Skip to main content
PPPhishPondPhishing Tradecraft Intelligence

Attack · Detection · Validation

CampaignTradecraftInfrastructureDetectionResearchRadarNewsroomAboutSubscribe
CampaignTradecraftInfrastructureDetectionResearchRadarNewsroomAboutSubscribe

Research Desk

PhishPond

Phishing tradecraft research desk covering campaign analysis, adversary infrastructure, detection engineering, and validation workflows.

High signal for security teams who need tradecraft, not recycled filler.

Navigate

  • Home
  • Newsroom
  • Research
  • Subscribe

Signals

  • editorial@phishpond.dev
  • Research Mission & Ethics
  • Intel Brief
  • RSS Feed
  • Submit Research Tip
© 2026 PhishPond. Authorized security research use only.

GitHub RadarBlue team tool

Chocolate4U/Iran-sing-box-rules

Enhanced sing-box and sing-box-clients routing rules with built-in Iranian domains and a focus on security and adblocking. 317 stars.

317 stars25 forkspushed Jun 12, 2026GPL-3.0

Project links:Open GitHub projectBack to radar

README Preview

Fetched from GitHub

<picture> <source media="(prefers-color-scheme: dark)" srcset="assets/logo-white.png"> <source media="(prefers-color-scheme: light)" srcset="assets/logo-dark.png"> <img alt="a logo for iran sing-box rules in both dark and light mode" src="assets/logo-dark.png"> </picture>

<p align="center"> <img alt="GitHub Workflow Status" src="https://img.shields.io/github/actions/workflow/status/Chocolate4U/Iran-sing-box-rules/release.yml?event=schedule&style=for-the-badge&logo=github&cacheSeconds=3600"> <img alt="GitHub release" src="https://img.shields.io/github/v/release/Chocolate4U/Iran-sing-box-rules?style=for-the-badge&cacheSeconds=3600"> <img alt="GitHub Release Date" src="https://img.shields.io/github/release-date/Chocolate4U/Iran-sing-box-rules?display_date=published_at&style=for-the-badge&cacheSeconds=3600"> <img alt="License" src="https://img.shields.io/github/license/Chocolate4U/Iran-sing-box-rules?style=for-the-badge&color=blue&cacheSeconds=3600"> </p>

فارسی

:writing_hand: Introduction

This is an Enhanced and All-in-One set of geo-location routing files optimized for Iranian users to use in sing-box and all its compatible clients.

:bulb: For V2Ray geolocation rules please refer to Iran V2Ray Rules :bulb: For Clash geolocation rules please refer to Iran Clash Rules

:arrow_down: How to download

<picture><source media="(prefers-color-scheme: dark)" srcset="https://cdn.simpleicons.org/github/white"><source media="(prefers-color-scheme: light)" srcset="https://cdn.simpleicons.org/github/dark"><img height="32" width="32" alt="github logo in dark and light mode." src="https://cdn.simpleicons.org/github/dark"></picture> From GitHub

Rule-Set

New Geo-Assets format introduced in sing-box v1.8.0+ in order to replace GeoIP and GeoSite. For more information visit rule-set

See here for a list of all supported rule-set assets.

[!WARNING]
GeoIP, GeoSite and all .db files in general are deprecated in sing-box v1.8.0+ and you should use Rule-Set instead. Only use .db assets if you are using sing-box v1.7.x and lower.

:bulb: Rule-Set assets are in these formats: geoip-xx.srs and geosite-xx.srs. Replace xx with your desired category. For example:

Rule-Set https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/rule-set/geoip-ir.srs Rule-Set https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/rule-set/geosite-ir.srs

DB

GeoIP https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/release/geoip.db GeoSite https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/release/geosite.db

GeoIP-Lite https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/release/geoip-lite.db GeoSite-Lite https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/release/geosite-lite.db

Security-IP https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/release/security-ip.db Security https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/release/security.db

<picture><source media="(prefers-color-scheme: dark)" srcset="https://cdn.simpleicons.org/jsdelivr/white"><source media="(prefers-color-scheme: light)" srcset="https://cdn.simpleicons.org/jsdelivr/dark"><img height="32" width="32" alt="github logo in dark and light mode." src="https://cdn.simpleicons.org/jsdelivr/dark"></picture> From jsdelivr CDN

Rule-Set

Rule-Set https://cdn.jsdelivr.net/gh/chocolate4u/Iran-sing-box-rules@rule-set/geoip-ir.srs Rule-Set https://cdn.jsdelivr.net/gh/chocolate4u/Iran-sing-box-rules@rule-set/geosite-ir.srs

DB

GeoIP https://cdn.jsdelivr.net/gh/chocolate4u/Iran-sing-box-rules@release/geoip.db GeoSite https://cdn.jsdelivr.net/gh/chocolate4u/Iran-sing-box-rules@release/geosite.db

GeoIP-Lite https://cdn.jsdelivr.net/gh/chocolate4u/Iran-sing-box-rules@release/geoip-lite.db GeoSite-Lite https://cdn.jsdelivr.net/gh/chocolate4u/Iran-sing-box-rules@release/geosite-lite.db

Security-IP https://cdn.jsdelivr.net/gh/chocolate4u/Iran-sing-box-rules@release/security-ip.db Security https://cdn.jsdelivr.net/gh/chocolate4u/Iran-sing-box-rules@release/security.db

:computer: Usage

sing-box core

<details> <summary><strong>Using Rule-Set (Requires sing-box v1.8.0+)</strong></summary>

Add the following to your sing-box client configuration:

"outbounds": [
  {
    "type": "direct",
    "tag": "direct"
  },
  {
    "type": "block",
    "tag": "block"
  }
],
"route": {
    "rules": [
      {
        "ip_is_private": true,
        "outbound": "direct"
      },
      {
        "rule_set": [
          "geosite-category-ads-all",
          "geosite-malware",
          "geosite-phishing",
          "geosite-cryptominers",
          "geoip-malware",
          "geoip-phishing"
        ],
        "outbound": "block"
      },
      {
        "rule_set": [
          "geosite-ir",
          "geoip-ir"
        ],
        "outbound": "direct"
      }
    ],
    "rule_set": [
      {
        "tag": "geosite-ir",
        "type": "remote",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/rule-set/geosite-ir.srs"
      },
      {
        "tag": "geosite-category-ads-all",
        "type": "remote",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/rule-set/geosite-category-ads-all.srs"
      },
      {
        "tag": "geosite-malware",
        "type": "remote",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/rule-set/geosite-malware.srs"
      },
      {
        "tag": "geosite-phishing",
        "type": "remote",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/rule-set/geosite-phishing.srs"
      },
      {
        "tag": "geosite-cryptominers",
        "type": "remote",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/rule-set/geosite-cryptominers.srs"
      },
      {
        "tag": "geoip-ir",
        "type": "remote",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/rule-set/geoip-ir.srs"
      },
      {
        "tag": "geoip-malware",
        "type": "remote",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/rule-set/geoip-malware.srs"
      },
      {
        "tag": "geoip-phishing",
        "type": "remote",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/rule-set/geoip-phishing.srs"
      }
    ]
  },
  "experimental": {
    "cache_file": {
      "enabled": true
    }
  }

</details>

<details> <summary><strong>Using DB Files</strong></summary>

Add the following to your sing-box client configuration:

"outbounds": [
  {
    "type": "direct",
    "tag": "direct"
  },
  {
    "type": "block",
    "tag": "block"
  }
],
"route": {
  "geoip": {
      "download_url": "https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/release/geoip.db"
  },
  "geosite": {
    "download_url": "https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/release/geosite.db"
  },
  "rules": [
    {
      "geosite": [
        "category-ads-all",
        "malware",
        "phishing",
        "cryptominers"
      ],
      "outbound": "block"
    },
    {
      "geoip": [
        "malware",
        "phishing"
      ],
      "outbound": "block"
    },
    {
      "geosite": "ir",
      "outbound": "direct"
    },
    {
      "geoip": [
        "ir",
        "private"
      ],
      "outbound": "direct"
    }
  ]
}

</details>

:page_with_curl: Categories

GeoIP

<details> <summary><strong>Categories in <code>geoip.db</code></strong></summary>

  • Contains IP Addresses of all countries from Maxmind and IP2Location databases.
  • geoip:ir

Contains Iran IP addresses from Maxmind and IP2Location databases, IP addresses of Iranian messengers such as eitaa, rubika, etc. and IP addresses of arvancloud, derakcloud, iranserver and parspack CDNs.

  • geoip:private

Contains a list of local (LAN) IP addresses.

  • geoip:arvancloud

Contains the IP addresses of ArvanCloud.ir CDN. :information_source: Integrated in geoip:ir and no longer needed to be written as a separate rule.

  • geoip:derakcloud

Contains the IP addresses of Derak.cloud CDN. :information_source: Integrated in geoip:ir and no longer needed to be written as a separate rule.

  • geoip:iranserver

Contains the IP addresses of IranServer.com CDN. :information_source: Integrated in geoip:ir and no longer needed to be written as a separate rule.

  • geoip:parspack

Contains the IP addresses of ParsPack.com CDN. :information_source: Integrated in geoip:ir and no longer needed to be written as a separate rule.

  • geoip:cloudflare

Contains the IP addresses of Cloudflare CDN.

  • geoip:google

Contains the IP addresses of Google, GoogleCloud and GoogleBot.

  • geoip:amazon

Contains the IP addresses of Amazon and Amazon Web Services (AWS).

  • geoip:microsoft

Contains the IP addresses of Microsoft and Azure Platform.

  • geoip:bing

Contains the IP addresses of Bing and Bingbot.

  • geoip:github

Contains the IP addresses of GitHub.

  • geoip:facebook

Contains the IP addresses of the Meta ecosystem, including Facebook, Instagram and WhatsApp.

  • geoip:twitter

Contains the IP addresses of Twitter (now called X!).

  • geoip:telegram

Contains the IP addresses of Telegram Messenger.

  • geoip:oracle

Contains the IP addresses of Oracle Cloud.

  • geoip:digitalocean

Contains the IP addresses of DigitalOcean-related services.

  • geoip:linode

Contains the IP addresses of Linode-related services.

  • geoip:openai

Contains the IP addresses of OpenAI and ChatGPT.

  • geoip:phishing

Contains Phishing IP addresses.

  • geoip:malware

Contains Active Malware IP addresses. </details>

<details> <summary><strong>Categories in <code>geoip-lite.db</code></strong></summary>

  • geoip:ir

Contains Iran IP addresses from Maxmind and IP2Location databases, IP addresses of Iranian messengers such as eitaa,