Data Sources

Sentinel utilizes publicly available data sources to maintain up-to-date threat intelligence while remaining self-hosting friendly.

Firehol IP Lists

Sentinel’s Threat Intelligence integrates with FireHOL blocklists to identify malicious IPs. For more information and configuration options, visit related documentation.

Disposable Email Domains

Sentinel detects temporary email addresses using domains from:

disposable-email-domains

Custom Configuration

Override the default source:

EMAIL_LIST_DISPOSABLE=https://raw.githubusercontent.com/disposable-email-domains/disposable-email-domains/master/domains.txt

Automatic Updates

Data files are updated automatically based on the configured CRON-style schedule. To adjust the update frequency, set the following environment variables:

• EMAIL_LIST_DISPOSABLE_SCHEDULE (default: 0 0 * * * - every day at midnight)

Each variable controls the update schedule for its corresponding data source.

High-Risk Countries

Country List

Below is a list of high-risk countries identified based on observed levels of cyberattacks and spam activity. This includes countries such as the United States, China, and India. Sentinel will treat access from these locations as high-risk, which may trigger stricter security measures.

To avoid unnecessary restrictions for your users, you can whitelist specific country codes using the HIGH_RISK_COUNTRIES_EXCLUDE environment variable.

ISO Code	Country Name
ir	Iran
kp	North Korea
cu	Cuba
sy	Syria
by	Belarus
cd	Democratic Republic of the Congo
ru	Russia
ly	Libya
cf	Central African Republic
iq	Iraq
mm	Myanmar (Burma)
lb	Lebanon
so	Somalia
ve	Venezuela
zw	Zimbabwe
cn	China
sd	Sudan
us	United States
il	Israel
vn	Vietnam
in	India
pk	Pakistan
br	Brazil
ng	Nigeria
ua	Ukraine

Supporting These Projects

These data sources are freely available. Consider supporting the maintainers:

• Support FireHOL
• Support disposable-email-domains