CrowdSec dashboard

Last poll Nov 7, 1:30 AM CST — ok
Last 24 hours: 88 attacks from 45 IPs, mostly web probing. 9 IPs are banned by your CrowdSec right now. ✅ Everything healthy.
Active bans
15046
local 6 · community 15040
Alerts 24h
88
Lines read
216677
parsed 216677

Health

✅
Data collection
Last poll 5 min ago (Nov 7, 1:30 AM CST), no errors.
✅
CrowdSec engine (LAPI)
Up and answering (live check just now).
✅
Log parsing
CrowdSec understood 100% of the log lines it read (216,677 of 216,677 since it last started). Unparsed lines are usually just normal noise it doesn't need.
✅
Bouncer (NPMplus)
Active (npmplus) — it asked CrowdSec for ban updates since the previous poll. Last seen active: Nov 7, 1:30 AM CST (Central).

Trends

Data since Nov 3, 11:59 AM CST (Central). Days before that show as empty, not "zero attacks". Local bans only (community blocklist not counted). Hover a bar for exact numbers.

Today so far: 0 new IPs and 1 repeat offender (seen on an earlier day).

Alerts per day — 413 total
136Sun Nov 1: 0 alertsSun 1Mon Nov 2: 0 alertsMon 2Tue Nov 3: 95 alertsTue 395Wed Nov 4: 91 alertsWed 491Thu Nov 5: 136 alertsThu 5136Fri Nov 6: 90 alertsFri 690Sat Nov 7: 1 alertsSat 71
Local bans per day — 368 total
119Sun Nov 1: 0 local bansSun 1Mon Nov 2: 0 local bansMon 2Tue Nov 3: 86 local bansTue 386Wed Nov 4: 84 local bansWed 484Thu Nov 5: 119 local bansThu 5119Fri Nov 6: 78 local bansFri 678Sat Nov 7: 1 local bansSat 71

Who's attacking & how

Local vs community bans

Local = your CrowdSec caught it. Community = shared blocklist from other CrowdSec users.

6 local · 15,040 community (active now, 0% local)

7-day average: 16.3 local · 15,050 community (0.1% local)

Loudest attack types (7 days)

Web probing98
Looking for secret files75
Known bad bot / scanner49
Looking for admin pages47
Software fingerprinting45
Aggressive web crawling24
Open proxy abuse attempt15
Known exploit attempt (CVE-2021-26086, Jira)15

Top banned countries (30 days, local bans)

CountryIPsBans
US56110
BE1842
NL1441
DE1430
FR710
CN55
ES410
SE44
BR38
LT38

Top networks (ASN)

GOOGLE-CLOUD-PLATFORM31 IPs
unknown30 IPs
DIGITALOCEAN-ASN14 IPs
CENSYS-ARIN-0112 IPs
GOOGLE11 IPs

Repeat offenders (banned 2+ times, 30 days)

IPCountryBansLast ban (Central)
93.123.109.103BG 18Nov 5, 7:12 AM CST
45.148.10.120NL 12Nov 6, 11:21 AM CST
34.62.82.207BE 12Nov 5, 10:39 PM CST
32.195.61.205US 10Nov 5, 7:14 AM CST
158.23.145.82MX 9Nov 5, 10:14 AM CST
95.214.53.196PL 7Nov 6, 1:34 PM CST
4.232.93.50IT 7Nov 6, 1:02 PM CST
35.221.191.249TW 7Nov 4, 11:05 AM CST
93.123.109.230BG 7Nov 3, 9:57 PM CST
34.174.154.87US 6Nov 5, 11:52 AM CST
34.55.4.36US 6Nov 4, 2:19 PM CST
34.156.35.188US 6Nov 4, 12:01 PM CST
45.138.12.16LT 5Nov 5, 6:37 PM CST
52.176.17.58US 5Nov 5, 9:27 AM CST
158.23.22.8MX 5Nov 4, 11:10 PM CST

🔒 = still banned now. Hover the ban count to see why.

What they're trying to access (7 days)

Site + path taken from the log lines that triggered each alert. Many different URLs from one IP = a broad scan; the same path over and over = someone after one specific URL. URL info found in 413 of 413 alerts.

Request (site + path)HitsIPsStatus
? _ (garbage — not a real web request) 15213400
GET (no host / raw IP)/ 2322400
GET hnd.laxtontx.com/.env 2312403
GET hnd.laxtontx.com/.env.local 177403
GET hnd.laxtontx.com/.env.development 145403
GET office.laxtontx.com/.env 126404
GET hnd.laxtontx.com/.env.staging 125403
GET hnd.laxtontx.com/wp-config.php 102404
GET hnd.laxtontx.com/.git/config 106403
GET hnd.laxtontx.com/info.php 97403,404
GET whc.laxtontx.com/.env 95403
POST analytics.laxtontx.com/api/event 97202
GET office.laxtontx.com/.env.local 84404
GET office.laxtontx.com/.env.staging 84404
GET office.laxtontx.com/.env.development 84404
IPRequestsSitesDifferent URLsLooks like
34.62.82.20778363 🔍 broad scan
45.148.10.12050947 🔍 broad scan
93.123.109.103108145 🔍 broad scan
32.195.61.20559344 🔍 broad scan
34.174.154.8740240 🔍 broad scan
158.23.145.8248138 🔍 broad scan
34.156.35.18838233 🔍 broad scan
93.123.109.23044432 🔍 broad scan
4.232.93.5041232 🔍 broad scan
34.55.4.3631129 🔍 broad scan
45.138.12.1638228 🔍 broad scan
35.221.191.24932125 🔍 broad scan

Hover “Sites” / “Different URLs” for the lists.

Active bans (blocked right now)

Live from CrowdSec. Local = your CrowdSec caught this IP attacking you. Community blocklist bans (15040 IPs shared by other CrowdSec users) aren't listed one by one and can't be unbanned here — they're re-synced from CrowdSec automatically.

IPWhyOriginCountryBanned atTime leftEnds
146.190.242.161Web probing LocalCANov 7, 1:32 AM CST 3h 58mNov 7, 5:32 AM CST
146.190.242.161Known exploit attempt (CVE-2021-26086, Jira) LocalCANov 7, 1:32 AM CST 3h 57mNov 7, 5:32 AM CST (same IP)
68.183.180.73Known exploit attempt (CVE-2021-26086, Jira) LocalSGNov 7, 1:32 AM CST 3h 57mNov 7, 5:32 AM CST
91.148.245.81Web probing LocalNLNov 7, 1:32 AM CST 3h 57mNov 7, 5:32 AM CST
91.148.245.81Looking for secret files LocalNLNov 7, 1:32 AM CST 3h 57mNov 7, 5:32 AM CST (same IP)
2.57.122.202Looking for admin pages LocalRONov 7, 1:31 AM CST 3h 56mNov 7, 5:31 AM CST
45.94.31.16Web probing LocalNLNov 7, 12:40 AM CST 3h 5mNov 7, 4:40 AM CST
66.132.172.129Known bad bot / scanner LocalUSNov 6, 11:49 PM CST 2h 14mNov 7, 3:49 AM CST
45.94.31.16Web probing LocalNLNov 6, 11:45 PM CST 2h 10mNov 7, 3:45 AM CST (same IP)
35.206.133.206Web probing LocalBENov 6, 9:53 PM CST 18mNov 7, 1:53 AM CST
23.191.200.12Known bad bot / scanner LocalUSNov 6, 9:48 PM CST 13mNov 7, 1:48 AM CST
92.246.84.133Known bad bot / scanner LocalDENov 6, 9:47 PM CST 12mNov 7, 1:47 AM CST

Ban an IP yourself

Block an address you don't trust. It shows up under Active bans as Local and you can Unban it any time. Home-network (192.168.x, 10.x), loopback, and Tailscale addresses are refused so you can't lock yourself out.

Your recent actions

When (Central)ActionIPLengthReasonResult
No bans or unbans done from the dashboard yet.

Top offending IPs

IPCountryASAlertsStatus
93.123.109.103BGTechoff Srv Limited21 not banned
34.62.82.207BEGOOGLE-CLOUD-PLATFORM15 not banned
45.148.10.120NLTechoff Srv Limited12 not banned
32.195.61.205US12 not banned
4.232.93.50ITMICROSOFT-CORP-MSN-AS-BLOCK9 not banned
158.23.145.82MXMICROSOFT-CORP-MSN-AS-BLOCK9 not banned
34.174.154.87USGOOGLE-CLOUD-PLATFORM8 not banned
34.156.35.188USGOOGLE-CLOUD-PLATFORM8 not banned
95.214.53.196PLMEVSPACE sp. z o.o.7 not banned
93.123.109.230BGTechoff Srv Limited7 not banned
35.221.191.249TWGOOGLE-CLOUD-PLATFORM7 not banned
34.55.4.36USGOOGLE-CLOUD-PLATFORM6 not banned
52.176.17.58USMICROSOFT-CORP-MSN-AS-BLOCK5 not banned
45.148.10.21NLTechoff Srv Limited5 not banned
45.138.12.16LT5 not banned

Attack types

Attack typeWhat it meansAlertsIPs
Web probingRequesting many pages that do not exist, looking for something to attack.9882
Looking for secret filesTrying to download files like .env, .git or backups.7551
Known bad bot / scannerThe visitor identified itself as a known attack tool or scanner.4947
Looking for admin pagesSearching for login/admin panels (phpMyAdmin, /admin, etc.).4738
Software fingerprintingChecking which web software you run, usually before attacking.4537
Aggressive web crawlingA bot hammering many pages very fast.2418
Known exploit attempt (CVE-2021-26086, Jira)Trying a specific published software vulnerability.1511
Open proxy abuse attemptTrying to use your server to relay their traffic.157
WordPress scanningProbing for WordPress pages and plugins.1411
Known exploit (CVE) scanningTrying many published vulnerabilities to see if any work.116
Web backdoor attemptsLooking for web shells left by earlier hacks.87
WordPress config theft attemptTrying to download wp-config.php (contains database passwords).53
Known exploit attempt (CVE-2021-41773)Trying a specific published software vulnerability.33
Path traversal attemptsUsing ../ tricks to read files outside the website.22
Known exploit attempt (CVE-2021-42013)Trying a specific published software vulnerability.22

Recent alerts

When (Central)IPScenarioCountryEvents
Nov 7, 12:40 AM CST45.94.31.16Web probingNL11
Nov 6, 11:49 PM CST66.132.172.129Known bad bot / scannerUS2
Nov 6, 11:45 PM CST45.94.31.16Web probingNL11
Nov 6, 9:53 PM CST35.206.133.206Web probingBE18
Nov 6, 9:48 PM CST23.191.200.12Known bad bot / scannerUS2
Nov 6, 9:47 PM CST92.246.84.133Known bad bot / scannerDE2
Nov 6, 9:28 PM CST35.210.219.60Web probingBE18
Nov 6, 9:26 PM CST176.115.236.247Looking for secret filesDE5
Nov 6, 9:22 PM CST45.156.87.186Looking for secret filesNL5
Nov 6, 9:13 PM CST35.210.49.36Web probingBE16
Nov 6, 8:52 PM CST172.161.40.129Looking for admin pagesCH4
Nov 6, 8:52 PM CST172.161.40.129Software fingerprintingCH1
Nov 6, 8:51 PM CST172.161.40.129WordPress scanningCH5
Nov 6, 8:51 PM CST172.161.40.129Looking for admin pagesCH4
Nov 6, 8:51 PM CST213.209.159.175Software fingerprintingTW1
Nov 6, 8:51 PM CST172.161.40.129Web probingCH11
Nov 6, 8:33 PM CST34.125.76.192Looking for admin pagesUS5
Nov 6, 8:33 PM CST34.125.76.192Software fingerprintingUS1
Nov 6, 8:33 PM CST34.125.76.192Web probingUS11
Nov 6, 8:33 PM CST34.125.76.192Looking for secret filesUS5
Nov 6, 7:36 PM CST13.223.82.250Web probingUS11
Nov 6, 7:36 PM CST13.223.82.250Looking for secret filesUS5
Nov 6, 7:34 PM CST159.89.174.87Known exploit attempt (CVE-2021-26086, Jira)IN1
Nov 6, 7:34 PM CST159.89.12.166Known exploit attempt (CVE-2021-26086, Jira)DE1
Nov 6, 7:33 PM CST138.68.82.23Software fingerprintingDE1