# Cloudfish
Cloudfish (aims to be) a selfhosted Cloudflare replacement.

Right now, it only features an IP abuse MMDB database builder. You give it an IP and it will expose 3 optional values: `is_proxy`, `is_hosting` and `is_tor`.

To use the database, you can use this PHP code:
```php
<?php
require "geoip2.phar";
use MaxMind\Db\Reader as MmdbReader;

$cf = new MmdbReader("cloudfish.mmdb");
$cf_lookup = $reader_abuse->get("45.80.201.66");

print_r($cf_lookup); // ["is_hosting" => true]
```

**Warning**: Any field may be missing. Fields that are set are always set to `true`.

# Data sources

## Proxy detection ([firehol](https://iplists.firehol.org/))
- [firehol_anonymous](https://iplists.firehol.org/?ipset=firehol_anonymous)
- [firehol_abusers_30d](https://iplists.firehol.org/?ipset=firehol_abusers_30d)
- [spamhaus_drop](https://iplists.firehol.org/?ipset=spamhaus_drop)
- [dshield_30d](https://iplists.firehol.org/?ipset=dshield_30d)
- [greensnow](https://iplists.firehol.org/?ipset=greensnow)
- [blocklist_de](https://iplists.firehol.org/?ipset=blocklist_de)
- [bruteforceblocker](https://iplists.firehol.org/?ipset=bruteforceblocker)
- [ciarmy](https://iplists.firehol.org/?ipset=ciarmy)
- [myip](https://iplists.firehol.org/?ipset=myip)
- [vxvault](https://iplists.firehol.org/?ipset=vxvault)
- [blocklist_net_ua](https://iplists.firehol.org/?ipset=blocklist_net_ua)
- [botscout_30d](https://iplists.firehol.org/?ipset=botscout_30d)

## Currently begging droneBL staff for access
- [dronebl_anonymizers](https://iplists.firehol.org/?ipset=dronebl_anonymizers)
- [dronebl_irc_drones](https://iplists.firehol.org/?ipset=dronebl_irc_drones)

## VPN providers (inserted in db as "is_proxy")
- [Tunnelbear](https://raw.githubusercontent.com/tn3w/TunnelBear-IPs/refs/heads/master/tunnelbear_ips.txt) ([source](https://github.com/tn3w/TunnelBear-IPs))
- [ProtonVPN](https://raw.githubusercontent.com/tn3w/ProtonVPN-IPs/refs/heads/master/protonvpn_ips.txt) ([source](https://github.com/tn3w/ProtonVPN-IPs))
- [Windscribe](https://raw.githubusercontent.com/tn3w/Windscribe-IPs/refs/heads/master/windscribe_ips.txt) ([source](https://github.com/tn3w/Windscribe-IPs))
- pia/proton/apple/mullvad [ipv4](https://raw.githubusercontent.com/X4BNet/lists_vpn/refs/heads/main/output/vpn/ipv4.txt), [ipv6](https://raw.githubusercontent.com/X4BNet/lists_vpn/refs/heads/main/output/vpn/ipv6.txt) ([source](https://github.com/X4BNet/lists_vpn/))

## Hosting detection
- [datacenter-ipv4](https://raw.githubusercontent.com/X4BNet/lists_vpn/refs/heads/main/output/datacenter/ipv4.txt), [datacenter-ipv6](https://raw.githubusercontent.com/X4BNet/lists_vpn/refs/heads/main/output/datacenter/ipv6.txt) ([source](https://github.com/X4BNet/lists_vpn/))
- [CDN list](https://raw.githubusercontent.com/mansourjabin/cdn-ip-database/refs/heads/main/data/cdn.lst) ([source](https://github.com/mansourjabin/cdn-ip-database))

## Tor detection
- [tor exit node list](https://openinternet.io/tor/tor-exit-list.txt) ([source](https://openinternet.io))
- [tor_exits](https://iplists.firehol.org/?ipset=tor_exits)

# Recommendation
I recommend these additional MMDB databases to complement Cloudfish.

## ASN detection
- [GeoLite2-ASN](https://git.io/GeoLite2-ASN.mmdb) ([source](https://github.com/P3TERX/GeoLite.mmdb))

## Country/city detection
- [GeoLite2-City](https://git.io/GeoLite2-City.mmdb) ([source](https://github.com/P3TERX/GeoLite.mmdb))

# Try it
I wrote a simple IP lookup script. It's available at `ip.lolcat.ca`, `ip4.lolcat.ca` and `ip6.lolcat.ca`.

### Disclaimer
I transpiled MMDBWriter.php from it's original Go implementation using Claude. I'll make my own when I have more time, no idea if the filesize could be reduced.

# License
AGPLv3, make sure to credit all blocklists used, they all have their own fuckass licenses.