CrowdSec dashboard

Last poll Nov 7, 4:35 AM CST — ok
Last 24 hours: 94 attacks from 48 IPs, mostly web probing. 10 IPs are banned by your CrowdSec right now. ✅ Everything healthy.
Active bans
15066
local 15 · community 15051
Alerts 24h
94
Lines read
223358
parsed 223358

Health

✅
Data collection
Last poll 4 min ago (Nov 7, 4:35 AM CST), no errors.
✅
CrowdSec engine (LAPI)
Up and answering (live check just now).
✅
Log parsing
CrowdSec understood 100% of the log lines it read (223,358 of 223,358 since it last started). Unparsed lines are usually just normal noise it doesn't need.
✅
Bouncer (NPMplus)
Active (npmplus) — it asked CrowdSec for ban updates since the previous poll. Last seen active: Nov 7, 4:35 AM CST (Central).

Trends

Data since Nov 3, 11:59 AM CST (Central). Days before that show as empty, not "zero attacks". Local bans only (community blocklist not counted). Hover a bar for exact numbers.

Today so far: 5 new IPs and 5 repeat offenders (seen on an earlier day).

Alerts per day — 428 total
136Sun Nov 1: 0 alertsSun 1Mon Nov 2: 0 alertsMon 2Tue Nov 3: 95 alertsTue 395Wed Nov 4: 91 alertsWed 491Thu Nov 5: 136 alertsThu 5136Fri Nov 6: 90 alertsFri 690Sat Nov 7: 16 alertsSat 716
Local bans per day — 382 total
119Sun Nov 1: 0 local bansSun 1Mon Nov 2: 0 local bansMon 2Tue Nov 3: 86 local bansTue 386Wed Nov 4: 84 local bansWed 484Thu Nov 5: 119 local bansThu 5119Fri Nov 6: 78 local bansFri 678Sat Nov 7: 15 local bansSat 715

Who's attacking & how

Local vs community bans

Local = your CrowdSec caught it. Community = shared blocklist from other CrowdSec users.

15 local · 15,051 community (active now, 0.1% local)

7-day average: 16.1 local · 15,050 community (0.1% local)

Loudest attack types (7 days)

Web probing101
Looking for secret files77
Known bad bot / scanner51
Looking for admin pages48
Software fingerprinting46
Aggressive web crawling25
Open proxy abuse attempt17
Known exploit attempt (CVE-2021-26086, Jira)17

Top banned countries (30 days, local bans)

CountryIPsBans
US57114
BE1842
NL1443
DE1430
FR710
CN66
SE55
ES410
BR38
LT38

Top networks (ASN)

unknown31 IPs
GOOGLE-CLOUD-PLATFORM31 IPs
DIGITALOCEAN-ASN15 IPs
CENSYS-ARIN-0112 IPs
GOOGLE11 IPs

Repeat offenders (banned 2+ times, 30 days)

IPCountryBansLast ban (Central)
93.123.109.103BG 18Nov 5, 7:12 AM CST
45.148.10.120NL 12Nov 6, 11:21 AM CST
34.62.82.207BE 12Nov 5, 10:39 PM CST
32.195.61.205US 10Nov 5, 7:14 AM CST
158.23.145.82MX 9Nov 5, 10:14 AM CST
95.214.53.196 🔒PL 8Nov 7, 2:38 AM CST
4.232.93.50IT 7Nov 6, 1:02 PM CST
35.221.191.249TW 7Nov 4, 11:05 AM CST
93.123.109.230BG 7Nov 3, 9:57 PM CST
34.174.154.87US 6Nov 5, 11:52 AM CST
34.55.4.36US 6Nov 4, 2:19 PM CST
34.156.35.188US 6Nov 4, 12:01 PM CST
91.148.245.81 🔒NL 5Nov 7, 1:32 AM CST
45.138.12.16LT 5Nov 5, 6:37 PM CST
52.176.17.58US 5Nov 5, 9:27 AM CST

🔒 = still banned now. Hover the ban count to see why.

What they're trying to access (7 days)

Site + path taken from the log lines that triggered each alert. Many different URLs from one IP = a broad scan; the same path over and over = someone after one specific URL. URL info found in 428 of 428 alerts.

Request (site + path)HitsIPsStatus
? _ (garbage — not a real web request) 15213400
GET (no host / raw IP)/ 2322400
GET hnd.laxtontx.com/.env 2312403
GET hnd.laxtontx.com/.env.local 177403
GET hnd.laxtontx.com/.env.development 145403
GET office.laxtontx.com/.env 126404
GET hnd.laxtontx.com/.env.staging 125403
GET hnd.laxtontx.com/wp-config.php 102404
GET hnd.laxtontx.com/.git/config 106403
POST analytics.laxtontx.com/api/event 108202
GET hnd.laxtontx.com/info.php 97403,404
GET whc.laxtontx.com/.env 95403
GET office.laxtontx.com/.env.local 84404
GET office.laxtontx.com/.env.staging 84404
GET office.laxtontx.com/.env.development 84404
IPRequestsSitesDifferent URLsLooks like
34.62.82.20778363 🔍 broad scan
45.148.10.12050947 🔍 broad scan
93.123.109.103108145 🔍 broad scan
32.195.61.20559344 🔍 broad scan
34.174.154.8740240 🔍 broad scan
158.23.145.8248138 🔍 broad scan
34.156.35.18838233 🔍 broad scan
93.123.109.23044432 🔍 broad scan
4.232.93.5041232 🔍 broad scan
91.148.245.8137329 🔍 broad scan
34.55.4.3631129 🔍 broad scan
45.138.12.1638228 🔍 broad scan

Hover “Sites” / “Different URLs” for the lists.

Active bans (blocked right now)

Live from CrowdSec. Local = your CrowdSec caught this IP attacking you. Community blocklist bans (15051 IPs shared by other CrowdSec users) aren't listed one by one and can't be unbanned here — they're re-synced from CrowdSec automatically.

IPWhyOriginCountryBanned atTime leftEnds
122.192.32.80Known bad bot / scanner LocalCNNov 7, 4:28 AM CST 3h 48mNov 7, 8:28 AM CST
185.150.28.13Known bad bot / scanner LocalCHNov 7, 4:01 AM CST 3h 22mNov 7, 8:01 AM CST
184.194.161.222Aggressive web crawling LocalUSNov 7, 3:55 AM CST 3h 15mNov 7, 7:55 AM CST
184.194.161.222WordPress config theft attempt LocalUSNov 7, 3:55 AM CST 3h 15mNov 7, 7:55 AM CST (same IP)
184.194.161.222Web probing LocalUSNov 7, 3:55 AM CST 3h 15mNov 7, 7:55 AM CST (same IP)
184.194.161.222Looking for secret files LocalUSNov 7, 3:55 AM CST 3h 15mNov 7, 7:55 AM CST (same IP)
95.214.53.196Open proxy abuse attempt LocalPLNov 7, 2:38 AM CST 1h 58mNov 7, 6:38 AM CST
45.198.224.234Open proxy abuse attempt LocalSENov 7, 1:37 AM CST 58mNov 7, 5:37 AM CST
146.190.242.161Web probing LocalCANov 7, 1:32 AM CST 53mNov 7, 5:32 AM CST
146.190.242.161Known exploit attempt (CVE-2021-26086, Jira) LocalCANov 7, 1:32 AM CST 53mNov 7, 5:32 AM CST (same IP)
68.183.180.73Known exploit attempt (CVE-2021-26086, Jira) LocalSGNov 7, 1:32 AM CST 53mNov 7, 5:32 AM CST
91.148.245.81Web probing LocalNLNov 7, 1:32 AM CST 52mNov 7, 5:32 AM CST
91.148.245.81Looking for secret files LocalNLNov 7, 1:32 AM CST 52mNov 7, 5:32 AM CST (same IP)
2.57.122.202Looking for admin pages LocalRONov 7, 1:31 AM CST 51mNov 7, 5:31 AM CST
45.94.31.16Web probing LocalNLNov 7, 12:40 AM CST 0mNov 7, 4:40 AM CST

Ban an IP yourself

Block an address you don't trust. It shows up under Active bans as Local and you can Unban it any time. Home-network (192.168.x, 10.x), loopback, and Tailscale addresses are refused so you can't lock yourself out.

Your recent actions

When (Central)ActionIPLengthReasonResult
No bans or unbans done from the dashboard yet.

Top offending IPs

IPCountryASAlertsStatus
93.123.109.103BGTechoff Srv Limited21 not banned
34.62.82.207BEGOOGLE-CLOUD-PLATFORM15 not banned
45.148.10.120NLTechoff Srv Limited12 not banned
32.195.61.205US12 not banned
4.232.93.50ITMICROSOFT-CORP-MSN-AS-BLOCK9 not banned
158.23.145.82MXMICROSOFT-CORP-MSN-AS-BLOCK9 not banned
95.214.53.196PLMEVSPACE sp. z o.o.8
34.174.154.87USGOOGLE-CLOUD-PLATFORM8 not banned
34.156.35.188USGOOGLE-CLOUD-PLATFORM8 not banned
93.123.109.230BGTechoff Srv Limited7 not banned
35.221.191.249TWGOOGLE-CLOUD-PLATFORM7 not banned
34.55.4.36USGOOGLE-CLOUD-PLATFORM6 not banned
146.190.242.161CADIGITALOCEAN-ASN6
91.148.245.81NLEweka Internet Services B.V.5
52.176.17.58USMICROSOFT-CORP-MSN-AS-BLOCK5 not banned

Attack types

Attack typeWhat it meansAlertsIPs
Web probingRequesting many pages that do not exist, looking for something to attack.10183
Looking for secret filesTrying to download files like .env, .git or backups.7752
Known bad bot / scannerThe visitor identified itself as a known attack tool or scanner.5149
Looking for admin pagesSearching for login/admin panels (phpMyAdmin, /admin, etc.).4839
Software fingerprintingChecking which web software you run, usually before attacking.4637
Aggressive web crawlingA bot hammering many pages very fast.2519
Known exploit attempt (CVE-2021-26086, Jira)Trying a specific published software vulnerability.1712
Open proxy abuse attemptTrying to use your server to relay their traffic.178
WordPress scanningProbing for WordPress pages and plugins.1411
Known exploit (CVE) scanningTrying many published vulnerabilities to see if any work.116
Web backdoor attemptsLooking for web shells left by earlier hacks.87
WordPress config theft attemptTrying to download wp-config.php (contains database passwords).64
Known exploit attempt (CVE-2021-41773)Trying a specific published software vulnerability.33
Path traversal attemptsUsing ../ tricks to read files outside the website.22
Known exploit attempt (CVE-2021-42013)Trying a specific published software vulnerability.22

Recent alerts

When (Central)IPScenarioCountryEvents
Nov 7, 4:28 AM CST122.192.32.80Known bad bot / scannerCN2
Nov 7, 4:01 AM CST185.150.28.13Known bad bot / scannerCH2
Nov 7, 3:55 AM CST184.194.161.222Aggressive web crawlingUS47
Nov 7, 3:55 AM CST184.194.161.222WordPress config theft attemptUS6
Nov 7, 3:55 AM CST184.194.161.222Web probingUS11
Nov 7, 3:55 AM CST184.194.161.222Looking for secret filesUS5
Nov 7, 2:38 AM CST95.214.53.196Open proxy abuse attemptPL1
Nov 7, 1:37 AM CST45.198.224.234Open proxy abuse attemptSE1
Nov 7, 1:32 AM CST146.190.242.161Web probingCA13
Nov 7, 1:32 AM CST146.190.242.161Software fingerprintingCA1
Nov 7, 1:32 AM CST146.190.242.161Known exploit attempt (CVE-2021-26086, Jira)CA1
Nov 7, 1:32 AM CST68.183.180.73Known exploit attempt (CVE-2021-26086, Jira)SG1
Nov 7, 1:32 AM CST91.148.245.81Web probingNL11
Nov 7, 1:32 AM CST91.148.245.81Looking for secret filesNL5
Nov 7, 1:31 AM CST2.57.122.202Looking for admin pagesRO3
Nov 7, 12:40 AM CST45.94.31.16Web probingNL11
Nov 6, 11:49 PM CST66.132.172.129Known bad bot / scannerUS2
Nov 6, 11:45 PM CST45.94.31.16Web probingNL11
Nov 6, 9:53 PM CST35.206.133.206Web probingBE18
Nov 6, 9:48 PM CST23.191.200.12Known bad bot / scannerUS2
Nov 6, 9:47 PM CST92.246.84.133Known bad bot / scannerDE2
Nov 6, 9:28 PM CST35.210.219.60Web probingBE18
Nov 6, 9:26 PM CST176.115.236.247Looking for secret filesDE5
Nov 6, 9:22 PM CST45.156.87.186Looking for secret filesNL5
Nov 6, 9:13 PM CST35.210.49.36Web probingBE16