89 lines
4.1 KiB
Markdown
89 lines
4.1 KiB
Markdown
# Cloudfish
|
|
Cloudfish (aims to be) a selfhosted Cloudflare replacement.
|
|
|
|
Right now, it only features an IP abuse MMDB database builder. You give it an IP and it will expose 4 optional values: `is_proxy`, `is_hosting`, `is_residential` and `is_tor`.
|
|
|
|
To use the database, you can use this PHP code:
|
|
```php
|
|
<?php
|
|
require "geoip2.phar";
|
|
use MaxMind\Db\Reader as MmdbReader;
|
|
|
|
$cf = new MmdbReader("cloudfish.mmdb");
|
|
$cf_lookup = $reader_abuse->get("45.80.201.66");
|
|
|
|
print_r($cf_lookup); // ["is_hosting" => true]
|
|
```
|
|
|
|
**Warning**: Any field may be missing. Fields that are set are always set to `true`.
|
|
|
|
# Generate database
|
|
Just run that shit and hope it works
|
|
|
|
```sh
|
|
php mmdb.php
|
|
```
|
|
|
|
# Data sources
|
|
|
|
## Proxy detection ([firehol](https://iplists.firehol.org/))
|
|
- [firehol_anonymous](https://iplists.firehol.org/?ipset=firehol_anonymous)
|
|
- [abuseipdb_30d](https://iplists.firehol.org/?ipset=abuseipdb_30d)
|
|
- [firehol_abusers_30d](https://iplists.firehol.org/?ipset=firehol_abusers_30d)
|
|
- [spamhaus_drop](https://iplists.firehol.org/?ipset=spamhaus_drop)
|
|
- [dshield_30d](https://iplists.firehol.org/?ipset=dshield_30d)
|
|
- [greensnow](https://iplists.firehol.org/?ipset=greensnow)
|
|
- [blocklist_de](https://iplists.firehol.org/?ipset=blocklist_de)
|
|
- [bruteforceblocker](https://iplists.firehol.org/?ipset=bruteforceblocker)
|
|
- [ciarmy](https://iplists.firehol.org/?ipset=ciarmy)
|
|
- [myip](https://iplists.firehol.org/?ipset=myip)
|
|
- [vxvault](https://iplists.firehol.org/?ipset=vxvault)
|
|
- [blocklist_net_ua](https://iplists.firehol.org/?ipset=blocklist_net_ua)
|
|
- [botscout_30d](https://iplists.firehol.org/?ipset=botscout_30d)
|
|
|
|
## Currently begging droneBL staff for access
|
|
- [dronebl_anonymizers](https://iplists.firehol.org/?ipset=dronebl_anonymizers)
|
|
- [dronebl_irc_drones](https://iplists.firehol.org/?ipset=dronebl_irc_drones)
|
|
|
|
## VPN providers (inserted in db as "is_proxy")
|
|
- [Tunnelbear](https://raw.githubusercontent.com/tn3w/TunnelBear-IPs/refs/heads/master/tunnelbear_ips.txt) ([source](https://github.com/tn3w/TunnelBear-IPs))
|
|
- [ProtonVPN](https://raw.githubusercontent.com/tn3w/ProtonVPN-IPs/refs/heads/master/protonvpn_ips.txt) ([source](https://github.com/tn3w/ProtonVPN-IPs))
|
|
- [Windscribe](https://raw.githubusercontent.com/tn3w/Windscribe-IPs/refs/heads/master/windscribe_ips.txt) ([source](https://github.com/tn3w/Windscribe-IPs))
|
|
- pia/proton/apple/mullvad [ipv4](https://raw.githubusercontent.com/X4BNet/lists_vpn/refs/heads/main/output/vpn/ipv4.txt), [ipv6](https://raw.githubusercontent.com/X4BNet/lists_vpn/refs/heads/main/output/vpn/ipv6.txt) ([source](https://github.com/X4BNet/lists_vpn/))
|
|
|
|
## Hosting detection
|
|
- [GeoLite2-ASN](https://git.io/GeoLite2-ASN.mmdb) ([source](https://github.com/P3TERX/GeoLite.mmdb))
|
|
- ASN purpose index ([source](https://bgp.tools)):
|
|
- Residential signals
|
|
- [Home ISP](https://bgp.tools/tags/dsl)
|
|
- [Mobile Data/Carrier](https://bgp.tools/tags/mobile)
|
|
- Hosting signals
|
|
- [Content Delivery Network](https://bgp.tools/tags/cdn)
|
|
- [Server Hosting](https://bgp.tools/tags/vpsh)
|
|
- [VPN Host](https://bgp.tools/tags/vpn)
|
|
|
|
### Important!
|
|
- An ASN's IP range(s) are assigned `is_hosting` if they report *ANY* hosting signal, but it *MUST NOT* have a residential signal.
|
|
- An ASN's IP range(s) are assigned `is_residential` if they report a residential signal, but it *MUST NOT* have a hosting signal.
|
|
|
|
This method wont cover everything, some IPs will not receive a category. But it shouldn't falseflag!
|
|
|
|
## Tor detection
|
|
- [tor exit node list](https://openinternet.io/tor/tor-exit-list.txt) ([source](https://openinternet.io))
|
|
- [tor_exits](https://iplists.firehol.org/?ipset=tor_exits)
|
|
|
|
# Recommendation
|
|
I recommend these additional MMDB databases to complement Cloudfish.
|
|
|
|
## Country/city detection
|
|
- [GeoLite2-City](https://git.io/GeoLite2-City.mmdb) ([source](https://github.com/P3TERX/GeoLite.mmdb))
|
|
|
|
# Try it
|
|
I wrote a simple IP lookup script. It's available at `ip.lolcat.ca`, `ip4.lolcat.ca` and `ip6.lolcat.ca`.
|
|
|
|
# Disclaimer
|
|
MMDB_ASN_Extractor.php is vibe-coded. Works fine though.
|
|
|
|
# License
|
|
AGPLv3, make sure to credit all blocklists used, they all have their own fuckass licenses.
|