Add the following to your sing-box client configuration:

"outbounds": [
  {
    "type": "direct",
    "tag": "direct"
  },
  {
    "type": "block",
    "tag": "block"
  }
],
"route": {
    "rules": [
      {
        "ip_is_private": true,
        "outbound": "direct"
      },
      {
        "rule_set": [
          "geosite-category-ads-all",
          "geosite-malware",
          "geosite-phishing",
          "geosite-cryptominers",
          "geoip-malware",
          "geoip-phishing"
        ],
        "outbound": "block"
      },
      {
        "rule_set": [
          "geosite-ir",
          "geoip-ir"
        ],
        "outbound": "direct"
      }
    ],
    "rule_set": [
      {
        "tag": "geosite-ir",
        "type": "remote",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/rule-set/geosite-ir.srs"
      },
      {
        "tag": "geosite-category-ads-all",
        "type": "remote",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/rule-set/geosite-category-ads-all.srs"
      },
      {
        "tag": "geosite-malware",
        "type": "remote",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/rule-set/geosite-malware.srs"
      },
      {
        "tag": "geosite-phishing",
        "type": "remote",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/rule-set/geosite-phishing.srs"
      },
      {
        "tag": "geosite-cryptominers",
        "type": "remote",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/rule-set/geosite-cryptominers.srs"
      },
      {
        "tag": "geoip-ir",
        "type": "remote",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/rule-set/geoip-ir.srs"
      },
      {
        "tag": "geoip-malware",
        "type": "remote",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/rule-set/geoip-malware.srs"
      },
      {
        "tag": "geoip-phishing",
        "type": "remote",
        "format": "binary",
        "url": "https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/rule-set/geoip-phishing.srs"
      }
    ]
  },
  "experimental": {
    "cache_file": {
      "enabled": true
    }
  }

Add the following to your sing-box client configuration:

"outbounds": [
  {
    "type": "direct",
    "tag": "direct"
  },
  {
    "type": "block",
    "tag": "block"
  }
],
"route": {
  "geoip": {
      "download_url": "https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/release/geoip.db"
  },
  "geosite": {
    "download_url": "https://raw.githubusercontent.com/Chocolate4U/Iran-sing-box-rules/release/geosite.db"
  },
  "rules": [
    {
      "geosite": [
        "category-ads-all",
        "malware",
        "phishing",
        "cryptominers"
      ],
      "outbound": "block"
    },
    {
      "geoip": [
        "malware",
        "phishing"
      ],
      "outbound": "block"
    },
    {
      "geosite": "ir",
      "outbound": "direct"
    },
    {
      "geoip": [
        "ir",
        "private"
      ],
      "outbound": "direct"
    }
  ]
}

• Contains IP Addresses of all countries from Maxmind and IP2Location databases.

• geoip:ir
  Contains Iran IP addresses from Maxmind and IP2Location databases, IP addresses of Iranian messengers such as eitaa, rubika, etc. and IP addresses of arvancloud, derakcloud, iranserver and parspack CDNs.

• geoip:private
  Contains a list of local (LAN) IP addresses.

• geoip:arvancloud
  Contains the IP addresses of ArvanCloud.ir CDN. ℹ️ Integrated in geoip:ir and no longer needed to be written as a separate rule.

• geoip:derakcloud
  Contains the IP addresses of Derak.cloud CDN. ℹ️ Integrated in geoip:ir and no longer needed to be written as a separate rule.

• geoip:iranserver
  Contains the IP addresses of IranServer.com CDN. ℹ️ Integrated in geoip:ir and no longer needed to be written as a separate rule.

• geoip:parspack
  Contains the IP addresses of ParsPack.com CDN. ℹ️ Integrated in geoip:ir and no longer needed to be written as a separate rule.

• geoip:cloudflare
  Contains the IP addresses of Cloudflare CDN.

• geoip:google
  Contains the IP addresses of Google, GoogleCloud and GoogleBot.

• geoip:amazon
  Contains the IP addresses of Amazon and Amazon Web Services (AWS).

• geoip:microsoft
  Contains the IP addresses of Microsoft and Azure Platform.

• geoip:bing
  Contains the IP addresses of Bing and Bingbot.

• geoip:github
  Contains the IP addresses of GitHub.

• geoip:facebook
  Contains the IP addresses of the Meta ecosystem, including Facebook, Instagram and WhatsApp.

• geoip:twitter
  Contains the IP addresses of Twitter (now called X!).

• geoip:telegram
  Contains the IP addresses of Telegram Messenger.

• geoip:oracle
  Contains the IP addresses of Oracle Cloud.

• geoip:digitalocean
  Contains the IP addresses of DigitalOcean-related services.

• geoip:linode
  Contains the IP addresses of Linode-related services.

• geoip:openai
  Contains the IP addresses of OpenAI and ChatGPT.

• geoip:phishing
  Contains Phishing IP addresses.

• geoip:malware
  Contains Active Malware IP addresses.

• geoip:ir
  Contains Iran IP addresses from Maxmind and IP2Location databases, IP addresses of Iranian messengers such as eitaa, rubika, etc. and IP addresses of arvancloud, derakcloud, iranserver and parspack CDNs.

• geoip:private
  Contains a list of local (LAN) IP addresses.

• geoip:phishing
  Contains Phishing IP addresses.

• geoip:malware
  Contains Active Malware IP addresses.

• geoip:arvancloud
  Contains the IP addresses of ArvanCloud.ir CDN.

• geoip:derakcloud
  Contains the IP addresses of Derak.cloud CDN.

• geoip:iranserver
  Contains the IP addresses of IranServer.com CDN.

• geoip:parspack
  Contains the IP addresses of ParsPack.com CDN.

• geoip:cloudflare
  Contains the IP addresses of Cloudflare CDN.

• geoip:google
  Contains the IP addresses of Google, GoogleCloud and GoogleBot.

• geoip:amazon
  Contains the IP addresses of Amazon and Amazon Web Services (AWS).

• geoip:microsoft
  Contains the IP addresses of Microsoft and Azure Platform.

• geoip:bing
  Contains the IP addresses of Bing and Bingbot.

• geoip:github
  Contains the IP addresses of GitHub.

• geoip:facebook
  Contains the IP addresses of the Meta ecosystem, including Facebook, Instagram and WhatsApp.

• geoip:twitter
  Contains the IP addresses of Twitter (now called X!).

• geoip:telegram
  Contains the IP addresses of Telegram Messenger.

• geoip:oracle
  Contains the IP addresses of Oracle Cloud.

• geoip:digitalocean
  Contains the IP addresses of DigitalOcean-related services.

• geoip:linode
  Contains the IP addresses of Linode-related services.

• geoip:openai
  Contains the IP addresses of OpenAI and ChatGPT.

• All categories from domain-list-community are supported, plus the following categories:

• geosite:ir
  Contains non-ir TLD Iranian domains (e.g. .com .net .org etc.) and rules to bypass all .ir domains.

• geosite:ads
  Contains a list of Persian advertisement and tracking domains.

• geosite:category-ads-all
  Contains a curated list of Persian and Foreign advertisement and tracking domains based on multiple sources. It is optimized to have as low as possible false positives while also retaining a small size and efficiency.

• geosite:malware
  Contains a list of active malware domains.

• geosite:phishing
  Contains a list of scam and phishing domains.

• geosite:cryptominers
  Contains a list of cryptocurrency miners that run in the background of a web browser and affect system performance.

• geosite:social
  Contains Domain Addresses of popular social media platforms, including Facebook, Instagram, Whatsapp, Twitter, LinkedIn, MySpace, Pinterest, Tumblr, Reddit, TikTok, clubhouse.

• geosite:nsfw Contains a list of porn and gambling websites.

• geosite:ir
  Contains non-ir TLD Iranian domains (e.g. .com .net .org etc.) with dead domains removed and rules to bypass all .ir domains.
  All IR domains from normal GeoSite get checked every 24 hours and after the removal of non-active domains, will get in this category.
  The test may not be very accurate, so I recommend updating this list daily or regularly.
• geosite:ads
  Contains a list of Persian advertisement and tracking domains.

• geosite:category-ads-all
  Contains a curated list of Persian and Foreign advertisement and tracking domains based on multiple sources. It is optimized to have as low as possible false positives while also retaining a small size and efficiency.

• geosite:malware
  Contains a list of active malware domains.

• geosite:phishing
  Contains a list of scam and phishing domains.

• geosite:cryptominers
  Contains a list of cryptocurrency miners that run in the background of a web browser and affect system performance.