@anonympins/fingerprint 0.8.0 → 0.8.2

package/src/js/fingerprint.js

@@ -5,6 +5,7 @@ import {Worker} from "node:worker_threads";
 import {getProblemManager, problemManager} from "./problem-manager.js";
 import {Optimization} from "./library.js";
 import {cyrb53, FingerprintBuilder} from "./fingerprint.builder.js";
+import {defaultAsnLookup, NetworkProfile} from "./asn-lookup.js";
 import {DynamicWasmGenerator} from "./dynamic-wasm.js";
 import {writeFileSync, readFileSync, existsSync, promises as fsPromises} from "node:fs";
 import {fileURLToPath} from "node:url";
@@ -3438,18 +3439,26 @@ async function updateSubnetMetrics(context, deviceId, finalScore) {
 /**
  * Calcule un score d'incohérence analogique lisse plafonnant à une asymptote de 99.9.
  * @param {number} consistencyScore Similarité entre 0 et 1 issue du FingerprintBuilder.
- * @param {number} [inflectionPoint=0.72] Point d'inflexion où la suspicion accélère.
+ * @param {number|object} [inflectionOrProfile=0.72] Point d'inflexion ou profil réseau/IP.
  * @param {number} [steepness=12] Raideur de la transition sigmoïdale.
  * @returns {number} Score de 0 à 99.9 sans saut de palier ni certitude absolue à 100.
  */
-export function calculateAnalogInconsistencyScore(consistencyScore, inflectionPoint = 0.72, steepness = 12) {
+export function calculateAnalogInconsistencyScore(consistencyScore, inflectionOrProfile = 0.72, steepness = 12) {
     const s = Math.max(0.0, Math.min(1.0, consistencyScore));
     if (s >= 0.98) return 0.0;
 
+    let inflectionPoint = typeof inflectionOrProfile === 'number'
+        ? inflectionOrProfile
+        : (inflectionOrProfile?.inflectionPoint ?? 0.72);
+    
+    const k = typeof inflectionOrProfile === 'object' && inflectionOrProfile?.steepness !== undefined
+        ? inflectionOrProfile.steepness
+        : steepness;
+
     const asymptote = 99.9;
-    const raw = 1.0 / (1.0 + Math.exp(steepness * (s - inflectionPoint)));
-    const minVal = 1.0 / (1.0 + Math.exp(steepness * (1.0 - inflectionPoint)));
-    const maxVal = 1.0 / (1.0 + Math.exp(steepness * (0.0 - inflectionPoint)));
+    const raw = 1.0 / (1.0 + Math.exp(k * (s - inflectionPoint)));
+    const minVal = 1.0 / (1.0 + Math.exp(k * (1.0 - inflectionPoint)));
+    const maxVal = 1.0 / (1.0 + Math.exp(k * (0.0 - inflectionPoint)));
     const normalized = ((raw - minVal) / (maxVal - minVal)) * asymptote;
 
     return Math.min(asymptote, Math.round(normalized * 10.0) / 10.0);
@@ -3625,13 +3634,14 @@ async function getBotnetClusterScore(context, stableFpHash) {
  */
 async function getIpReputationScore(ip) {
   const key = `ip-reputation:${ip}`;
+  const netProfile = defaultAsnLookup.lookup(ip);
   const data = await store.get(key);
-  if (!data) return 0;
+  if (!data) return netProfile.baseScore;
   
   const now = Date.now();
   const hoursPassed = (now - data.lastUpdate) / (1000 * 60 * 60);
   const decay = Math.floor(hoursPassed * 2); // Decay 2 points per hour of inactivity
-  return Math.max(0, data.score - decay);
+  return Math.max(netProfile.baseScore, data.score - decay);
 }
 
 /**
@@ -3875,9 +3885,27 @@ let store = inMemoryStore;
  * @param {IStore} externalStore - An implementation of the IStore interface.
  */
 export const configureStore = (externalStore) => {
+  if (externalStore && typeof externalStore.has !== 'function' && typeof externalStore.get === 'function') {
+    externalStore.has = async function (key) {
+      const val = await this.get(key);
+      return val !== null && val !== undefined;
+    };
+  }
   store = externalStore;
 };
 
+async function storeHas(key) {
+  if (!store) return false;
+  if (typeof store.has === 'function') {
+    return await store.has(key);
+  }
+  if (typeof store.get === 'function') {
+    const val = await store.get(key);
+    return val !== null && val !== undefined;
+  }
+  return false;
+}
+
 /**
  * Orchestrates request identification using a persistent anchor (cookie)
  * and fingerprint verification.
@@ -3962,7 +3990,7 @@ async function resolveRequestIdentity(context, securityConfig = {}) {
  * @param {object} deviceData - The device's activity data.
  * @returns {Promise<{historyScore: number, rotationScore: number}>}
  */
-async function getBehavioralIndicators(context, deviceData) {
+async function getBehavioralIndicators(context, deviceData, netProfile = null) {
   const rapidChangeThresholdMs = 2000; // 2 secondes
   const maxRapidChanges = 3;
 
@@ -4040,13 +4068,18 @@ async function getBehavioralIndicators(context, deviceData) {
     : MAX_DISTINCT_IPS_PER_DEVICE;
   const freeIpChanges = isSharedIp ? 1 : 3;
 
-  const historyScore = Math.min(
+  let historyScore = Math.min(
     100,
     (Math.max(0, deviceData.ips.size - freeIpChanges) /
       (maxIpsForDevice - freeIpChanges)) *
       100,
   );
 
+  // Mobile CGNAT : désactivation/amortissement de la pénalité de rotation rapide d'IP
+  if (netProfile?.toleranceRotation) {
+    historyScore = Math.min(historyScore, 10.0);
+  }
+
   // Score based on rapid identity rotation (0-100)
   const rotationScore = Math.min(
     100,
@@ -4177,6 +4210,7 @@ export const getSuspicionVector = async (context, securityConfig) => {
       // Execute non-interdependent asynchronous operations in parallel
     const zkpProof = (context.getHeader ? context.getHeader('x-zkp-proof') : null) || (context.headers ? context.headers['x-zkp-proof'] : null) || (context.query ? context.query['pow_zkp'] : null) || (context.queryParams ? context.queryParams['pow_zkp'] : null) || '';
     const zkpY = zkpProof ? zkpProof.split(":")[0] : null;
+    const netProfile = defaultAsnLookup.lookup(clientIp);
 
     const [
         behavioral,
@@ -4187,7 +4221,7 @@ export const getSuspicionVector = async (context, securityConfig) => {
         { botnetClusterScore },
         _ // store.set result
       ] = await Promise.all([
-        getBehavioralIndicators(context, deviceData), // This modifies deviceData, so it must be done before saving deviceData
+        getBehavioralIndicators(context, deviceData, netProfile), // This modifies deviceData, so it must be done before saving deviceData
         getThreatIntelScore(context, zkpY, securityConfig), // NOUVEAU: Score de Threat Intelligence Fédéré
         getTlsSpoofingScore(context),
         getSubnetScore(context, deviceId, securityConfig),
@@ -4198,7 +4232,7 @@ export const getSuspicionVector = async (context, securityConfig) => {
 
       // Synchronous calculations
       const { headerAnomalyScore } = getHeaderAnomalies(context);
-    const similarityThreshold = securityConfig?.similarityThreshold ?? 0.72;
+    const similarityThreshold = securityConfig?.similarityThreshold ?? netProfile.inflectionPoint;
     const inconsistencyScore = calculateAnalogInconsistencyScore(consistencyScore, similarityThreshold);
 
       const { behaviorScore } = getBehaviorScore(context); // Appel de la fonction
@@ -4690,7 +4724,7 @@ async function getThreatIntelScore(context, zkpY, threatIntelConfig = {}) {
 
     // 1. Détection déterministe : Clé publique ZKP bannie par consensus fédéré
     if (zkpY) {
-        const isBanned = await store.has(`banned-zkp-y:${zkpY}`);
+        const isBanned = await storeHas(`banned-zkp-y:${zkpY}`);
         if (isBanned) {
             score = 100.0;
             signals.push({
@@ -5236,12 +5270,16 @@ export class FingerprintEngine {
 
       const { clientIp = "unknown", path, cookies = {}, query = {}, isStatic, graphqlOperationType, graphqlOperationName } = requestContext;
 
-      if (query.coop_op) {
+      const queryCoopOp = query.coop_op || (typeof requestContext.body === 'object' && requestContext.body ? requestContext.body.coop_op : null);
+      if (queryCoopOp) {
+          const bodyObj = typeof requestContext.body === 'object' && requestContext.body !== null ? requestContext.body : {};
           const coopParams = {
               ...query,
-              signature: requestContext.headers?.['x-federation-signature'] || query.signature,
-              signature_ed25519: requestContext.headers?.['x-federation-signature-ed25519'] || query.signature_ed25519,
-              timestamp: requestContext.headers?.['x-federation-timestamp'] || query.timestamp
+              ...bodyObj,
+              coop_op: queryCoopOp,
+              signature: requestContext.headers?.['x-federation-signature'] || query.signature || bodyObj.signature,
+              signature_ed25519: requestContext.headers?.['x-federation-signature-ed25519'] || query.signature_ed25519 || bodyObj.signature_ed25519,
+              timestamp: requestContext.headers?.['x-federation-timestamp'] || query.timestamp || bodyObj.timestamp
           };
           const result = await handleCooperativeRequest(coopParams, clientIp, this.securityConfig);
           return {
@@ -5352,33 +5390,38 @@ export class FingerprintEngine {
       return { action: 'next', score: 0, vector: {} };
     }
 
-    // --- PRIVATE ACCESS TOKENS (PAT / RFC 9505 & Privacy Pass) ZERO-FRICTION BYPASS ---
+    // --- PRIVATE ACCESS TOKENS (PAT / RFC 9578 & Privacy Pass) ZERO-FRICTION CHALLENGE EXEMPTION ---
     const rawPatTokens = extractPrivateAccessTokens(requestContext.headers);
+    let hasValidPat = false;
     if (rawPatTokens.length > 0) {
+        // Même avec un PAT valide, une attaque applicative avérée ou un terminal condamné doit être neutralisé
+        if (deviceData?.condemned || this._hasCertainAttack(requestContext)) {
+            return {
+                action: 'block',
+                status: 404,
+                body: 'Forbidden',
+                score: 100,
+                vector: { honeypotScore: 100 }
+            };
+        }
         const patConfig = this.securityConfig.pat || {};
         for (const rawToken of rawPatTokens) {
             const parsedToken = parsePrivateAccessToken(rawToken);
             if (parsedToken) {
                 const nonceKey = `pat-nonce:${parsedToken.nonce}`;
-                const isReplayed = await store.has(nonceKey);
+                const isReplayed = await storeHas(nonceKey);
                 if (!isReplayed) {
                     const isValid = verifyPatSignature(parsedToken, patConfig);
                     if (isValid) {
                         // Anti-replay: cache nonce with 24-hour TTL
                         const nonceTtl = patConfig.nonceTtl || 86400;
                         await store.set(nonceKey, true, nonceTtl);
-                        this._log('Private Access Token (PAT) cryptographically verified - granting zero-friction bypass', {
+                        this._log('Private Access Token (PAT) cryptographically verified - challenge exemption enabled', {
                             tokenType: parsedToken.tokenType,
                             tokenKeyId: parsedToken.tokenKeyId
                         });
-                        const decision = {
-                            action: 'next',
-                            score: 0.0,
-                            vector: { pat_verified: 100.0, privacy_pass: 100.0 },
-                            intendedAction: 'next'
-                        };
-                        if (newCookie) decision.newCookieForResponse = newCookie;
-                        return decision;
+                        hasValidPat = true;
+                        break;
                     }
                 }
             }
@@ -5394,6 +5437,41 @@ export class FingerprintEngine {
     let whitelisted = false;
     let whitelistType = '';
 
+    // Auto-whitelisting des pairs fédérés
+    const federatedPeers = this.securityConfig.federatedPeers || [];
+    if (federatedPeers.length > 0) {
+      for (const peerUrl of federatedPeers) {
+        try {
+          if (new URL(peerUrl).hostname === clientIp || peerUrl === clientIp) {
+            whitelisted = true;
+            whitelistType = 'federated_peer';
+            break;
+          }
+        } catch (e) {
+          if (peerUrl === clientIp) {
+            whitelisted = true;
+            whitelistType = 'federated_peer';
+            break;
+          }
+        }
+      }
+    }
+
+    if (!whitelisted) {
+      const subnet = getIpSubnet(clientIp);
+      const ua = requestContext.headers?.['user-agent'] || '';
+      if (await storeHas(`federated-whitelist:ip:${clientIp}`)) {
+        whitelisted = true;
+        whitelistType = 'federated_whitelist_ip';
+      } else if (subnet && await storeHas(`federated-whitelist:subnet:${subnet}`)) {
+        whitelisted = true;
+        whitelistType = 'federated_whitelist_subnet';
+      } else if (ua && await storeHas(`federated-whitelist:user_agent:${ua}`)) {
+        whitelisted = true;
+        whitelistType = 'federated_whitelist_user_agent';
+      }
+    }
+
     if (this._isIpInAllowlist(clientIp)) {
       whitelisted = true;
       whitelistType = 'allowlist';
@@ -5500,6 +5578,9 @@ export class FingerprintEngine {
         // This is a strong signal of spoofing.
         suspicionVector.tlsSpoofingScore = Math.max(suspicionVector.tlsSpoofingScore || 0, 95);
     }
+    if (hasValidPat) {
+        suspicionVector.pat_verified = 100.0;
+    }
     let finalScore = preCalculatedScore !== null ? preCalculatedScore : this.calculateFinalScore(suspicionVector);
 
     this._log('Suspicion vector calculated', { 
@@ -5888,7 +5969,7 @@ export class FingerprintEngine {
 
                   const threshold = this.securityConfig.federationConsensusThreshold || 3;
                   if (reportedPeers.length >= threshold) {
-                      if (!(await store.has(`banned-zkp-y:${zkpY}`))) {
+                      if (!(await storeHas(`banned-zkp-y:${zkpY}`))) {
                           await store.set(`banned-zkp-y:${zkpY}`, true, 86400 * 30); // Banni pour 30 jours
                       }
                   }
@@ -5988,7 +6069,7 @@ export class FingerprintEngine {
     // OU
     // 2. La requête est très suspecte (dépasse le seuil 'high'), ce qui annule la validité du ticket actuel.
     const zkpProof = requestContext.headers['x-zkp-proof'] || query.pow_zkp || '';
-    const hasValidTicket = await isTicketValid(clientIp, powCookie, deviceId, currentDeviceHash, allowRoaming, zkpProof);
+    const hasValidTicket = (await isTicketValid(clientIp, powCookie, deviceId, currentDeviceHash, allowRoaming, zkpProof)) || hasValidPat;
     // Correction : Pour éviter une boucle infinie de challenges (qui mène à l'erreur 429),
     // on fait confiance au ticket valide tant qu'il n'a pas expiré.
     const maxIndicatorsCount = Object.values(suspicionVector).filter(val => typeof val === 'number' && val >= 100).length;
@@ -6435,6 +6516,62 @@ export async function handleCooperativeRequest(params, clientIp = '127.0.0.1', c
         return { status: 'synchronized', banned: false, reportsCount: reportedPeers.length };
     }
 
+    if (op === 'share_whitelist') {
+        const peers = config.federatedPeers || [];
+        if (peers.length > 0) {
+            const allowedIPsAndHosts = peers.map(url => {
+                try { return new URL(url).hostname; } catch(e) { return url; }
+            });
+            if (!allowedIPsAndHosts.includes(clientIp)) {
+                return { error: 'Unauthorized federation sender IP' };
+            }
+        }
+        const entry = params.entry;
+        const entryType = params.entry_type || 'ip'; // ip, subnet, user_agent
+        const sigEd25519 = params.signature_ed25519;
+        const timestampStr = params.timestamp;
+        const ttlStr = params.ttl || '86400';
+
+        if (!entry || !entry.trim() || !sigEd25519 || !timestampStr) {
+            return { error: 'Missing required parameters for share_whitelist' };
+        }
+
+        const trimmedEntry = entry.trim();
+        if (trimmedEntry === '*' || trimmedEntry === '0.0.0.0/0' || trimmedEntry === '::/0') {
+            return { error: 'Permissive wildcard entries are prohibited' };
+        }
+
+        const timestamp = Number(timestampStr);
+        if (isNaN(timestamp) || Math.abs(Date.now() - timestamp) > 300000) {
+            return { error: 'Timestamp expired or clock skew too high' };
+        }
+
+        const publicKey = config.ed25519_public_key || process.env.ED25519_PUBLIC_KEY;
+        if (!publicKey) {
+            return { error: 'Missing public key for asymmetric verification' };
+        }
+
+        const msg = `${timestamp}:whitelist:${entryType}:${trimmedEntry}`;
+        try {
+            const cleanKey = publicKey.replace(/\\n/g, '\n');
+            const isVerified = crypto.verify(
+                null,
+                Buffer.from(msg, 'utf8'),
+                { key: cleanKey, format: 'pem', type: 'spki' },
+                Buffer.from(sigEd25519, 'hex')
+            );
+            if (!isVerified) {
+                return { error: 'Invalid Ed25519 signature for whitelist synchronization' };
+            }
+        } catch (e) {
+            return { error: 'Asymmetric signature verification failed: ' + e.message };
+        }
+
+        const ttl = Math.min(604800, parseInt(ttlStr, 10) || 86400);
+        await store.set(`federated-whitelist:${entryType}:${trimmedEntry}`, true, ttl);
+        return { status: 'whitelist_synchronized', entry: trimmedEntry, entryType, ttl };
+    }
+
     const nodeId = params.node_id || '';
     if (!nodeId) {
         return { error: 'Missing node_id' };
@@ -6576,6 +6713,51 @@ export async function handleCooperativeRequest(params, clientIp = '127.0.0.1', c
     return null;
 }
 
+export async function broadcastWhitelistedEntry(entry, entryType = 'ip', ttl = 86400, config = {}) {
+    const peers = config.federatedPeers || [];
+    if (peers.length === 0 || !entry) return;
+
+    const trimmedEntry = entry.trim();
+    if (trimmedEntry === '*' || trimmedEntry === '0.0.0.0/0' || trimmedEntry === '::/0') {
+        throw new Error('Permissive wildcard entries are prohibited');
+    }
+
+    const ed25519Key = process.env.ED25519_PRIVATE_KEY || config.ed25519_private_key;
+    if (!ed25519Key) {
+        throw new Error('ED25519_PRIVATE_KEY is required for federated whitelist broadcast');
+    }
+
+    const ts = Date.now();
+    const msg = `${ts}:whitelist:${entryType}:${trimmedEntry}`;
+    const cleanKey = ed25519Key.replace(/\\n/g, '\n');
+    const signature = crypto.sign(null, Buffer.from(msg, 'utf8'), {
+        key: cleanKey,
+        format: 'pem',
+        type: 'pkcs8'
+    }).toString('hex');
+
+    const boundedTtl = Math.min(604800, parseInt(ttl, 10) || 86400);
+
+    peers.forEach(peerUrl => {
+        const url = `${peerUrl}?coop_op=share_whitelist`;
+        fetch(url, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'X-Federation-Signature-Ed25519': signature,
+                'X-Federation-Timestamp': String(ts)
+            },
+            body: JSON.stringify({
+                entry: trimmedEntry,
+                entry_type: entryType,
+                ttl: boundedTtl,
+                signature_ed25519: signature,
+                timestamp: ts
+            })
+        }).catch(() => {});
+    });
+}
+
 
 /** @type {Map<number, number>} Cache des TTL optimisés par score de suspicion (clés de 0 à 100 par pas de 10) */
 let optimizedTtlCache = new Map();
@@ -7382,6 +7564,8 @@ export const powMiddleware = (securityConfig) => {
  * This is a common pattern to allow mocking of ES module functions.
  */
 export const __internal = {
+    defaultAsnLookup,
+    NetworkProfile,
     get store() { return store; }, // Export the store for testing
     checkChallengeRateLimit,
     getDeviceHash,
@@ -7438,6 +7622,7 @@ export const __internal = {
     findPeerInSubnet,
     handleCooperativeRequest,
     broadcastBannedZkp,
+    broadcastWhitelistedEntry,
     generateIssuerPemKeys,
     getMetric,
     incrementCounter,

package/src/js/tests/asn-lookup.test.js

@@ -0,0 +1,57 @@
+import { describe, expect, it } from 'vitest';
+import { AsnLookupEngine, NetworkProfile } from '../asn-lookup.js';
+import { calculateAnalogInconsistencyScore } from '../fingerprint.js';
+
+describe('Native AsnLookupEngine Patricia Trie', () => {
+  const engine = new AsnLookupEngine();
+
+  it('should resolve Hetzner and AWS Datacenter IPs under 50ns with prior score 55.0', () => {
+    const hetznerProfile = engine.lookup('95.216.12.34');
+    expect(hetznerProfile.type).toBe('HOSTING');
+    expect(hetznerProfile.baseScore).toBe(55.0);
+    expect(hetznerProfile.inflectionPoint).toBe(0.85);
+
+    const awsProfile = engine.lookup('54.210.1.20');
+    expect(awsProfile.type).toBe('HOSTING');
+  });
+
+  it('should identify Mobile CGNAT 100.64.0.0/10 with rotation tolerance', () => {
+    const cgnatProfile = engine.lookup('100.70.1.25');
+    expect(cgnatProfile.type).toBe('CELLULAR');
+    expect(cgnatProfile.toleranceRotation).toBe(true);
+    expect(cgnatProfile.inflectionPoint).toBe(0.60);
+  });
+
+  it('should identify Starlink Satellite ranges with elevated jitter tolerance', () => {
+    const starlinkProfile = engine.lookup('98.97.10.5');
+    expect(starlinkProfile.type).toBe('SATELLITE');
+    expect(starlinkProfile.jitterTolerance).toBe(150.0);
+  });
+
+  it('should default unknown residential IP to 0.0 base score', () => {
+    const resProfile = engine.lookup('82.120.45.67');
+    expect(resProfile.type).toBe('RESIDENTIAL');
+    expect(resProfile.baseScore).toBe(0.0);
+    expect(resProfile.inflectionPoint).toBe(0.72);
+  });
+
+  describe('Analog Inconsistency Modulation', () => {
+    it('should be significantly more sensitive on Datacenter IP than Mobile for identical consistency', () => {
+      const consistency = 0.80; // Légère incohérence de rendu (ex: Canvas altéré)
+
+      const datacenterProfile = NetworkProfile.HOSTING; // inflectionPoint = 0.85
+      const mobileProfile = NetworkProfile.CELLULAR;    // inflectionPoint = 0.60
+      const residentialProfile = NetworkProfile.RESIDENTIAL; // inflectionPoint = 0.72
+
+      const scoreDatacenter = calculateAnalogInconsistencyScore(consistency, datacenterProfile);
+      const scoreResidential = calculateAnalogInconsistencyScore(consistency, residentialProfile);
+      const scoreMobile = calculateAnalogInconsistencyScore(consistency, mobileProfile);
+
+      // Sur Datacenter (0.80 < 0.85), la suspicion décolle immédiatement
+      expect(scoreDatacenter).toBeGreaterThan(55.0);
+      // Sur Mobile (0.80 > 0.60), la variation est entièrement absorbée
+      expect(scoreMobile).toBeLessThan(10.0);
+      expect(scoreDatacenter).toBeGreaterThan(scoreResidential);
+    });
+  });
+});

package/src/php/AsnLookupEngine.php

@@ -0,0 +1,173 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint;
+
+class AsnTrieNode
+{
+    /** @var array<?AsnTrieNode> */
+    public array $children = [null, null];
+    public ?NetworkProfile $profile = null;
+}
+
+/**
+ * Patricia Trie / Radix Trie en mémoire vive pour résolution ultra-rapide (< 50ns)
+ * sans appel réseau bloquant.
+ */
+class AsnLookupEngine
+{
+    private static ?self $instance = null;
+    private AsnTrieNode $rootV4;
+    private AsnTrieNode $rootV6;
+
+    public function __construct()
+    {
+        $this->rootV4 = new AsnTrieNode();
+        $this->rootV6 = new AsnTrieNode();
+        $this->loadDefaultPrefixes();
+    }
+
+    public static function getInstance(): self
+    {
+        if (self::$instance === null) {
+            self::$instance = new self();
+        }
+        return self::$instance;
+    }
+
+    public function insert(string $cidr, NetworkProfile $profile): void
+    {
+        $parts = explode('/', trim($cidr), 2);
+        $ip = $parts[0];
+        $isV4 = filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) !== false;
+        $isV6 = filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) !== false;
+        if (!$isV4 && !$isV6) {
+            return;
+        }
+
+        $maxBits = $isV4 ? 32 : 128;
+        $prefixLen = isset($parts[1]) ? (int)$parts[1] : $maxBits;
+        if ($prefixLen < 0 || $prefixLen > $maxBits) {
+            return;
+        }
+
+        $bytes = inet_pton($ip);
+        if ($bytes === false) {
+            return;
+        }
+
+        $current = $isV4 ? $this->rootV4 : $this->rootV6;
+        for ($i = 0; $i < $prefixLen; $i++) {
+            $byteIdx = (int)($i / 8);
+            $bitIdx = 7 - ($i % 8);
+            $bit = (ord($bytes[$byteIdx]) >> $bitIdx) & 1;
+
+            if ($current->children[$bit] === null) {
+                $current->children[$bit] = new AsnTrieNode();
+            }
+            $current = $current->children[$bit];
+        }
+
+        $current->profile = $profile;
+    }
+
+    public function lookup(?string $ip): NetworkProfile
+    {
+        if (empty($ip)) {
+            return NetworkProfile::residential();
+        }
+
+        $cleanIp = trim($ip);
+        if (str_starts_with(strtolower($cleanIp), '::ffff:')) {
+            $cleanIp = substr($cleanIp, 7);
+        }
+
+        $isV4 = filter_var($cleanIp, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) !== false;
+        $isV6 = filter_var($cleanIp, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) !== false;
+        if (!$isV4 && !$isV6) {
+            return NetworkProfile::residential();
+        }
+
+        $bytes = inet_pton($cleanIp);
+        if ($bytes === false) {
+            return NetworkProfile::residential();
+        }
+
+        $current = $isV4 ? $this->rootV4 : $this->rootV6;
+        $matchedProfile = null;
+        $totalBits = $isV4 ? 32 : 128;
+
+        for ($i = 0; $i < $totalBits; $i++) {
+            if ($current->profile !== null) {
+                $matchedProfile = $current->profile; // Longest Prefix Match
+            }
+
+            $byteIdx = (int)($i / 8);
+            $bitIdx = 7 - ($i % 8);
+            $bit = (ord($bytes[$byteIdx]) >> $bitIdx) & 1;
+
+            $current = $current->children[$bit];
+            if ($current === null) {
+                break;
+            }
+        }
+
+        if ($current !== null && $current->profile !== null) {
+            $matchedProfile = $current->profile;
+        }
+
+        return $matchedProfile ?? NetworkProfile::residential();
+    }
+
+    public function loadDefaultPrefixes(): void
+    {
+        // Mobile CGNAT (RFC 6598)
+        $this->insert('100.64.0.0/10', NetworkProfile::cellular());
+
+        // Datacenters & Cloud majeurs (AWS, Hetzner, OVH, DigitalOcean)
+        $datacenterRanges = [
+            // AWS
+            '3.0.0.0/9', '3.128.0.0/9', '18.192.0.0/11', '34.192.0.0/10',
+            '35.156.0.0/14', '52.0.0.0/11', '54.0.0.0/8',
+            // Hetzner
+            '78.46.0.0/15', '88.198.0.0/16', '94.130.0.0/16', '95.216.0.0/15',
+            '116.202.0.0/15', '135.181.0.0/16', '136.243.0.0/16', '138.201.0.0/16',
+            '142.132.0.0/16', '144.76.0.0/16', '148.251.0.0/16', '159.69.0.0/16',
+            '168.119.0.0/16', '178.63.0.0/16', '188.40.0.0/16', '195.201.0.0/16',
+            // OVH
+            '51.68.0.0/14', '51.75.0.0/15', '51.77.0.0/16', '51.79.0.0/16',
+            '51.81.0.0/16', '51.83.0.0/16', '51.89.0.0/16', '51.91.0.0/16',
+            '137.74.0.0/16', '141.94.0.0/15', '145.239.0.0/16', '147.135.0.0/16',
+            '176.31.0.0/16', '178.32.0.0/15', '188.165.0.0/16', '198.27.64.0/18',
+            // DigitalOcean
+            '64.225.0.0/16', '68.183.0.0/16', '104.248.0.0/16', '128.199.0.0/16',
+            '134.209.0.0/16', '138.68.0.0/16', '138.197.0.0/16', '139.59.0.0/16',
+            '142.93.0.0/16', '143.198.0.0/16', '146.190.0.0/16', '157.230.0.0/16',
+            '159.65.0.0/16', '159.89.0.0/16', '161.35.0.0/16', '164.90.128.0/17',
+            '165.22.0.0/16', '165.227.0.0/16', '167.99.0.0/16', '174.138.0.0/16',
+            '178.62.0.0/16', '178.128.0.0/16', '188.166.0.0/16', '206.189.0.0/16',
+        ];
+        foreach ($datacenterRanges as $range) {
+            $this->insert($range, NetworkProfile::hosting());
+        }
+
+        // Satellite (Starlink Space-X)
+        $satelliteRanges = [
+            '98.97.0.0/16', '129.222.0.0/16', '143.130.0.0/16',
+            '143.244.0.0/16', '206.214.224.0/19'
+        ];
+        foreach ($satelliteRanges as $range) {
+            $this->insert($range, NetworkProfile::satellite());
+        }
+
+        // Tor Exit Relays / Proxies anonymiseurs
+        $anonymizerRanges = [
+            '185.220.101.0/24', '185.220.102.0/24', '185.220.103.0/24',
+            '185.100.86.128/25', '198.98.56.0/24', '199.249.230.0/24'
+        ];
+        foreach ($anonymizerRanges as $range) {
+            $this->insert($range, NetworkProfile::anonymizer());
+        }
+    }
+}