Enable and update the ip filter block list in uTorrent (ipfilter.dat)

If you've been using uTorrent to download for a while you may have found yourself receiving lots of wasted data. This is data that has been discarded after being deemed corrupt or invalid by uTorrent.

This usually happens because Anti-P2P organizations are polluting P2P networks with fake peers, which send out fake or corrupt data in order to waste bandwidth and slow down file transfers. There is also a a more serious side to this, once you've established a connection to one of these fake "peers", your IP has been logged and will most likely be sent to the RIAA, MPAA or your ISP to inform them what you have been downloading.

You can easily block these bad IP ranges in uTorrent by enabling the IP filter and using a simple script to update the IP block list each day.

Load uTorrent up, select Options > Preferences > Advanced then find ipfilter.enable. set the value to true then press ok.



Now all you need to do is install this simple script called the “uTorrent IP Filter Updater” this is a self extracting WinRAR script that will add the ipfilter.dat file to %AppData%\uTorrent\ and place a shortcut on your desktop to update the IP Filter block list.

Download uTorrent IP Filter Updater (Mega)
Download uTorrent IP Filter Updater (ZippyShare)

If this link is ever broken let me know and i'll update it.

Close uTorrent and run this script, it will download the latest ipfilter.dat block list and place it in the correct place for uTorrent to make use of it. If you run the ipfilter update when utorrent is still running you will need to disable and re enable the filter in uTorrent for it to make use of the new list.

The update script running.


Update the script every so often and hopefully your uTorrent wont connect to any bad IP ranges.

A thanks mate! I'll do this so I don't get caught lol..

Thanks for the article, I've had enough trouble from these stupid organisations, so I keep on finding ways of outcoming them*

Why not installing PeerGuardian2? Works for me!

It doesn't work on Windows Vista / Windows 7, well it didn't at the time of posting.

It looks like a working beta version has been released now.

Its working for me under MS windows 7 Ultimate edition x64
also I am running the newer uptodate 1.8.5 version of the Utorrent client

While this is good and does provide some degree of protection if you want the best protection get shot of MS Winblows alltogether and install something like Ubuntu Linux
you have ipblock to drop connections to known bad ip ranges (can use same block lists as peergaurdian2/peerblock and will be more uptodate than utorrents ipfillter) and deluge bittorrent client wich allows you to encrypt the entire data stream including the handshaking process

Utorrent is stoping a connection to your torrent client the bad guys know you are there because they were able to connect to your machine (now they know you are there they can take steps to shut down and overcome you protection)

IPBlock (linux) / PeerBlock (windows) is droping the connections for known bad ip's to the machine the baddies are not aware that you are even there


Also Linux especialy Ubuntu (this is wot i am using there are many different versions of linux) has gotten way better and is easy to setup and use by the novie as an every day desktop infact its faster / safer / requires less from your hardware hell you dont even have to run a virus scanner rflmao windows is for gamers and even that is changing

After an upgrade to a newer faster gaming rig i keept my old hardware and installed Ubuntu on it now i use this to do all of my web browsing / downloading / home entertainment / fileserver (this also helps to keep down the power bill and prolong the life of my new gaming box)

Best of all its Free Ubuntu Home Page | Ubuntu
and comes on a LIVE Bootable disk so you can try it before installing it as allways backup any important information on your hard disk before using just incase

Extra Info's

windows
http://www.peerblock.com/
Linux
http://sourceforge.net/projects/iplist/
http://www.ubuntugeek.com/ipblock-graphical-ip-blocker.html

alternative Torrent client Deluge
http://deluge-torrent.org/
allows you to encrypt the entire network stream including the handshaking process works n both windows and linux

Awesome stuff but I made a small update.

I made changes so to check that new incoming ipfilter.dat is larger than the old one, felt as if DNS poisoning ever happened or something like that no one can empty my file! I also added this as a task in task scheduler to run nightly as well. Here is my modified batch file. Let me know what you think!


NOTE: You will need to set homedir_utorrent variable to your utorrent Appdata folder(should be where your ipfilter.dat file is now)

Sounds like a useful update , to attach the file you will need to zip it up.

TheQuonk said:

NOTE: You will need to set homedir_utorrent variable to your utorrent Appdata folder(should be where your ipfilter.dat file is now)

Click to expand...

set homedir_utorrent=%appdata%\uTorrent

updated version

I noticed the website you were using hasn't updated their IP filter list since August. I decided to move to bluetack's nipfilter.dat.gz but they haven't updated in even longer (or my ISP is sending their own version), so it seems they force you to go to their blocklist pro website and download manually as I cannot find a direct link. Luckily, deluge mirrors the npfilter.dat.gz files on their website, so I changed the link to download their filter, which is updated daily.

Also included is tracker1's appdata directory fix so that nobody needs to edit the script to get it working.

Just put the files into your %appdata%\uTorrent directory and run. If you have used the previous files, remove the old ipfilter.dat since it may be larger. I also recommend setting up task scheduler to automatically run the script weekly (or daily).

Enjoy

Hello,

Thanks for making this! I have set this up and it is working.
But how do I know if the blocklist link is changed?
Currently the batch file points to: deluge-torrent.org/blocklist/nipfilter.dat.gz

Is there a page on deluge where you can see the current blocklist? (I have looked for it in the FAQ etc...)
Or is there another way to make sure the content behind: deluge-torrent.org/blocklist/nipfilter.dat.gz is up to date?

Thanks again for this man!

dragonetti said:

Hello,
Is there a page on deluge where you can see the current blocklist? (I have looked for it in the FAQ etc...)

Click to expand...

The current version on deluge is from 2011-06-13 externally, but no info on when it was generated or packaged.

The original source is from bluetack.co.uk, but I can't post the links because the forum calls them spam links.

The nipfilter from bluetack is 2010-03-29 and it's pay only for the new DL area.

To get the current filter list (2012-01-29), you need one or more of:
* level1.zip - Anti-P2P Threats
* level2.zip - Corporate addresses - not necessarily bad, but who knows.
* badpeers.gz - Reported by P2P users for corrupt data, virii, etc
It's bluetack co uk slash config slash one of those files.

The format of these is different from nipfilter.dat. To convert this, swap the fields around a little to get:
rangestart - rangestop , 000 , 10char descript

You can use the Bluetack blocklist manager free, or donate to get their updated versions pre-generated for you.

They also have simple firewall tools that will use their filter lists. Good for young kids, good for P2P folks.

The "Normal" filter, NIPFilter.dat includes:

Bad Peers list
Bogon
D-Shield
Hijacked
IANA Multicast
IANA Private
IANA Reserved
Level 1 [ Anti-P2P ]
Level 2 [ Corp ]
Microsoft
Non Lan List

Click to expand...

The "Paranoid" filter, PIPfilter.dat includes:

Ad-Trackers-Scams
Bad Peers List
Bogon
D-Shield
EDU
Hijacked
IANA Multicast
IANA Private
IANA Reserved
Level 1 [ Anti-P2P ]
Level 2 [ Corp ]
Level 3
Microsoft
Non Lan List
Proxy
Spiders
Malware ( aka : Spyware )

Click to expand...

bobbert said:

I noticed the website you were using hasn't updated their IP filter list since August. I decided to move to bluetack's nipfilter.dat.gz but they haven't updated in even longer (or my ISP is sending their own version), so it seems they force you to go to their blocklist pro website and download manually as I cannot find a direct link. Luckily, deluge mirrors the npfilter.dat.gz files on their website, so I changed the link to download their filter, which is updated daily.

Also included is tracker1's appdata directory fix so that nobody needs to edit the script to get it working.

Just put the files into your %appdata%\uTorrent directory and run. If you have used the previous files, remove the old ipfilter.dat since it may be larger. I also recommend setting up task scheduler to automatically run the script weekly (or daily).

Enjoy

Click to expand...

I know this is an old thread but hopefully someone is still answering. I downloaded the batch file for the IPFilter updater and it seems to be working. I run it through task scheduler weekly. Is this still an up to date list and filter?*-)

I started using the ipfilter and now the wasted amount with number of hashfails insanely increased. Yesterday 80 MB for a 40 MB file was downloaded. I set-up according t the forum. What should I do?

This uTorrent IP Filter Updater contains a file named wget.exe which is malware BTW, it is hiding the real server by encripting it's name, it is creating a proxy on your PC by changing one of your files and in the process keeping its real name date of creation, date of last modification to the file and even goes to the extend where it forges the digital certificate of the file so it looks normal in any way. It also saves a forged coockie on your computer, it also gets your user name and password for your computer and leavs a backdoor. Also it makes a cache faile which contains spam which will be send from your computer until some KB, MB or even GB of messages are send from your PC, and it also makes who knows what. How do I know this I desassembled the wget.exe file and I'm certain it has unwanted funconts, not only the program which does its job well.

This kind of tricks where someone is making a sowtware which you realy need and BTW it is hacking your computer and later using it as a distributed system from where he can send SPAM messagea, makes DoS attacks on various servers e.t.c.

I'VE SAID ENOGHT I THINK, FOR A REGULAR USER TO SEE THE SCAM...BYE

pecko88 said:

This uTorrent IP Filter Updater contains a file named wget.exe which is malware BTW

Click to expand...

Really... does all that without admin rights too i bet.

Its an open source application for downloading files from web / ftp servers.

To quote the webpage for the Windows port:

GNU Wget is a free network utility to retrieve files from the World Wide Web using HTTP and FTP, the two most widely used Internet protocols. It works non-interactively, thus enabling work in the background, after having logged off.

The recursive retrieval of HTML pages, as well as FTP sites is supported -- you can use Wget to make mirrors of archives and home pages, or traverse the web like a WWW robot (Wget understands /robots.txt).

Wget works exceedingly well on slow or unstable connections, keeping getting the document until it is fully retrieved. Re-getting files from where it left off works on servers (both HTTP and FTP) that support it. Matching of wildcards and recursive mirroring of directories are available when retrieving via FTP. Both HTTP and FTP retrievals can be time-stamped, thus Wget can see if the remote file has changed since last retrieval and automatically retrieve the new version if it has.

Wget supports proxy servers, which can lighten the network load, speed up retrieval and provide access behind firewalls. If you are behind a firewall that requires the use of a socks style gateway, you can get the socks library and compile wget with support for socks.

Click to expand...

Read: Wget for Windows

pecko88 said:

This uTorrent IP Filter Updater contains a file named wget.exe which is malware BTW, it is hiding the real server by encripting it's name, it is creating a proxy on your PC by changing one of your files and in the process keeping its real name date of creation, date of last modification to the file and even goes to the extend where it forges the digital certificate of the file so it looks normal in any way. It also saves a forged coockie on your computer, it also gets your user name and password for your computer and leavs a backdoor. Also it makes a cache faile which contains spam which will be send from your computer until some KB, MB or even GB of messages are send from your PC, and it also makes who knows what. How do I know this I desassembled the wget.exe file and I'm certain it has unwanted funconts, not only the program which does its job well.

This kind of tricks where someone is making a sowtware which you realy need and BTW it is hacking your computer and later using it as a distributed system from where he can send SPAM messagea, makes DoS attacks on various servers e.t.c.

I'VE SAID ENOGHT I THINK, FOR A REGULAR USER TO SEE THE SCAM...BYE

Click to expand...

Hi, i downloaded and installed it. Is there a way to remove it?

Deruxian said:

Hi, i downloaded and installed it. Is there a way to remove it?

Click to expand...

ROFL. You installed it? You are so screwed! OK. LOL, seriously, even after InsaneNutter's explanation do you still think its a malware? Then just don't use it. Go back to the utorrent folder (%appdata%\uTorrent) and just delete the "ipfilter.dat" file.and you're done.

pecko88 said:

This uTorrent IP Filter Updater contains a file named wget.exe which is malware BTW, it is hiding the real server by encripting it's name, it is creating a proxy on your PC by changing one of your files and in the process keeping its real name date of creation, date of last modification to the file and even goes to the extend where it forges the digital certificate of the file so it looks normal in any way. It also saves a forged coockie on your computer, it also gets your user name and password for your computer and leavs a backdoor. Also it makes a cache faile which contains spam which will be send from your computer until some KB, MB or even GB of messages are send from your PC, and it also makes who knows what. How do I know this I desassembled the wget.exe file and I'm certain it has unwanted funconts, not only the program which does its job well.

This kind of tricks where someone is making a sowtware which you realy need and BTW it is hacking your computer and later using it as a distributed system from where he can send SPAM messagea, makes DoS attacks on various servers e.t.c.

I'VE SAID ENOGHT I THINK, FOR A REGULAR USER TO SEE THE SCAM...BYE

Click to expand...

If you ever took an entry level CS/CE course in college you would know of the Unix/Linux command "Wget". I used wget daily, along with putty, to SSH into my university's servers, downloading music etc... All it does is grabs files from the internet given an address and parameters on what to look for...

Linux and Unix wget command help and examples

p.s. i forged coockies in ur mum's backdoor.

Deruxian said:

Hi, i downloaded and installed it. Is there a way to remove it?

Click to expand...

The readme is included. It is a .txt file called READ_ME.txt. You can read it with Notepad or Wordpad.
If you've done the 'install' correctly, you've should've only extracted the following to your uTorrent directory:

ssleay32.dll
wget.exe
IP filter µpdater.bat
libeay32.dll

Delete them to 'uninstall.'