diff --git a/Build/build-internal-reverse-chn-cidr.ts b/Build/build-internal-reverse-chn-cidr.ts
index 5d9213b0..94f1bf92 100644
--- a/Build/build-internal-reverse-chn-cidr.ts
+++ b/Build/build-internal-reverse-chn-cidr.ts
@@ -4,8 +4,9 @@ import path from 'path';
 import fsp from 'fs/promises';
 import { task } from './lib/trace-runner';
 
-import { exclude } from 'fast-cidr-tools';
+import { exclude, merge } from 'fast-cidr-tools';
 
+// https://en.wikipedia.org/wiki/Reserved_IP_addresses
 const RESERVED_IPV4_CIDR = [
   '0.0.0.0/8',
   '10.0.0.0/8',
@@ -15,6 +16,7 @@ const RESERVED_IPV4_CIDR = [
   '172.16.0.0/12',
   '192.0.0.0/24',
   '192.0.2.0/24',
+  // 192.88.99.0 // is currently being broadcast by HE and Comcast
   '192.168.0.0/16',
   '198.18.0.0/15',
   '198.51.100.0/24',
@@ -30,15 +32,16 @@ export const buildInternalReverseChnCIDR = task(import.meta.path, async () => {
     fsp.mkdir(path.resolve(import.meta.dir, '../List/internal'), { recursive: true })
   ]))[0];
 
-  const reversedCidr = exclude(
-    [
-      '0.0.0.0/0',
+  const reversedCidr = merge(
+    exclude(
+      ['0.0.0.0/0'],
+      RESERVED_IPV4_CIDR.concat(cidr),
+      true
+    ).concat([
       // https://github.com/misakaio/chnroutes2/issues/25
       '223.118.0.0/15',
       '223.120.0.0/15'
-    ],
-    RESERVED_IPV4_CIDR.concat(cidr),
-    true
+    ])
   );
 
   return Bun.write(path.resolve(import.meta.dir, '../List/internal/reversed-chn-cidr.txt'), `${reversedCidr.join('\n')}\n`);
diff --git a/README.md b/README.md
index b89e3a15..2938353d 100644
--- a/README.md
+++ b/README.md
@@ -27,6 +27,7 @@
 
 ```ini
 # Non IP
+RULE-SET,https://ruleset.skk.moe/List/ip/reject-drop.conf,REJECT-DROP
 DOMAIN-SET,https://ruleset.skk.moe/List/domainset/reject.conf,REJECT-TINYGIF
 RULE-SET,https://ruleset.skk.moe/List/non_ip/reject.conf,REJECT
 # IP
@@ -37,6 +38,13 @@ RULE-SET,https://ruleset.skk.moe/List/ip/reject.conf,REJECT-DROP
 
 ```yaml
 rule-providers:
+  reject_non_ip_drop:
+    type: http
+    behavior: classical
+    format: text
+    interval: 43200
+    url: https://ruleset.skk.moe/Clash/non_ip/reject-drop.txt
+    path: ./sukkaw_ruleset/reject_non_ip_drop.txt
   reject_non_ip:
     type: http
     behavior: classical
@@ -61,6 +69,7 @@ rule-providers:
     path: ./sukkaw_ruleset/reject_ip.txt
 
 rules:
+  - RULE-SET,reject_non_ip_drop,REJECT-DROP
   - RULE-SET,reject_non_ip,REJECT
   # WARNING! Using reject_domainset can cause Clash out of memory due to the insufficient Clash implementation.
   - RULE-SET,reject_domainset,REJECT
diff --git a/Source/domainset/download.conf b/Source/domainset/download.conf
index 3e7f3ae3..f10d6d9b 100644
--- a/Source/domainset/download.conf
+++ b/Source/domainset/download.conf
@@ -170,6 +170,7 @@ mirrors.edge.kernel.org
 .mirrors.dotsrc.org
 .mirror.clarkson.edu
 .mirror.constant.com
+ftp.gnu.org
 # WhatPulse
 releases.whatpulse.org
 # GIMP
diff --git a/Source/domainset/reject_sukka.conf b/Source/domainset/reject_sukka.conf
index f4047b6d..02b1e6b4 100644
--- a/Source/domainset/reject_sukka.conf
+++ b/Source/domainset/reject_sukka.conf
@@ -10,8 +10,10 @@
 .sharethrough.com
 .clicktale.net
 optimus-ads.amap.com
+.flash.cn
 .geo2.adobe.com
 .2144.cn
+.2144.com
 .laomaotao.net
 .weddingeeos.com
 .rjno1.com
diff --git a/Source/ip/domestic.conf b/Source/ip/domestic.conf
index cacf3084..e54b5436 100644
--- a/Source/ip/domestic.conf
+++ b/Source/ip/domestic.conf
@@ -1,4 +1,7 @@
 # $ meta_title Sukka's Ruleset - Mainland China Supplement CIDR
 # $ meta_description This file contains IPs broadcast inside Mainland China.
 
+# cloud.tencent.com AIA
 IP-CIDR,162.14.0.0/18,no-resolve
+# aliyun.com Premium DNS
+IP-CIDR,140.205.1.0/24,no-resolve
diff --git a/Source/non_ip/reject-drop.conf b/Source/non_ip/reject-drop.conf
new file mode 100644
index 00000000..72e96510
--- /dev/null
+++ b/Source/non_ip/reject-drop.conf
@@ -0,0 +1,4 @@
+# $ meta_title Sukka's Ruleset - Reject And Drop
+# $ meta_description This file This file contains rules for domain should be used with REJECT-DROP policy.
+
+DOMAIN-SUFFIX,geo2.adobe.com