project

// Start session if not already started
if (session_status() === PHP_SESSION_NONE) {
    session_start();
}

// Get visitor information
$ip = $_SERVER['REMOTE_ADDR'] ?? '';
$user_agent = $_SERVER['HTTP_USER_AGENT'] ?? '';
$hostname = gethostbyaddr($ip);

// Enhanced bot detection patterns
$bot_signatures = array(
    // Common bot identifiers
    'bot', 'crawler', 'spider', 'scraper', 'curl', 'wget', 'python', 'java',
    'libwww', 'perl', 'go-http-client', 'node', 'axios', 'postman', 'insomnia',
    'facebookexternalhit', 'twitterbot', 'linkedinbot', 'slackbot',
    'googlebot', 'bingbot', 'yandexbot', 'baiduspider', 'ahrefsbot',
    'semrushbot', 'dotbot', 'mj12bot', 'petalbot', 'zoominfobot',
    'bytespider', 'dataforseobot', 'serpstatbot', 'seznambot',
    'exabot', 'sogou', 'duckduckgo', 'archive.org_bot',
    
    // Additional bot identifiers
    'scan', 'monitor', 'checker', 'analyzer', 'harvester', 'collector',
    'extractor', 'grabber', 'ripper', 'sucker', 'sniffer', 'spyder',
    'fetcher', 'resolver', 'validator', 'verifier', 'tester', 'debugger'
);

// Suspicious user agent patterns
$suspicious_patterns = array(
    '/^$/', // Empty user agent
    '/^[a-z0-9]{10,}$/', // Very long random string
    '/(libwww|libcurl|php|zend|perl|python|java|ruby|node)/i',
    '/(winhttp|httpclient|mechanize|selenium|webdriver|puppeteer)/i',
    '/(scrapy|requests|urllib|httrack|webcopier|teleport|offline|download)/i'
);

// Known bad IP ranges/patterns
$bad_ip_patterns = array(
    '/^192\.168\./', // Private network
    '/^10\./', // Private network
    '/^172\.(1[6-9]|2[0-9]|3[01])\./', // Private network
    '/^127\./', // Loopback
    '/^0\./', // Invalid
    '/^255\./' // Broadcast
);

// Blocked hostnames
$blocked_hostnames = array(
    'amazonaws', 'softlayer', 'linode', 'digitalocean', 'cloud', 'server',
    'hosting', 'datacenter', 'proxy', 'tor', 'vpn', 'anonymous'
);

// Check for bot signatures in user agent
foreach($bot_signatures as $signature) {
    if(stripos($user_agent, $signature) !== false) {
        block_visitor("Bot signature detected: $signature");
        exit();
    }
}

// Check for suspicious patterns
foreach($suspicious_patterns as $pattern) {
    if(preg_match($pattern, $user_agent)) {
        block_visitor("Suspicious user agent pattern detected: $user_agent");
        exit();
    }
}

// Check for bad IP patterns
foreach($bad_ip_patterns as $pattern) {
    if(preg_match($pattern, $ip)) {
        block_visitor("Bad IP pattern detected: $ip");
        exit();
    }
}

// Check hostname for blocked patterns
foreach($blocked_hostnames as $pattern) {
    if(stripos($hostname, $pattern) !== false) {
        block_visitor("Blocked hostname pattern detected: $hostname");
        exit();
    }
}

// Check for missing headers that legitimate browsers usually send
$required_headers = array('HTTP_ACCEPT', 'HTTP_ACCEPT_LANGUAGE');
foreach($required_headers as $header) {
    if(!isset($_SERVER[$header])) {
        block_visitor("Missing required header: $header");
        exit();
    }
}

// Function to block visitor
function block_visitor($reason = '') {
    // Log the blocked attempt
    $log_entry = date('Y-m-d H:i:s') . " - BLOCKED: $reason - IP: " . ($_SERVER['REMOTE_ADDR'] ?? 'Unknown') . " - UA: " . ($_SERVER['HTTP_USER_AGENT'] ?? 'None') . "\n";
    file_put_contents(__DIR__ . '/blocked_visitors.log', $log_entry, FILE_APPEND | LOCK_EX);
    
    // Send 404 response
    header('HTTP/1.0 404 Not Found');
    exit();
}

?>