How it works

shieldie-guard is a single-binary security agent a server operator installs on their own machine. It bans brute-forcers and scanners locally, fail2ban-style. This service is the optional layer above it: installations that opt in report the addresses they banned, and pull back a list of addresses the whole network agrees on.

Three layers, no shortcuts

1. Reports

Every participating server sends its bans (address, jail, attempt count, its own ban length). Each server holds an install key; the service stores only the key's hash. Private, loopback, CGNAT and documentation ranges are refused, and a server can never report its own address.

2. Classifier (deterministic)

An address enters the shared feed only when at least 3 independent, warmed-up servers in at least 2 distinct source networks (/16 or /32) have banned it. One person running many servers in one hosting account counts as one voice, so nobody can push a victim's address into the feed alone. Confidence (0–100) grows with independent witnesses, attack kinds and freshness, and decays as reports age. Addresses nobody has seen for 7 days leave the feed.

3. AI analyst

Only addresses that passed the classifier are shown to a small Claude model, which sees numbers and jail names — never any text an attacker or reporter wrote — and chooses how long the network should keep blocking: 6 h, 24 h, 7 d or 30 d. It can lengthen a rule-based block, never shorten it. Spend is capped per hour; over the cap, rule-based timing stands.

Using the feed

Anyone may pull it, no key needed:

curl https://api.shieldie.cloud/v1/feed
curl "https://api.shieldie.cloud/v1/feed?since=2026-09-20T10:00:00Z"

Each entry carries ip, until (RFC 3339), confidence and state (shared or expired). Pass the returned cursor back as since to get only changes. A shieldie-guard installation does this for you and always keeps its own admin_ips allowlist above the feed, so the network can never lock an operator out.

Reporting

curl -X POST https://api.shieldie.cloud/v1/enroll -H 'content-type: application/json' -d '{"agent":"my-tool 1.0"}'
curl -X POST https://api.shieldie.cloud/v1/report -H "authorization: Bearer sgc_…" -H 'content-type: application/json' \
  -d '{"bans":[{"ip":"198.51.100.7","jail":"sshd","attempts":12,"ttl_secs":3600}]}'

Enrolment is limited per source network per day. Reporters that send mostly invalid data are quarantined: their reports are kept but stop counting.

What is not here

No accounts, no logins, no buttons. Nothing on this site identifies a reporting server. The service never connects to participants; they pull.