From d35b69d87c54d4b3ba8184664240fa744216b142 Mon Sep 17 00:00:00 2001 From: lolcat Date: Sat, 15 Aug 2026 22:44:06 -0400 Subject: [PATCH] remove outdated crime lists, add firehol_abusers_30d, use tor_exits instead of dm_tor --- README.md | 9 ++++++--- mmdb.php | 7 +++---- 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index da27508..60ee0bc 100644 --- a/README.md +++ b/README.md @@ -21,6 +21,7 @@ print_r($cf_lookup); // ["is_hosting" => true] ## Proxy detection ([firehol](https://iplists.firehol.org/)) - [firehol_anonymous](https://iplists.firehol.org/?ipset=firehol_anonymous) +- [firehol_abusers_30d](https://iplists.firehol.org/?ipset=firehol_abusers_30d) - [spamhaus_drop](https://iplists.firehol.org/?ipset=spamhaus_drop) - [dshield_30d](https://iplists.firehol.org/?ipset=dshield_30d) - [greensnow](https://iplists.firehol.org/?ipset=greensnow) @@ -31,8 +32,10 @@ print_r($cf_lookup); // ["is_hosting" => true] - [vxvault](https://iplists.firehol.org/?ipset=vxvault) - [blocklist_net_ua](https://iplists.firehol.org/?ipset=blocklist_net_ua) - [botscout_30d](https://iplists.firehol.org/?ipset=botscout_30d) -- [cybercure](https://iplists.firehol.org/?ipset=cybercure) -- [cybercrime](https://iplists.firehol.org/?ipset=cybercrime) + +## Currently begging droneBL staff for access +- [dronebl_anonymizers](https://iplists.firehol.org/?ipset=dronebl_anonymizers) +- [dronebl_irc_drones](https://iplists.firehol.org/?ipset=dronebl_irc_drones) ## VPN providers (inserted in db as "is_proxy") - [Tunnelbear](https://raw.githubusercontent.com/tn3w/TunnelBear-IPs/refs/heads/master/tunnelbear_ips.txt) ([source](https://github.com/tn3w/TunnelBear-IPs)) @@ -46,7 +49,7 @@ print_r($cf_lookup); // ["is_hosting" => true] ## Tor detection - [tor exit node list](https://openinternet.io/tor/tor-exit-list.txt) ([source](https://openinternet.io)) -- [dm_tor](https://iplists.firehol.org/?ipset=dm_tor) +- [tor_exits](https://iplists.firehol.org/?ipset=tor_exits) # Recommendation I recommend these additional MMDB databases to complement Cloudfish. diff --git a/mmdb.php b/mmdb.php index 6ddcd32..5238e9e 100644 --- a/mmdb.php +++ b/mmdb.php @@ -100,6 +100,7 @@ class mmdb_creator{ [ "proxy" => [ "firehol_anonymous.netset", + "firehol_abusers_30d.netset", "spamhaus_drop.netset", "dshield_30d.netset", "greensnow.ipset", @@ -110,12 +111,10 @@ class mmdb_creator{ "myip.ipset", "vxvault.ipset", "blocklist_net_ua.ipset", - "botscout_30d.ipset", - "cybercure.ipset", - "cybercrime.ipset" + "botscout_30d.ipset" ], "tor" => [ // + tor, the other tor list misses ipv4s with ipv6 addresses - "dm_tor.ipset" + "tor_exits.ipset" ] ], "blocklist-ipsets/"