72 lines
3.8 KiB
Markdown
72 lines
3.8 KiB
Markdown
# Cloudfish
|
|
Cloudfish (aims to be) a selfhosted Cloudflare replacement.
|
|
|
|
Right now, it only features an IP abuse MMDB database builder. You give it an IP and it will expose 3 optional values: `is_proxy`, `is_hosting` and `is_tor`.
|
|
|
|
To use the database, you can use this PHP code:
|
|
```php
|
|
<?php
|
|
require "geoip2.phar";
|
|
use MaxMind\Db\Reader as MmdbReader;
|
|
|
|
$cf = new MmdbReader("cloudfish.mmdb");
|
|
$cf_lookup = $reader_abuse->get("45.80.201.66");
|
|
|
|
print_r($cf_lookup); // ["is_hosting" => true]
|
|
```
|
|
|
|
**Warning**: Any field may be missing. Fields that are set are always set to `true`.
|
|
|
|
# Data sources
|
|
|
|
## Proxy detection ([firehol](https://iplists.firehol.org/))
|
|
- [firehol_anonymous](https://iplists.firehol.org/?ipset=firehol_anonymous)
|
|
- [abuseipdb_30d](https://iplists.firehol.org/?ipset=abuseipdb_30d)
|
|
- [firehol_abusers_30d](https://iplists.firehol.org/?ipset=firehol_abusers_30d)
|
|
- [spamhaus_drop](https://iplists.firehol.org/?ipset=spamhaus_drop)
|
|
- [dshield_30d](https://iplists.firehol.org/?ipset=dshield_30d)
|
|
- [greensnow](https://iplists.firehol.org/?ipset=greensnow)
|
|
- [blocklist_de](https://iplists.firehol.org/?ipset=blocklist_de)
|
|
- [bruteforceblocker](https://iplists.firehol.org/?ipset=bruteforceblocker)
|
|
- [ciarmy](https://iplists.firehol.org/?ipset=ciarmy)
|
|
- [myip](https://iplists.firehol.org/?ipset=myip)
|
|
- [vxvault](https://iplists.firehol.org/?ipset=vxvault)
|
|
- [blocklist_net_ua](https://iplists.firehol.org/?ipset=blocklist_net_ua)
|
|
- [botscout_30d](https://iplists.firehol.org/?ipset=botscout_30d)
|
|
|
|
## Currently begging droneBL staff for access
|
|
- [dronebl_anonymizers](https://iplists.firehol.org/?ipset=dronebl_anonymizers)
|
|
- [dronebl_irc_drones](https://iplists.firehol.org/?ipset=dronebl_irc_drones)
|
|
|
|
## VPN providers (inserted in db as "is_proxy")
|
|
- [Tunnelbear](https://raw.githubusercontent.com/tn3w/TunnelBear-IPs/refs/heads/master/tunnelbear_ips.txt) ([source](https://github.com/tn3w/TunnelBear-IPs))
|
|
- [ProtonVPN](https://raw.githubusercontent.com/tn3w/ProtonVPN-IPs/refs/heads/master/protonvpn_ips.txt) ([source](https://github.com/tn3w/ProtonVPN-IPs))
|
|
- [Windscribe](https://raw.githubusercontent.com/tn3w/Windscribe-IPs/refs/heads/master/windscribe_ips.txt) ([source](https://github.com/tn3w/Windscribe-IPs))
|
|
- pia/proton/apple/mullvad [ipv4](https://raw.githubusercontent.com/X4BNet/lists_vpn/refs/heads/main/output/vpn/ipv4.txt), [ipv6](https://raw.githubusercontent.com/X4BNet/lists_vpn/refs/heads/main/output/vpn/ipv6.txt) ([source](https://github.com/X4BNet/lists_vpn/))
|
|
|
|
## Hosting detection
|
|
- [datacenter-ipv4](https://raw.githubusercontent.com/X4BNet/lists_vpn/refs/heads/main/output/datacenter/ipv4.txt), [datacenter-ipv6](https://raw.githubusercontent.com/X4BNet/lists_vpn/refs/heads/main/output/datacenter/ipv6.txt) ([source](https://github.com/X4BNet/lists_vpn/))
|
|
- [CDN list](https://raw.githubusercontent.com/mansourjabin/cdn-ip-database/refs/heads/main/data/cdn.lst) ([source](https://github.com/mansourjabin/cdn-ip-database))
|
|
|
|
## Tor detection
|
|
- [tor exit node list](https://openinternet.io/tor/tor-exit-list.txt) ([source](https://openinternet.io))
|
|
- [tor_exits](https://iplists.firehol.org/?ipset=tor_exits)
|
|
|
|
# Recommendation
|
|
I recommend these additional MMDB databases to complement Cloudfish.
|
|
|
|
## ASN detection
|
|
- [GeoLite2-ASN](https://git.io/GeoLite2-ASN.mmdb) ([source](https://github.com/P3TERX/GeoLite.mmdb))
|
|
|
|
## Country/city detection
|
|
- [GeoLite2-City](https://git.io/GeoLite2-City.mmdb) ([source](https://github.com/P3TERX/GeoLite.mmdb))
|
|
|
|
# Try it
|
|
I wrote a simple IP lookup script. It's available at `ip.lolcat.ca`, `ip4.lolcat.ca` and `ip6.lolcat.ca`.
|
|
|
|
### Disclaimer
|
|
I transpiled MMDBWriter.php from it's original Go implementation using Claude. I'll make my own when I have more time, no idea if the filesize could be reduced.
|
|
|
|
# License
|
|
AGPLv3, make sure to credit all blocklists used, they all have their own fuckass licenses.
|