4.1 KiB
Cloudfish
Cloudfish (aims to be) a selfhosted Cloudflare replacement.
Right now, it only features an IP abuse MMDB database builder. You give it an IP and it will expose 4 optional values: is_proxy, is_hosting, is_residential and is_tor.
To use the database, you can use this PHP code:
<?php
require "geoip2.phar";
use MaxMind\Db\Reader as MmdbReader;
$cf = new MmdbReader("cloudfish.mmdb");
$cf_lookup = $reader_abuse->get("45.80.201.66");
print_r($cf_lookup); // ["is_hosting" => true]
Warning: Any field may be missing. Fields that are set are always set to true.
Generate database
Just run that shit and hope it works
php mmdb.php
Data sources
Proxy detection (firehol)
- firehol_anonymous
- abuseipdb_30d
- firehol_abusers_30d
- spamhaus_drop
- dshield_30d
- greensnow
- blocklist_de
- bruteforceblocker
- ciarmy
- myip
- vxvault
- blocklist_net_ua
- botscout_30d
Currently begging droneBL staff for access
VPN providers (inserted in db as "is_proxy")
- Tunnelbear (source)
- ProtonVPN (source)
- Windscribe (source)
- pia/proton/apple/mullvad ipv4, ipv6 (source)
Hosting detection
- GeoLite2-ASN (source)
- ASN purpose index (source):
- Residential signals
- Hosting signals
Important!
- An ASN's IP range(s) are assigned
is_hostingif they report ANY hosting signal, but it MUST NOT have a residential signal. - An ASN's IP range(s) are assigned
is_residentialif they report a residential signal, but it MUST NOT have a hosting signal.
This method wont cover everything, some IPs will not receive a category. But it shouldn't falseflag!
Tor detection
Recommendation
I recommend these additional MMDB databases to complement Cloudfish.
Country/city detection
Try it
I wrote a simple IP lookup script. It's available at ip.lolcat.ca, ip4.lolcat.ca and ip6.lolcat.ca.
Disclaimer
MMDB_ASN_Extractor.php is vibe-coded. Works fine though.
License
AGPLv3, make sure to credit all blocklists used, they all have their own fuckass licenses.