# Cloudfish
Cloudfish (aims to be) a selfhosted Cloudflare replacement.

Right now, it only features an IP abuse MMDB database builder. You give it an IP and it will expose 4 optional values: `is_proxy`, `is_hosting`, `is_residential` and `is_tor`.

To use the database, you can use this PHP code:
```php
<?php
require "geoip2.phar";
use MaxMind\Db\Reader as MmdbReader;

$cf = new MmdbReader("cloudfish.mmdb");
$cf_lookup = $reader_abuse->get("45.80.201.66");

print_r($cf_lookup); // ["is_hosting" => true]
```

**Warning**: Any field may be missing. Fields that are set are always set to `true`.

# Generate database
Just run that shit and hope it works

```sh
php mmdb.php
```

# Data sources

## Proxy detection ([firehol](https://iplists.firehol.org/))
- [firehol_anonymous](https://iplists.firehol.org/?ipset=firehol_anonymous)
- [abuseipdb_30d](https://iplists.firehol.org/?ipset=abuseipdb_30d)
- [firehol_abusers_30d](https://iplists.firehol.org/?ipset=firehol_abusers_30d)
- [spamhaus_drop](https://iplists.firehol.org/?ipset=spamhaus_drop)
- [dshield_30d](https://iplists.firehol.org/?ipset=dshield_30d)
- [greensnow](https://iplists.firehol.org/?ipset=greensnow)
- [blocklist_de](https://iplists.firehol.org/?ipset=blocklist_de)
- [bruteforceblocker](https://iplists.firehol.org/?ipset=bruteforceblocker)
- [ciarmy](https://iplists.firehol.org/?ipset=ciarmy)
- [myip](https://iplists.firehol.org/?ipset=myip)
- [vxvault](https://iplists.firehol.org/?ipset=vxvault)
- [blocklist_net_ua](https://iplists.firehol.org/?ipset=blocklist_net_ua)
- [botscout_30d](https://iplists.firehol.org/?ipset=botscout_30d)

## Currently begging droneBL staff for access
- [dronebl_anonymizers](https://iplists.firehol.org/?ipset=dronebl_anonymizers)
- [dronebl_irc_drones](https://iplists.firehol.org/?ipset=dronebl_irc_drones)

## VPN providers (inserted in db as "is_proxy")
- [Tunnelbear](https://raw.githubusercontent.com/tn3w/TunnelBear-IPs/refs/heads/master/tunnelbear_ips.txt) ([source](https://github.com/tn3w/TunnelBear-IPs))
- [ProtonVPN](https://raw.githubusercontent.com/tn3w/ProtonVPN-IPs/refs/heads/master/protonvpn_ips.txt) ([source](https://github.com/tn3w/ProtonVPN-IPs))
- [Windscribe](https://raw.githubusercontent.com/tn3w/Windscribe-IPs/refs/heads/master/windscribe_ips.txt) ([source](https://github.com/tn3w/Windscribe-IPs))
- pia/proton/apple/mullvad [ipv4](https://raw.githubusercontent.com/X4BNet/lists_vpn/refs/heads/main/output/vpn/ipv4.txt), [ipv6](https://raw.githubusercontent.com/X4BNet/lists_vpn/refs/heads/main/output/vpn/ipv6.txt) ([source](https://github.com/X4BNet/lists_vpn/))

## Hosting detection
- [GeoLite2-ASN](https://git.io/GeoLite2-ASN.mmdb) ([source](https://github.com/P3TERX/GeoLite.mmdb))
- ASN purpose index ([source](https://bgp.tools)):
	- Residential signals
		- [Home ISP](https://bgp.tools/tags/dsl)
		- [Mobile Data/Carrier](https://bgp.tools/tags/mobile)
	- Hosting signals
		- [Content Delivery Network](https://bgp.tools/tags/cdn)
		- [Server Hosting](https://bgp.tools/tags/vpsh)
		- [VPN Host](https://bgp.tools/tags/vpn)

### Important!
- An ASN's IP range(s) are assigned `is_hosting` if they report *ANY* hosting signal, but it *MUST NOT* have a residential signal.
- An ASN's IP range(s) are assigned `is_residential` if they report a residential signal, but it *MUST NOT* have a hosting signal.

This method cover everything, some IPs will not receive a category. But it shouldn't falseflag.

## Tor detection
- [tor exit node list](https://openinternet.io/tor/tor-exit-list.txt) ([source](https://openinternet.io))
- [tor_exits](https://iplists.firehol.org/?ipset=tor_exits)

# Recommendation
I recommend these additional MMDB databases to complement Cloudfish.

## Country/city detection
- [GeoLite2-City](https://git.io/GeoLite2-City.mmdb) ([source](https://github.com/P3TERX/GeoLite.mmdb))

# Try it
I wrote a simple IP lookup script. It's available at `ip.lolcat.ca`, `ip4.lolcat.ca` and `ip6.lolcat.ca`.

### Disclaimer
I transpiled MMDBWriter.php from it's original Go implementation using Claude. I'll make my own when I have more time, no idea if the filesize could be reduced. I also asked it to create a MMDB ASN extractor. Lol.

# License
AGPLv3, make sure to credit all blocklists used, they all have their own fuckass licenses.