Blocklist Feeds

# Create nftables set and rules
nft add table inet filter
nft add set inet filter fraudcache { type ipv4_addr\; flags interval\; }
nft add set inet filter fraudcache6 { type ipv6_addr\; flags interval\; }

# Add drop rule
nft add rule inet filter input ip saddr @fraudcache drop
nft add rule inet filter input ip6 saddr @fraudcache6 drop

# Load IPs from feed
curl -sf https://fraudcache.com/feeds/fraudcache-spam-ips.txt | \
  grep -v '^#' | grep -v '^$' | while read ip; do
    if [[ $ip == *":"* ]]; then
      nft add element inet filter fraudcache6 { "$ip" }
    else
      nft add element inet filter fraudcache { "$ip" }
    fi
  done

# Step 1: Convert feed to nginx geo format
curl -sf https://fraudcache.com/feeds/fraudcache-spam-ips.txt | \
  grep -v '^#' | grep -v '^$' | \
  awk '{print $1 " 1;"}' > /etc/nginx/fraudcache-spam.conf

# Step 2: Add to nginx.conf (http block)
geo $is_spam {
    default 0;
    include /etc/nginx/fraudcache-spam.conf;
}

# Step 3: Use in your server block
server {
    listen 80;
    server_name example.com;
    
    if ($is_spam) {
        return 403 "Access denied";
    }
    
    # ... rest of config
}

# Step 4: Reload nginx
nginx -t && systemctl reload nginx

# Step 1: Download feed (strip comments)
curl -sf https://fraudcache.com/feeds/fraudcache-spam-ips.txt | \
  grep -v '^#' | grep -v '^$' > /etc/haproxy/fraudcache-spam.lst

# Step 2: haproxy.cfg configuration
frontend http_front
    bind *:80
    bind *:443 ssl crt /etc/haproxy/certs/

    # Load blocklist ACL
    acl is_spam src -f /etc/haproxy/fraudcache-spam.lst
    acl is_attacker src -f /etc/haproxy/fraudcache-attacks.lst
    
    # Block matching IPs
    http-request deny deny_status 403 if is_spam
    http-request deny deny_status 403 if is_attacker
    
    # Or silently tarpit them
    # http-request tarpit if is_spam
    
    default_backend servers

# Step 3: Reload HAProxy
haproxy -c -f /etc/haproxy/haproxy.cfg && \
  systemctl reload haproxy

# Create a script to ban all IPs from feed
cat > /usr/local/bin/fraudcache-f2b.sh << 'EOF'
#!/bin/bash
JAIL="fraudcache"

# Fetch and ban each IP
curl -sf https://fraudcache.com/feeds/fraudcache-scanners.txt | \
  grep -v '^#' | grep -v '^$' | while read ip; do
    fail2ban-client set $JAIL banip "$ip" 2>/dev/null
  done
EOF

chmod +x /usr/local/bin/fraudcache-f2b.sh

# Create fail2ban jail (/etc/fail2ban/jail.d/fraudcache.conf)
[fraudcache]
enabled = true
filter = 
banaction = iptables-allports
maxretry = 1
findtime = 86400
bantime = 86400

# Script to add rules to UFW
cat > /usr/local/bin/ufw-fraudcache.sh << 'EOF'
#!/bin/bash

# Download and add each IP
curl -sf https://fraudcache.com/feeds/fraudcache-botnet-c2.txt | \
  grep -v '^#' | grep -v '^$' | while read ip; do
    ufw insert 1 deny from "$ip" to any comment "Fraudcache"
  done
EOF

chmod +x /usr/local/bin/ufw-fraudcache.sh

# Note: UFW can be slow with many rules.
# For large blocklists, use ipset instead.

# Generate .htaccess deny rules
echo "Order Allow,Deny" > /var/www/.htaccess-fraudcache
echo "Allow from all" >> /var/www/.htaccess-fraudcache

curl -sf https://fraudcache.com/feeds/fraudcache-web-attacks.txt | \
  grep -v '^#' | grep -v '^$' | \
  awk '{print "Deny from " $1}' >> /var/www/.htaccess-fraudcache

# Include in your main .htaccess
Include /var/www/.htaccess-fraudcache

# Or use mod_authz_host (Apache 2.4+)
# Require not ip 192.0.2.1