2603.9 frequesnt IPs added

includes/functions.php

@@ -198,6 +198,27 @@ function set_setting(string $key, string $value): void {
     $s->execute([$key, $value]);
 }
 
+// ── Frequent IPs ─────────────────────────────────────────────────────────────
+
+/**
+ * Return all IPs with a total connection count >= $min_connections, sorted
+ * highest-count first. Includes first and last seen timestamps.
+ */
+function frequent_ips(int $min_connections): array {
+    $s = db()->prepare(
+        'SELECT src_ip,
+                COUNT(*)     AS total_connections,
+                MIN(occurred_at) AS first_seen,
+                MAX(occurred_at) AS last_seen
+         FROM connections
+         GROUP BY src_ip
+         HAVING total_connections >= ?
+         ORDER BY total_connections DESC'
+    );
+    $s->execute([$min_connections]);
+    return $s->fetchAll();
+}
+
 // ── Purge ─────────────────────────────────────────────────────────────────────
 
 /**