Data Sources

Every built-in data source, what database it produces, the upstream providers it fetches from, and the record structure it compiles.

Shield Base fetches data from 13 built-in sources across five categories: network routing, geographic location, anonymity and proxy detection, threat intelligence, and application-layer fingerprints. Each source produces one or more binary database files in either MMDB format (IP range lookups) or LMDB format (key-value lookups).


Sources at a Glance

SourceFlagOutput fileFormat
BGP / ASN--bgpasn.mmdbMMDB
City Geolocation--citycity.mmdbMMDB
Country Geolocation--geocountry.mmdbMMDB
Proxy Detection--proxyproxy.mmdbMMDB
Tor Nodes--tortor.mmdbMMDB
Verified Crawlers--seogoodBots.mmdbMMDB
FireHOL Threats--l1 --l2 --l3 --l4 --anonymousfirehol_*.mmdbMMDB
Suspicious User-Agents--useragentuseragent-db/useragent.mdbLMDB
Disposable Emails--emailemail-db/disposable-emails.mdbLMDB

Database Formats

MMDB (MaxMind DB) is a binary format optimized for IP range lookups. Given an IP address, an MMDB reader returns the record associated with the matching CIDR prefix in microseconds. Every MMDB source requires the mmdbctl binary to compile.

LMDB (Lightning Memory-Mapped Database) is a key-value store with zero-copy reads and memory-mapped access. It is used for sources keyed by string identifiers rather than IP addresses: user-agent patterns, email domains, and TLS fingerprints. LMDB sources do not require any external binary.


Compiling All Sources

pnpm dlx @riavzon/shield-base --all --parallel --contact "Name https://example.com - [email protected]" --acceptFireholRisk
Logo