Block malware IPs and domains

[jimaek]

Lets also integrate anti-abuse logic. To stop people using probes to connect to malicious IPs and domains. Any request to a banned domain should be stopped by the API before even getting to any probe. Lists I propose using:

• IP list https://osint.digitalside.it/Threat-Intel/lists/latestips.txthttps://github.com/firehol/blocklist-ipsets and IP list 2 https://github.com/stamparm/ipsum with example how to parse them if needed https://github.com/EnergizedProtection/block/blob/master/extensions/ips/build.sh also https://osint.digitalside.it/Threat-Intel/lists/latestips.txt
• Domains https://zonefiles.io/compromised-domain-list/ https://osint.digitalside.it/ https://phishing.army/ https://urlhaus.abuse.ch/downloads/hostfile/
• Google safe browsing local DB with hashes we can query before running a test https://developers.google.com/safe-browsing/v4/update-api

Its important since people could be running probes in their homes so we need to do our best to protect them. Lists can be auto-updated during API deployment

Originally posted by @jimaek in https://github.com/jsdelivr/globalping/issues/1#issuecomment-1044580719

[patrykcieszkowski]

I've added all of them, except the Google safe db. I would leave that for later, if this basic implementation would end up not meeting our expectations.

https://github.com/jsdelivr/globalping/pull/84/files#diff-f9d4d76b0499b7e6bd50077a5f11b08d6bbd7d26640fa18ff7b7aeb856560178R7

https://github.com/jsdelivr/globalping/pull/84/files#diff-564f7e2138a76bab3217918662c7fe4afa4fcdd7093c63b39420b3def230d977R7