Projects sharing features with China Ip List

Ahoy is a first-party analytics framework for Ruby on Rails applications. It provides tools for capturing user behaviors and page views, allowing developers to maintain full ownership of their analytics data. The system distinguishes itself through relational data analytics, which links visit identifiers directly to application models for deep business object attribution. It includes a privacy-preserving tracking tool that utilizes IP address masking and cookie-less visitor grouping to anonymize user data. The project covers a broad range of analytics capabilities, including custom event tra

meta-rules-dat is a collection of binary-encoded network datasets used to identify and categorize traffic for routing on resource-constrained devices. It provides a structured domain categorization list and a geographic IP routing dataset to map network traffic to specific countries or service providers. The project utilizes trie-based lookup data and compact binary serialization to enable high-performance prefix matching and fast domain-to-category resolution. To minimize memory and storage overhead, it employs stripped-down GeoIP mapping that removes non-essential metadata. The datasets co

Wireshark is a network protocol analyzer and traffic inspector used for capturing and inspecting network traffic. It functions as a packet capture tool that intercepts live data from network interfaces and a TCP/IP dissector that decodes network protocol layers to translate raw binary packets into human-readable fields. The system provides capabilities for protocol stream reconstruction, grouping related packets into cohesive conversations between endpoints. It also operates as a packet file converter, allowing for the reading, modification, and conversion of network capture files across vari

HaE is a network traffic analysis tool designed to extract, classify, and highlight specific data fragments within network messages and HTTP traffic. It functions as an HTTP data extractor and traffic content filter, utilizing a network metadata aggregator to centralize highlighted data fragments and annotations for analysis. The tool identifies high-value network packets by mapping classification results to visual color markers and employs a modular classification system to isolate data fragments from binary or text streams. It distinguishes the severity of matched data by piping extracted c

Zeek is a network analysis framework and security monitoring tool that transforms raw network packets into high-level semantic logs. It functions as an application protocol analyzer and network intrusion detection system designed to extract meaning from network traffic and monitor for malicious activity. The system focuses on archiving network activity and maintaining historical records of application-layer state for forensic investigation and auditing. It utilizes a combination of modular protocol analyzers and customizable detection policies to perform deep semantic analysis of numerous app

This project provides a set of curated configuration rules and domain lists for the Shadowrocket app. It consists of network traffic routing rules, ad-blocking domain lists, DNS configuration profiles, and proxy bypass lists used to filter and direct network traffic. The rules establish policy-based routing logic to determine whether specific traffic is proxied, connected directly, or rejected. This includes specialized lists for proxy bypass management and the blocking of known advertising and tracking domains at the network level. The project covers a broad range of traffic management capa

RealiTLScanner is a TLS configuration scanner and network security auditor designed to identify security settings across IP addresses and domains. It functions as a target discovery tool that analyzes TLS configurations to find compatible endpoints and evaluate server security postures. The project distinguishes itself as a geolocation-enhanced network scanner, appending geographic location data and country codes to discovered security configurations using a local location database. This allows for the geographic mapping of servers by combining TLS scan results with GeoIP data. The tool supp

WindowsSpyBlocker is a suite of utilities designed to stop operating system data collection and tracking by applying firewall rules, hosts file blocks, and telemetry restrictions. It functions as a telemetry blocker and firewall manager that prevents the operating system from sending usage data to remote servers. The project features a specialized connectivity modifier for adjusting the network connectivity status indicator to prevent external reporting. It includes a network traffic auditor to capture and analyze system traffic to identify spying activities, alongside a manager for DNS and h

Surge is a network traffic routing and configuration system designed to categorize and steer network requests using curated rule sets, domain lists, and IP databases. It provides the data structures and filtering logic necessary to manage how application traffic is directed across proxies, direct connections, or regional gateways. The project distinguishes itself through granular traffic identification and steering. It identifies network requests by matching them against system process names, user-agent strings, and geographic IP ranges to apply specific routing policies. This allows for the

This project provides an iOS app ad-blocking ruleset, consisting of network traffic filter lists and proxy-based content filters. It functions as a collection of rewrite rules and scripts designed to intercept and modify network requests to remove advertisements from mobile applications. The system utilizes HTTP response modification scripts to alter the bodies of network responses. Beyond ad blocking, these scripts enable in-app content translation, such as providing translated song lyrics within music applications. The ruleset employs a pattern-matching engine using regular expressions and

multi-v2ray is a management panel and orchestration system for deploying and configuring V2Ray and Xray cores. It functions as a multi-user proxy manager that uses containerized deployments to isolate proxy instances and manage user accounts through a central web interface. The system distinguishes itself by integrating a CDN proxy gateway to tunnel traffic through content delivery networks and hide server origins. It includes an orchestrator for automated Xray network proxy installation and provides tools to generate shareable configuration strings and connection links for client provisionin

ntopng is a web-based network traffic monitoring tool and flow data aggregator. It functions as a network security monitor, an SNMP network management system, and an industrial protocol analyzer for OT and SCADA environments. The system provides specialized inspection for industrial protocols such as Modbus, DNP3, and IEC 60870. It distinguishes itself through behavioral threat detection, encrypted traffic analysis via handshake fingerprinting, and the ability to identify hardware and operating systems using DHCP and MAC address patterns. Its broader capabilities include real-time traffic an

Maltrail is a malicious traffic detection system used for network intrusion detection. It consists of a network intrusion sensor for monitoring interfaces, a threat intelligence aggregator for syncing blacklists, and a detection engine that identifies security threats through signature matching and heuristic attack patterns. The system distinguishes itself through a distributed sensor architecture that collects traffic data from multiple remote probes and forwards events to a central analysis server. It employs heuristic behavioral analysis to identify unknown threats, such as port scanning o

GhostTrack is an open-source intelligence (OSINT) framework that aggregates geographic, network, and social identity information from public data sources. It functions as a digital footprint analyzer, collecting various pieces of publicly available information to build comprehensive profiles of target individuals. The framework combines multiple investigative capabilities into a single tool, including IP address geolocation, phone number intelligence, and social media username discovery. It distributes queries across external data services to maximize coverage and accuracy, resolving IP addre

This project is an Android RPA framework designed for automating user interfaces and system tasks on rooted Android devices using Python and ADB. It provides a suite of tools for rooted device management, allowing for programmatic control of system settings, application lifecycles, and shell command execution via a remote API. The framework distinguishes itself through a combination of dynamic instrumentation and AI integration. It can inject scripts into running processes to hook Java interfaces and modifies application behavior in real time. Additionally, it supports large language model in

iperf is IP network measurement software designed to quantify data transfer rates and network stability. It functions as a network performance benchmarking tool that tests capacity and throughput between two hosts to identify bottlenecks and performance limits. The tool specifically measures maximum bandwidth and packet loss over IP networks using TCP and UDP protocols. It also serves as a network data exporter, outputting performance results in JSON format for programmatic analysis and integration. The software covers a range of capabilities including network throughput analysis and traffic

ThreatMapper is a cloud native application protection platform and infrastructure security scanner. It functions as a vulnerability management system and cloud workload telemetry collector designed to monitor workloads and detect security risks across cloud and container environments. The platform distinguishes itself through a network traffic visualizer that uses machine learning to classify communication patterns and a graph-based attack mapping system to identify high-risk paths between vulnerabilities and network dependencies. Its broader capabilities cover cloud infrastructure complianc

GeoLite.mmdb is a curated repository of prebuilt MaxMind GeoIP databases in the MMDB binary format, providing ready-to-use files for mapping IP addresses to geographic locations and autonomous system network providers without requiring a MaxMind account or manual compilation. The project serves as a central source for country-level, city-level, and autonomous system number (ASN) databases that enable fast, decompression-free IP lookups. The repository delivers three primary database files: the GeoLite2 Country database for resolving IP addresses to their registered countries, the GeoLite2 Cit

Ecapture is a suite of specialized auditing tools designed to capture plaintext database queries, log executed shell commands, forward packet captures, and decrypt TLS traffic. The system extracts plaintext content from encrypted communications and TLS master secrets without requiring CA certificates. It further monitors data interactions by capturing SQL queries from database instances and recording commands from shell environments for host-level auditing. The toolset includes capabilities for network traffic analysis, exporting captured data to pcapng files, and forwarding events to extern

bandwhich is a command-line network utility and terminal bandwidth monitor designed for real-time traffic analysis. It functions as a process-based traffic tracker that links network bandwidth usage directly to the system processes and remote hosts responsible for the data transfer. The tool provides a terminal user interface for monitoring active connections and identifying data-consuming applications. It performs background reverse DNS lookups to associate remote IP addresses with human-readable hostnames and tracks cumulative data utilization over the duration of a capture session. Its br

Kyanos is a diagnostic toolset for network analysis that uses eBPF to measure packet latency and trace traffic from the network card to the application. It functions as a kernel latency profiler and network performance monitor, providing capabilities to map external dependencies and capture network traffic. The project is distinguished by its ability to perform automatic SSL traffic decryption, converting encrypted requests and responses into plaintext for analysis. It further isolates bottlenecks by attributing latency across multiple stages, specifically tracing the time packets spend withi

Somo is a command line network utility and connection monitor used for filtering, sorting, and formatting network connection lists. It functions as an interactive process killer, allowing users to identify and terminate network processes based on their active connection data. The tool provides specialized network monitoring capabilities, including active socket and port tracking with port-to-service name resolution. It enables the administration of system sockets by sending termination signals to close specific network connections. Data management is handled through predicate-based filtering

Clash-rules provides a standardized, declarative system for managing network traffic routing across desktop and mobile proxy clients. It functions as a centralized configuration provider that uses structured rule sets to categorize outgoing requests, allowing users to define whether specific connections should be proxied, rejected, or routed directly. The project distinguishes itself through its comprehensive, curated rulesets that enable granular control over network behavior. By employing domain-pattern matching, CIDR-based network analysis, and application-specific signatures, it ensures c

Grav is a flat-file content management system that eliminates the need for a traditional database by storing site content and configuration in human-readable Markdown and YAML files. Built as a modular PHP web framework, it uses a hierarchical page routing system where the physical directory structure directly determines the site's URL paths. The platform is distinguished by its event-driven plugin architecture and a command-line interface that prioritizes system administration, deployment, and maintenance tasks. It utilizes a blueprint-driven system to generate administrative forms from stru

This project is a community-maintained directory that serves as a comprehensive index of software tools, frameworks, and educational materials. It functions as an open-source knowledge base, organizing diverse engineering domains and technical resources into a structured taxonomy to assist developers in discovering high-quality content. The directory distinguishes itself through a decentralized peer-review model, where independent contributors curate, verify, and update entries to ensure accuracy and relevance. All information is stored in a version-controlled, flat-file markdown format, whic

Netfox is an iOS and macOS network debugging library designed to intercept and monitor HTTP traffic. It functions as an in-app HTTP traffic inspector that captures request headers and response bodies for real-time network analysis. The tool provides a network performance monitor to calculate response times and data sizes, as well as a network log exporter for sharing captured request and response data via email. The project covers network analysis capabilities including traffic filtering to exclude specific URLs, request body capture, and a debug interface that can be toggled via programmati