[Feature request] Malicious IP blocklist

[ThreeDeeJay]

DNS block lists are great, but some apps are hell-bent on bypassing them by connecting to IPs directly, which can be prevented with the universal rule, but then we'd need to manually allow them and even then we wouldn't know if the IPs are to be trusted, which I guess also applies to IPs resolved by a hostname that hasn't been blocked.

There are several collections/databases that use multiple sources, like this one:
https://github.com/stamparm/ipsum
IPs are grouped into "levels", which indicate the number of sources in which the IP has been reported, so perhaps ReThink could also have an option to set the level to weed out possible false positives or just improve performance if this causes too much overhead.

Also, it would be neat to get notified before ReThink attempts to connect to an IP that's been flagged, even if the hostname has been allowed.

[ignoramous]

Makes sense. Possible dups?

• [Feature Request] Global IP Blocklists #1138
• User feedback: IP and Port blocklists  #50
• IP address and domain blocklists #237

[ThreeDeeJay]

Yeah, they're quite similar.
It'd be nice if something like IPsum was built into RDNS like offline hostname blocklists, but I could definitely work with a generic feature to load a custom URL/paste/file containing a list of IPs to block

So if you want you can go ahead and close this issue and I'll just watch the ones you mentioned 👀👌