Table of contents
Credits
Shieldlist stands on other people's work. It is credited here, in each repository's README, and on the console's Settings → About page.
Map
Natural Earth country outlines, public domain — embedded in the console, no tiles, no third party at run time.
Geolocation
With geoip: {source: dbip} the controller fetches the free DB-IP Lite
databases monthly — country, ASN, and the city edition when turned on —
IP Geolocation by DB-IP, licence CC BY 4.0. The
country and ASN editions are served to the agents.
Published blocklists
The console's catalogue (Lists → Blocked → Published blocklists), fetched only when turned on:
- malicious-ip — Romain Marcoux's hourly aggregate of fifteen threat feeds (AbuseIPDB, AlienVault OTX, Blocklist.de, CINS, Emerging Threats, Talos, ISC SANS…), MIT licence.
Published allow lists
Fetched only when turned on (sources: in controller.yaml) — the address ranges their publishers make public:
Google (Googlebot, the special-case crawlers), Microsoft (Bingbot), Apple
(Applebot), DuckDuckGo (DuckDuckBot), OpenAI (OAI-SearchBot, ChatGPT-User,
GPTBot), Cloudflare, Fastly, Ahrefs, Automattic (Jetpack), UptimeRobot,
Pingdom, Stripe (webhooks).
Rules
Parts of the rule packs are translated from the CrowdSec hub (MIT); the bad-bots list is built from Mitchell Krogza's nginx-ultimate-bad-bot-blocker.
Software
The Go modules each binary links, under their own licences, are listed in
THIRD_PARTY_LICENSES in each repository.