Shieldlist/shieldlist-controller
Watch
1
0
Fork
You've already forked shieldlist-controller
 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions
Page: Credits
Pages
API Abuse reports Configuration Credits Getting Started Home How it flows Installing Web UI What to expect in beta
9 Credits
Robin edited this page 2026-09-22 18:33:20 +00:00
Table of contents

Credits

Shieldlist stands on other people's work. It is credited here, in each repository's README, and on the Web UI's Settings → About page.

Map

Natural Earth country outlines, public domain — embedded in the Web UI, no tiles, no third party at run time.

Geolocation

With geoip: {source: dbip} the controller fetches the free DB-IP Lite databases monthly — country, ASN, and the city edition when turned on — IP Geolocation by DB-IP, licence CC BY 4.0. The country and ASN editions are served to the agents.

Published blocklists

The Web UI's catalogue (Lists → Blocked → Published blocklists), fetched only when turned on:

  • malicious-ip — Romain Marcoux's hourly aggregate of fifteen threat feeds (AbuseIPDB, AlienVault OTX, Blocklist.de, CINS, Emerging Threats, Talos, ISC SANS…), MIT licence.

Published allow lists

Fetched only when turned on (sources: in controller.yaml) — the address ranges their publishers make public: Google (Googlebot, the special-case crawlers), Microsoft (Bingbot), Apple (Applebot), DuckDuckGo (DuckDuckBot, DuckAssistBot), OpenAI (OAI-SearchBot, ChatGPT-User, GPTBot), Anthropic (Claude-User, Claude-SearchBot, ClaudeBot), Perplexity (Perplexity-User, PerplexityBot), Mistral AI (MistralAI-User, MistralAI-Index; and its outbound addresses, for MCP connectors), Google's user-triggered fetchers, PrestaShop (CloudSync), Cloudflare, Fastly, Ahrefs, Automattic (Jetpack), UptimeRobot, Pingdom, Stripe (webhooks).

Rules

Parts of the rule packs are translated from the CrowdSec hub (MIT); the bad-bots list is built from Mitchell Krogza's nginx-ultimate-bad-bot-blocker.

Abuse reports

The X-ARF export (an address's or a network's Abuse report…, format X-ARF) follows the XARF specification version 4 by the XARF Project, MIT licence — xarf.org. No code of theirs is used; the documents are written to their schemas.

The networks' abuse desks are found through the free Abusix Abuse Contact DB — one DNS query per network, the answer drawn from the five RIRs' records; every mail it addressed acknowledges it, as Abusix asks — then, when the operator keeps them locally (Settings → Abuse reports → Keep the registries' data locally), the registries' own databases: the RIPE Database, data of the RIPE NCC under the RIPE Database Terms and Conditions, and the AFRINIC database, data of AFRINIC under its Database Terms and Conditions — fetched as the dumps the registries publish, personal data removed by them, abuse mailboxes kept; every mail addressed from them says so. And, failing that, the registries' own RDAP service through rdap.org. (APNIC masks the mailboxes in its dump; ARIN and LACNIC give bulk data on agreement only.) The delivery failures are read over IMAP with go-imap by Simon Ser, MIT licence.

Software

The Go modules each binary links, under their own licences, are listed in THIRD_PARTY_LICENSES in each repository.