Skip to main content
PPPhishPondPhishing Tradecraft Intelligence

Attack · Detection · Validation

CampaignTradecraftInfrastructureDetectionResearchRadarNewsroomAboutSubscribe
CampaignTradecraftInfrastructureDetectionResearchRadarNewsroomAboutSubscribe

Research Desk

PhishPond

Phishing tradecraft research desk covering campaign analysis, adversary infrastructure, detection engineering, and validation workflows.

High signal for security teams who need tradecraft, not recycled filler.

Navigate

  • Home
  • Newsroom
  • Research
  • Subscribe

Signals

  • editorial@phishpond.dev
  • Research Mission & Ethics
  • Intel Brief
  • RSS Feed
  • Submit Research Tip
© 2026 PhishPond. Authorized security research use only.

GitHub RadarBlue team tool

Chocolate4U/Iran-clash-rules

Enhanced Clash and Clash.Meta routing rules with Iranian domains ruleset and a focus on security and adblocking. Primary language: Shell. 79 stars.

Shell79 stars5 forkspushed Jun 12, 2026GPL-3.0

Project links:Open GitHub projectBack to radar

README Preview

Fetched from GitHub

<picture> <source media="(prefers-color-scheme: dark)" srcset="assets/logo-white.png"> <source media="(prefers-color-scheme: light)" srcset="assets/logo-dark.png"> <img alt="a logo for iran clash rules in both dark and light mode" src="assets/logo-dark.png"> </picture>

<p align="center"> <img alt="GitHub Workflow Status" src="https://img.shields.io/github/actions/workflow/status/Chocolate4U/Iran-clash-rules/release.yml?event=schedule&style=for-the-badge&logo=github&cacheSeconds=3600"> <img alt="GitHub release" src="https://img.shields.io/github/v/release/Chocolate4U/Iran-clash-rules?style=for-the-badge&cacheSeconds=3600"> <img alt="GitHub Release Date" src="https://img.shields.io/github/release-date/Chocolate4U/Iran-clash-rules?display_date=published_at&style=for-the-badge&cacheSeconds=3600"> <img alt="License" src="https://img.shields.io/github/license/Chocolate4U/Iran-clash-rules?style=for-the-badge&color=blue&cacheSeconds=3600"> </p>

:writing_hand: Introduction

An enhanced and All-in-One set of geo-location routing files optimized for Iranian users to use in Clash/Clash.Meta.

:bulb: For V2Ray geolocation rules please refer to Iran V2Ray Rules :bulb: For Sing-Box geolocation rules please refer to Iran Sing-Box Rules

:page_with_curl: Categories

[!IMPORTANT]
There are two clash rule formats, text and yaml. text is preferred as it's faster to process by Clash and is supported in Clash Premium 1.15.0+ and clash.Meta 1.14.4+ . If you are using an older version of Clash/Clash.Meta, you should use yaml format.

Classical Rules

  • apps.txt, apps.yaml

Contains a list of Persian Android apps.

  • irasn.txt, irasn.yaml

Contains a list of Iran ASN numbers.

Domain Rules

  • ir.txt, ir.yaml

Contains non-ir TLD Iranian domains (e.g. .com .net .org etc.) and rules to bypass all .ir domains.

  • ir-lite.txt, ir-lite.yaml

Contains Active non-ir TLD Iranian domains (e.g. .com .net .org etc.) and rules to bypass all .ir domains.

  • ads.txt, ads.yaml

Contains a list of Persian advertisement and tracking domains.

  • category-ads-all.txt, category-ads-all.yaml

Contains a curated list of Persian and Foreign advertisement and tracking domains based on multiple sources. It is optimized to has as low as possible false positives while also retain small size and efficiency.

  • malware.txt, malware.yaml

Contains a list of active malware domains.

  • phishing.txt, phishing.yaml

Contains a list of scam and phishing domains.

  • cryptominers.txt, cryptominers.yaml

Contains a list of cryptocurrency miners that run in the background of a web browser and affect system performance.

  • social.txt,social.yaml

Contains Domain Addresses of popular social media platforms, including Facebook, Instagram, Whatsapp, Twitter, LinkedIn, MySpace, Pinterest, Tumblr, Reddit, TikTok, clubhouse.

  • nsfw.txt,nsfw.yaml

Contains a list of porn and gambling websites.

IP Rules

  • ircidr.txt, ircidr.yaml

Contains Iran IP addresses from Maxmind database and IP addresses of Iranian messengers such as eitaa, rubika, etc.

  • private.txt, private.yaml

Contains a list of local (LAN) IP addresses.

  • arvancloud.txt, arvancloud.yaml

Contains the IP addresses of ArvanCloud.ir CDN.

  • derakcloud.txt, derakcloud.yaml

Contains the IP addresses of Derak.cloud CDN.

  • iranserver.txt, iranserver.yaml

Contains the IP addresses of IranServer.com CDN.

  • parspack.txt, parspack.yaml

Contains the IP addresses of ParsPack.com CDN.

  • cloudflare.txt, cloudflare.yaml

Contains the IP addresses of Cloudflare CDN.

  • google.txt, google.yaml

Contains the IP addresses of Google, GoogleCloud and GoogleBot.

  • amazon.txt, amazon.yaml

Contains the IP addresses of Amazon and Amazon Web Services (AWS).

  • microsoft.txt, microsoft.yaml

Contains the IP addresses of Microsoft and Azure Platform.

  • bing.txt, bing.yaml

Contains the IP addresses of Bing and Bingbot.

  • github.txt, github.yaml

Contains the IP addresses of GitHub.

  • facebook.txt, facebook.yaml

Contains the IP addresses of the Meta ecosystem, including Facebook, Instagram and WhatsApp.

  • twitter.txt, twitter.yaml

Contains the IP addresses of Twitter (now called X!).

  • telegram.txt, telegram.yaml

Contains the IP addresses of Telegram Messenger.

  • oracle.txt, oracle.yaml

Contains the IP addresses of Oracle Cloud.

  • digitalocean.txt, digitalocean.yaml

Contains the IP addresses of DigitalOcean related services.

  • linode.txt, linode.yaml

Contains the IP addresses of Linode related services.

  • openai.txt, openai.yaml

Contains the IP addresses of OpenAI and ChatGPT.

  • phishing-ip.txt, phishing-ip.yaml

Contains Phishing IP addresses.

  • malware-ip.txt, malware-ip.yaml

Contains Active Malware IP addresses.

Meta GeoIP

[!NOTE]
Only usable in Clash.Meta.

GeoIP database in Clash.Meta format.

  • geoip.metadb

Same as GeoIP but in Clash.Meta format.

  • geoip-lite.metadb

Same as GeoIP-Lite but in Clash.Meta format.

  • security-ip.metadb

Same as Security-IP but in Clash.Meta format.

:arrow_down: How to download

<picture><source media="(prefers-color-scheme: dark)" srcset="https://cdn.simpleicons.org/github/white"><source media="(prefers-color-scheme: light)" srcset="https://cdn.simpleicons.org/github/dark"><img height="32" width="32" alt="github logo in dark and light mode." src="https://cdn.simpleicons.org/github/dark"></picture> From GitHub

  • IR
  • text https://raw.githubusercontent.com/Chocolate4U/Iran-clash-rules/release/ir.txt
  • yaml https://raw.githubusercontent.com/Chocolate4U/Iran-clash-rules/release/ir.yaml
  • IR-Lite
  • text https://raw.githubusercontent.com/Chocolate4U/Iran-clash-rules/release/ir-lite.txt
  • yaml https://raw.githubusercontent.com/Chocolate4U/Iran-clash-rules/release/ir-lite.yaml
  • Category-ads-all
  • text https://raw.githubusercontent.com/Chocolate4U/Iran-clash-rules/release/category-ads-all.txt
  • yaml https://raw.githubusercontent.com/Chocolate4U/Iran-clash-rules/release/category-ads-all.yaml
  • Malware
  • text https://raw.githubusercontent.com/Chocolate4U/Iran-clash-rules/release/malware.txt
  • yaml https://raw.githubusercontent.com/Chocolate4U/Iran-clash-rules/release/malware.yaml
  • Phishing
  • text https://raw.githubusercontent.com/Chocolate4U/Iran-clash-rules/release/phishing.txt
  • yaml https://raw.githubusercontent.com/Chocolate4U/Iran-clash-rules/release/phishing.yaml
  • CryptoMiners
  • text https://raw.githubusercontent.com/Chocolate4U/Iran-clash-rules/release/cryptominers.txt
  • yaml https://raw.githubusercontent.com/Chocolate4U/Iran-clash-rules/release/cryptominers.yaml
  • Apps
  • text https://raw.githubusercontent.com/Chocolate4U/Iran-clash-rules/release/apps.txt
  • yaml https://raw.githubusercontent.com/Chocolate4U/Iran-clash-rules/release/apps.yaml
  • IRASN
  • text https://raw.githubusercontent.com/Chocolate4U/Iran-clash-rules/release/irasn.txt
  • yaml https://raw.githubusercontent.com/Chocolate4U/Iran-clash-rules/release/irasn.yaml
  • IRcidr
  • text https://raw.githubusercontent.com/Chocolate4U/Iran-clash-rules/release/ircidr.txt
  • yaml https://raw.githubusercontent.com/Chocolate4U/Iran-clash-rules/release/ircidr.yaml
  • Private
  • text https://raw.githubusercontent.com/Chocolate4U/Iran-clash-rules/release/private.txt
  • yaml https://raw.githubusercontent.com/Chocolate4U/Iran-clash-rules/release/private.yaml
  • ArvanCloud
  • text https://raw.githubusercontent.com/Chocolate4U/Iran-clash-rules/release/arvancloud.txt
  • yaml https://raw.githubusercontent.com/Chocolate4U/Iran-clash-rules/release/arvancloud.yaml
  • DerakCloud
  • text https://raw.githubusercontent.com/Chocolate4U/Iran-clash-rules/release/derakcloud.txt
  • yaml https://raw.githubusercontent.com/Chocolate4U/Iran-clash-rules/release/derakcloud.yaml
  • IranServer
  • text https://raw.githubusercontent.com/Chocolate4U/Iran-clash-rules/release/iranserver.txt
  • yaml https://raw.githubusercontent.com/Chocolate4U/Iran-clash-rules/release/iranserver.yaml
  • ParsPack
  • text https://raw.githubusercontent.com/Chocolate4U/Iran-clash-rules/release/parspack.txt
  • yaml https://raw.githubusercontent.com/Chocolate4U/Iran-clash-rules/release/parspack.yaml

<picture><source media="(prefers-color-scheme: dark)" srcset="https://cdn.simpleicons.org/jsdelivr/white"><source media="(prefers-color-scheme: light)" srcset="https://cdn.simpleicons.org/jsdelivr/dark"><img height="32" width="32" alt="github logo in dark and light mode." src="https://cdn.simpleicons.org/jsdelivr/dark"></picture> From jsDelivr CDN

  • IR
  • text https://cdn.jsdelivr.net/gh/chocolate4u/Iran-clash-rules@release/ir.txt
  • yaml https://cdn.jsdelivr.net/gh/chocolate4u/Iran-clash-rules@release/ir.yaml
  • IR-Lite
  • text [https://cdn.jsdelivr.net/gh/chocolate