🛡️ Enhanced Management for Blocked IPs

# Check-BlockedIPs.ps1
$blockedIPs = @(
    "172.213.211.235",
    "4.213.160.187",
    "20.205.118.141",
    "4.197.176.207",
    "74.176.59.137"
)

$logPath = "C:\_amp\logs\apache\access.log"

Write-Host "`nChecking blocked IPs activity:" -ForegroundColor Yellow
Write-Host "="*50

foreach ($ip in $blockedIPs) {
    $hits = Select-String $ip $logPath | Select-Object -Last 5
    if ($hits) {
        $count = (Select-String $ip $logPath).Count
        $lastHit = $hits[-1].Line -split ' '
        Write-Host "$ip" -ForegroundColor Red
        Write-Host "  Total hits: $count"
        Write-Host "  Last seen: $($lastHit[3..4])"
        Write-Host "  Last request: $($lastHit[6])"
    } else {
        Write-Host "$ip - No recent activity" -ForegroundColor Green
    }
}

# Today's blocked attempts
Get-Content C:\_amp\logs\apache\access.log | 
    Where-Object {$_ -match "403"} | 
    Select-Object -Last 20 |
    ForEach-Object {
        $parts = $_ -split ' '
        "$($parts[0]) - $($parts[6]) - BLOCKED"
    }

# Escalate-ToFirewall.ps1
$blockedIPs = @(
    "172.213.211.235",
    "4.213.160.187", 
    "20.205.118.141",
    "4.197.176.207",
    "74.176.59.137"
)

foreach ($ip in $blockedIPs) {
    $ruleName = "Apache-Block-$ip"
    
    # Check if rule exists
    if (!(Get-NetFirewallRule -DisplayName $ruleName -ErrorAction SilentlyContinue)) {
        New-NetFirewallRule -DisplayName $ruleName `
            -Direction Inbound `
            -RemoteAddress $ip `
            -Action Block `
            -Description "Escalated from Apache blocks"
        
        Write-Host "Added firewall block for $ip" -ForegroundColor Green
    }
}

# Get-IPIntelligence.ps1
$ips = @(
    "172.213.211.235",
    "4.213.160.187",
    "20.205.118.141", 
    "4.197.176.207",
    "74.176.59.137"
)

Write-Host "`nIP Intelligence Report" -ForegroundColor Cyan
Write-Host "="*50

foreach ($ip in $ips) {
    Write-Host "`nChecking $ip..." -ForegroundColor Yellow
    
    # Use nslookup for reverse DNS
    $rdns = nslookup $ip 2>$null | Select-String "Name:" | ForEach-Object {$_ -replace "Name:\s+", ""}
    
    if ($rdns) {
        Write-Host "  Hostname: $rdns"
    } else {
        Write-Host "  Hostname: No PTR record"
    }
    
    # Check if it's a known cloud provider
    if ($ip -match "^20\.|^4\.") {
        Write-Host "  Note: Likely Microsoft Azure IP" -ForegroundColor Magenta
    }
    if ($ip -match "^172\.213\.") {
        Write-Host "  Note: Possibly Cloudflare range" -ForegroundColor Magenta
    }
}

# Daily-Security-Report.ps1
$date = Get-Date -Format "yyyy-MM-dd"
$reportPath = "C:\_amp\logs\apache\security-report-$date.txt"

# Get statistics
$totalRequests = (Get-Content C:\_amp\logs\apache\access.log | Measure-Object).Count
$blockedRequests = (Select-String " 403 " C:\_amp\logs\apache\access.log | Measure-Object).Count
$uniqueIPs = Get-Content C:\_amp\logs\apache\access.log | 
    ForEach-Object {($_ -split ' ')[0]} | 
    Sort-Object -Unique | 
    Measure-Object

# Generate report
@"
MediaFirm Security Report - $date
======================================
Total Requests: $totalRequests
Blocked Requests (403): $blockedRequests
Unique IPs: $($uniqueIPs.Count)
Block Rate: $([math]::Round(($blockedRequests/$totalRequests)*100, 2))%

Top 10 Blocked IPs Today:
$((Select-String " 403 " C:\_amp\logs\apache\access.log | 
    ForEach-Object {($_.Line -split ' ')[0]} | 
    Group-Object | 
    Sort-Object Count -Descending | 
    Select-Object -First 10 | 
    ForEach-Object {"  $($_.Name): $($_.Count) attempts"}) -join "`n")

Currently Blocked IPs in Apache:
$((Get-Content C:\_amp\run\apache\conf\blocked-ips.conf | 
    Where-Object {$_ -match "Require not ip"} | 
    ForEach-Object {"  $_"}) -join "`n")
"@ | Out-File $reportPath

Write-Host "Report saved to: $reportPath" -ForegroundColor Green

# Create scheduled task (run as administrator)
$action = New-ScheduledTaskAction -Execute "PowerShell.exe" `
    -Argument "-NoProfile -ExecutionPolicy Bypass -File C:\_amp\scripts\Daily-Security-Report.ps1"
$trigger = New-ScheduledTaskTrigger -Daily -At 11:59PM
Register-ScheduledTask -Action $action -Trigger $trigger `
    -TaskName "Apache Security Report" `
    -Description "Daily Apache security report generation"

# Find IPs with suspicious patterns not yet blocked
$blocked = Get-Content C:\_amp\run\apache\conf\blocked-ips.conf | 
    Where-Object {$_ -match 'Require not ip (\d+\.\d+\.\d+\.\d+)'} |
    ForEach-Object {$matches[1]}

$suspicious = Get-Content C:\_amp\logs\apache\access.log -Last 1000 |
    Where-Object {$_ -match "(wp-login|xmlrpc|\.env|phpmyadmin|/admin/|\.git|\.aws)"} |
    ForEach-Object {($_ -split ' ')[0]} |
    Group-Object |
    Where-Object {$_.Count -gt 10} |
    Select-Object -ExpandProperty Name |
    Where-Object {$_ -notin $blocked}

if ($suspicious) {
    Write-Host "`nNew IPs to consider blocking:" -ForegroundColor Yellow
    $suspicious | ForEach-Object {
        Write-Host "  Require not ip $_"
    }
}

# Apache-Monitor-Dashboard.ps1
Clear-Host
Write-Host "╔═══════════════════════════════════════════════╗" -ForegroundColor Cyan
Write-Host "║     Apache Security Monitoring Dashboard      ║" -ForegroundColor Cyan  
Write-Host "╚═══════════════════════════════════════════════╝" -ForegroundColor Cyan
Write-Host ""

# Current Status
$apacheRunning = Get-Service -Name "Apache*" -ErrorAction SilentlyContinue
if ($apacheRunning.Status -eq "Running") {
    Write-Host "[✓] Apache Status: RUNNING" -ForegroundColor Green
} else {
    Write-Host "[✗] Apache Status: STOPPED" -ForegroundColor Red
}

# Today's Stats
$today = Get-Date -Format "dd/MMM/yyyy"
$todayLogs = Get-Content C:\_amp\logs\apache\access.log | Where-Object {$_ -match $today}
$total = $todayLogs.Count
$blocked = ($todayLogs | Where-Object {$_ -match " 403 "}).Count

Write-Host ""
Write-Host "Today's Statistics ($today):" -ForegroundColor Yellow
Write-Host "  Total Requests: $total"
Write-Host "  Blocked (403): $blocked"
if ($total -gt 0) {
    Write-Host "  Block Rate: $([math]::Round(($blocked/$total)*100, 2))%"
}

# Recent Threats
Write-Host ""
Write-Host "Recent Suspicious Activity:" -ForegroundColor Yellow
$recent = Get-Content C:\_amp\logs\apache\access.log -Last 100 |
    Where-Object {$_ -match "(wp-login|xmlrpc|\.env|phpmyadmin)"} |
    Select-Object -Last 5

if ($recent) {
    $recent | ForEach-Object {
        $parts = $_ -split ' '
        Write-Host "  $($parts[0]) → $($parts[6])" -ForegroundColor Red
    }
} else {
    Write-Host "  No recent suspicious activity" -ForegroundColor Green
}

Write-Host ""
Write-Host "Press any key to refresh..." -ForegroundColor Gray