CrowdSec dashboard

Last poll Nov 7, 3:40 AM CST — ok
Last 24 hours: 89 attacks from 46 IPs, mostly web probing. 8 IPs are banned by your CrowdSec right now. ✅ Everything healthy.
Active bans
15050
local 11 · community 15039
Alerts 24h
89
Lines read
221426
parsed 221426

Health

✅
Data collection
Last poll 1 min ago (Nov 7, 3:40 AM CST), no errors.
✅
CrowdSec engine (LAPI)
Up and answering (live check just now).
✅
Log parsing
CrowdSec understood 100% of the log lines it read (221,426 of 221,426 since it last started). Unparsed lines are usually just normal noise it doesn't need.
✅
Bouncer (NPMplus)
Active (npmplus) — it asked CrowdSec for ban updates since the previous poll. Last seen active: Nov 7, 3:40 AM CST (Central).

Trends

Data since Nov 3, 11:59 AM CST (Central). Days before that show as empty, not "zero attacks". Local bans only (community blocklist not counted). Hover a bar for exact numbers.

Today so far: 2 new IPs and 5 repeat offenders (seen on an earlier day).

Alerts per day — 422 total
136Sun Nov 1: 0 alertsSun 1Mon Nov 2: 0 alertsMon 2Tue Nov 3: 95 alertsTue 395Wed Nov 4: 91 alertsWed 491Thu Nov 5: 136 alertsThu 5136Fri Nov 6: 90 alertsFri 690Sat Nov 7: 10 alertsSat 710
Local bans per day — 376 total
119Sun Nov 1: 0 local bansSun 1Mon Nov 2: 0 local bansMon 2Tue Nov 3: 86 local bansTue 386Wed Nov 4: 84 local bansWed 484Thu Nov 5: 119 local bansThu 5119Fri Nov 6: 78 local bansFri 678Sat Nov 7: 9 local bansSat 79

Who's attacking & how

Local vs community bans

Local = your CrowdSec caught it. Community = shared blocklist from other CrowdSec users.

11 local · 15,039 community (active now, 0.1% local)

7-day average: 16.1 local · 15,049 community (0.1% local)

Loudest attack types (7 days)

Web probing100
Looking for secret files76
Known bad bot / scanner49
Looking for admin pages48
Software fingerprinting46
Aggressive web crawling24
Open proxy abuse attempt17
Known exploit attempt (CVE-2021-26086, Jira)17

Top banned countries (30 days, local bans)

CountryIPsBans
US56110
BE1842
NL1443
DE1430
FR710
CN55
SE55
ES410
BR38
LT38

Top networks (ASN)

unknown31 IPs
GOOGLE-CLOUD-PLATFORM31 IPs
DIGITALOCEAN-ASN15 IPs
CENSYS-ARIN-0112 IPs
GOOGLE11 IPs

Repeat offenders (banned 2+ times, 30 days)

IPCountryBansLast ban (Central)
93.123.109.103BG 18Nov 5, 7:12 AM CST
45.148.10.120NL 12Nov 6, 11:21 AM CST
34.62.82.207BE 12Nov 5, 10:39 PM CST
32.195.61.205US 10Nov 5, 7:14 AM CST
158.23.145.82MX 9Nov 5, 10:14 AM CST
95.214.53.196 🔒PL 8Nov 7, 2:38 AM CST
4.232.93.50IT 7Nov 6, 1:02 PM CST
35.221.191.249TW 7Nov 4, 11:05 AM CST
93.123.109.230BG 7Nov 3, 9:57 PM CST
34.174.154.87US 6Nov 5, 11:52 AM CST
34.55.4.36US 6Nov 4, 2:19 PM CST
34.156.35.188US 6Nov 4, 12:01 PM CST
91.148.245.81 🔒NL 5Nov 7, 1:32 AM CST
45.138.12.16LT 5Nov 5, 6:37 PM CST
52.176.17.58US 5Nov 5, 9:27 AM CST

🔒 = still banned now. Hover the ban count to see why.

What they're trying to access (7 days)

Site + path taken from the log lines that triggered each alert. Many different URLs from one IP = a broad scan; the same path over and over = someone after one specific URL. URL info found in 422 of 422 alerts.

Request (site + path)HitsIPsStatus
? _ (garbage — not a real web request) 15213400
GET (no host / raw IP)/ 2322400
GET hnd.laxtontx.com/.env 2312403
GET hnd.laxtontx.com/.env.local 177403
GET hnd.laxtontx.com/.env.development 145403
GET office.laxtontx.com/.env 126404
GET hnd.laxtontx.com/.env.staging 125403
GET hnd.laxtontx.com/wp-config.php 102404
GET hnd.laxtontx.com/.git/config 106403
GET hnd.laxtontx.com/info.php 97403,404
GET whc.laxtontx.com/.env 95403
POST analytics.laxtontx.com/api/event 97202
GET office.laxtontx.com/.env.local 84404
GET office.laxtontx.com/.env.staging 84404
GET office.laxtontx.com/.env.development 84404
IPRequestsSitesDifferent URLsLooks like
34.62.82.20778363 🔍 broad scan
45.148.10.12050947 🔍 broad scan
93.123.109.103108145 🔍 broad scan
32.195.61.20559344 🔍 broad scan
34.174.154.8740240 🔍 broad scan
158.23.145.8248138 🔍 broad scan
34.156.35.18838233 🔍 broad scan
93.123.109.23044432 🔍 broad scan
4.232.93.5041232 🔍 broad scan
91.148.245.8137329 🔍 broad scan
34.55.4.3631129 🔍 broad scan
45.138.12.1638228 🔍 broad scan

Hover “Sites” / “Different URLs” for the lists.

Active bans (blocked right now)

Live from CrowdSec. Local = your CrowdSec caught this IP attacking you. Community blocklist bans (15039 IPs shared by other CrowdSec users) aren't listed one by one and can't be unbanned here — they're re-synced from CrowdSec automatically.

IPWhyOriginCountryBanned atTime leftEnds
95.214.53.196Open proxy abuse attempt LocalPLNov 7, 2:38 AM CST 2h 56mNov 7, 6:38 AM CST
45.198.224.234Open proxy abuse attempt LocalSENov 7, 1:37 AM CST 1h 56mNov 7, 5:37 AM CST
146.190.242.161Web probing LocalCANov 7, 1:32 AM CST 1h 51mNov 7, 5:32 AM CST
146.190.242.161Known exploit attempt (CVE-2021-26086, Jira) LocalCANov 7, 1:32 AM CST 1h 51mNov 7, 5:32 AM CST (same IP)
68.183.180.73Known exploit attempt (CVE-2021-26086, Jira) LocalSGNov 7, 1:32 AM CST 1h 51mNov 7, 5:32 AM CST
91.148.245.81Web probing LocalNLNov 7, 1:32 AM CST 1h 50mNov 7, 5:32 AM CST
91.148.245.81Looking for secret files LocalNLNov 7, 1:32 AM CST 1h 50mNov 7, 5:32 AM CST (same IP)
2.57.122.202Looking for admin pages LocalRONov 7, 1:31 AM CST 1h 49mNov 7, 5:31 AM CST
45.94.31.16Web probing LocalNLNov 7, 12:40 AM CST 58mNov 7, 4:40 AM CST
66.132.172.129Known bad bot / scanner LocalUSNov 6, 11:49 PM CST 7mNov 7, 3:49 AM CST
45.94.31.16Web probing LocalNLNov 6, 11:45 PM CST 3mNov 7, 3:45 AM CST (same IP)

Ban an IP yourself

Block an address you don't trust. It shows up under Active bans as Local and you can Unban it any time. Home-network (192.168.x, 10.x), loopback, and Tailscale addresses are refused so you can't lock yourself out.

Your recent actions

When (Central)ActionIPLengthReasonResult
No bans or unbans done from the dashboard yet.

Top offending IPs

IPCountryASAlertsStatus
93.123.109.103BGTechoff Srv Limited21 not banned
34.62.82.207BEGOOGLE-CLOUD-PLATFORM15 not banned
45.148.10.120NLTechoff Srv Limited12 not banned
32.195.61.205US12 not banned
4.232.93.50ITMICROSOFT-CORP-MSN-AS-BLOCK9 not banned
158.23.145.82MXMICROSOFT-CORP-MSN-AS-BLOCK9 not banned
95.214.53.196PLMEVSPACE sp. z o.o.8
34.174.154.87USGOOGLE-CLOUD-PLATFORM8 not banned
34.156.35.188USGOOGLE-CLOUD-PLATFORM8 not banned
93.123.109.230BGTechoff Srv Limited7 not banned
35.221.191.249TWGOOGLE-CLOUD-PLATFORM7 not banned
34.55.4.36USGOOGLE-CLOUD-PLATFORM6 not banned
146.190.242.161CADIGITALOCEAN-ASN6
91.148.245.81NLEweka Internet Services B.V.5
52.176.17.58USMICROSOFT-CORP-MSN-AS-BLOCK5 not banned

Attack types

Attack typeWhat it meansAlertsIPs
Web probingRequesting many pages that do not exist, looking for something to attack.10082
Looking for secret filesTrying to download files like .env, .git or backups.7651
Known bad bot / scannerThe visitor identified itself as a known attack tool or scanner.4947
Looking for admin pagesSearching for login/admin panels (phpMyAdmin, /admin, etc.).4839
Software fingerprintingChecking which web software you run, usually before attacking.4637
Aggressive web crawlingA bot hammering many pages very fast.2418
Known exploit attempt (CVE-2021-26086, Jira)Trying a specific published software vulnerability.1712
Open proxy abuse attemptTrying to use your server to relay their traffic.178
WordPress scanningProbing for WordPress pages and plugins.1411
Known exploit (CVE) scanningTrying many published vulnerabilities to see if any work.116
Web backdoor attemptsLooking for web shells left by earlier hacks.87
WordPress config theft attemptTrying to download wp-config.php (contains database passwords).53
Known exploit attempt (CVE-2021-41773)Trying a specific published software vulnerability.33
Path traversal attemptsUsing ../ tricks to read files outside the website.22
Known exploit attempt (CVE-2021-42013)Trying a specific published software vulnerability.22

Recent alerts

When (Central)IPScenarioCountryEvents
Nov 7, 2:38 AM CST95.214.53.196Open proxy abuse attemptPL1
Nov 7, 1:37 AM CST45.198.224.234Open proxy abuse attemptSE1
Nov 7, 1:32 AM CST146.190.242.161Web probingCA13
Nov 7, 1:32 AM CST146.190.242.161Software fingerprintingCA1
Nov 7, 1:32 AM CST146.190.242.161Known exploit attempt (CVE-2021-26086, Jira)CA1
Nov 7, 1:32 AM CST68.183.180.73Known exploit attempt (CVE-2021-26086, Jira)SG1
Nov 7, 1:32 AM CST91.148.245.81Web probingNL11
Nov 7, 1:32 AM CST91.148.245.81Looking for secret filesNL5
Nov 7, 1:31 AM CST2.57.122.202Looking for admin pagesRO3
Nov 7, 12:40 AM CST45.94.31.16Web probingNL11
Nov 6, 11:49 PM CST66.132.172.129Known bad bot / scannerUS2
Nov 6, 11:45 PM CST45.94.31.16Web probingNL11
Nov 6, 9:53 PM CST35.206.133.206Web probingBE18
Nov 6, 9:48 PM CST23.191.200.12Known bad bot / scannerUS2
Nov 6, 9:47 PM CST92.246.84.133Known bad bot / scannerDE2
Nov 6, 9:28 PM CST35.210.219.60Web probingBE18
Nov 6, 9:26 PM CST176.115.236.247Looking for secret filesDE5
Nov 6, 9:22 PM CST45.156.87.186Looking for secret filesNL5
Nov 6, 9:13 PM CST35.210.49.36Web probingBE16
Nov 6, 8:52 PM CST172.161.40.129Looking for admin pagesCH4
Nov 6, 8:52 PM CST172.161.40.129Software fingerprintingCH1
Nov 6, 8:51 PM CST172.161.40.129WordPress scanningCH5
Nov 6, 8:51 PM CST172.161.40.129Looking for admin pagesCH4
Nov 6, 8:51 PM CST213.209.159.175Software fingerprintingTW1
Nov 6, 8:51 PM CST172.161.40.129Web probingCH11