CrowdSec dashboard

Last poll Nov 5, 4:25 PM CST — ok
Last 24 hours: 114 attacks from 40 IPs, mostly web probing. 12 IPs are banned by your CrowdSec right now. ✅ Everything healthy.
Active bans
15028
local 26 · community 15002
Alerts 24h
114
Lines read
141109
parsed 141109

Health

✅
Data collection
Last poll 1 min ago (Nov 5, 4:25 PM CST), no errors.
✅
CrowdSec engine (LAPI)
Up and answering (live check just now).
✅
Log parsing
CrowdSec understood 100% of the log lines it read (141,109 of 141,109 since it last started). Unparsed lines are usually just normal noise it doesn't need.
✅
Bouncer (NPMplus)
Active (npmplus) — it asked CrowdSec for ban updates since the previous poll. Last seen active: Nov 5, 4:25 PM CST (Central).

Trends

Data since Nov 3, 11:59 AM CST (Central). Days before that show as empty, not "zero attacks". Local bans only (community blocklist not counted). Hover a bar for exact numbers.

Today so far: 29 new IPs and 6 repeat offenders (seen on an earlier day).

Alerts per day — 289 total
103Fri Oct 30: 0 alertsFri 30Sat Oct 31: 0 alertsSat 31Sun Nov 1: 0 alertsSun 1Mon Nov 2: 0 alertsMon 2Tue Nov 3: 95 alertsTue 395Wed Nov 4: 91 alertsWed 491Thu Nov 5: 103 alertsThu 5103
Local bans per day — 261 total
91Fri Oct 30: 0 local bansFri 30Sat Oct 31: 0 local bansSat 31Sun Nov 1: 0 local bansSun 1Mon Nov 2: 0 local bansMon 2Tue Nov 3: 86 local bansTue 386Wed Nov 4: 84 local bansWed 484Thu Nov 5: 91 local bansThu 591

Who's attacking & how

Local vs community bans

Local = your CrowdSec caught it. Community = shared blocklist from other CrowdSec users.

26 local · 15,002 community (active now, 0.2% local)

7-day average: 18.1 local · 15,079 community (0.1% local)

Loudest attack types (7 days)

Web probing62
Looking for secret files54
Known bad bot / scanner38
Looking for admin pages32
Software fingerprinting28
Aggressive web crawling21
Open proxy abuse attempt11
WordPress scanning10

Top banned countries (30 days, local bans)

CountryIPsBans
US4390
BE1328
NL1026
DE717
CN44
LT36
GB34
FR33
SE33
BG225

Top networks (ASN)

unknown25 IPs
GOOGLE-CLOUD-PLATFORM24 IPs
DIGITALOCEAN-ASN8 IPs
CENSYS-ARIN-018 IPs
MICROSOFT-CORP-MSN-AS-BLOCK7 IPs

Repeat offenders (banned 2+ times, 30 days)

IPCountryBansLast ban (Central)
93.123.109.103BG 18Nov 5, 7:12 AM CST
32.195.61.205US 10Nov 5, 7:14 AM CST
158.23.145.82MX 9Nov 5, 10:14 AM CST
35.221.191.249TW 7Nov 4, 11:05 AM CST
93.123.109.230BG 7Nov 3, 9:57 PM CST
34.174.154.87US 6Nov 5, 11:52 AM CST
45.148.10.120NL 6Nov 5, 11:26 AM CST
34.55.4.36US 6Nov 4, 2:19 PM CST
34.156.35.188US 6Nov 4, 12:01 PM CST
95.214.53.196 🔒PL 5Nov 5, 1:42 PM CST
52.176.17.58US 5Nov 5, 9:27 AM CST
158.23.22.8MX 5Nov 4, 11:10 PM CST
20.218.73.251DE 5Nov 3, 4:33 PM CST
35.238.129.244US 5Nov 3, 11:59 AM CST
45.45.237.39 🔒US 4Nov 5, 3:35 PM CST

🔒 = still banned now. Hover the ban count to see why.

What they're trying to access (7 days)

Site + path taken from the log lines that triggered each alert. Many different URLs from one IP = a broad scan; the same path over and over = someone after one specific URL. URL info found in 289 of 289 alerts.

Request (site + path)HitsIPsStatus
? _ (garbage — not a real web request) 868400
GET (no host / raw IP)/ 1717400
GET hnd.laxtontx.com/.env 146403
GET hnd.laxtontx.com/.env.local 114403
GET hnd.laxtontx.com/wp-config.php 102404
GET office.laxtontx.com/.env 84404
GET hnd.laxtontx.com/.env.development 82403
POST analytics.laxtontx.com/api/event 86202
GET office.laxtontx.com/.env.local 63404
GET office.laxtontx.com/.env.staging 63404
GET office.laxtontx.com/.env.development 63404
GET files.laxtontx.com/.env 64200,403
GET hnd.laxtontx.com/.env.staging 62403
GET hnd.laxtontx.com/.env.bak 63403
GET hnd.laxtontx.com/.env.backup 64403
IPRequestsSitesDifferent URLsLooks like
93.123.109.103108145 🔍 broad scan
32.195.61.20559344 🔍 broad scan
34.174.154.8740240 🔍 broad scan
158.23.145.8248138 🔍 broad scan
34.156.35.18838233 🔍 broad scan
93.123.109.23044432 🔍 broad scan
45.148.10.12030630 🔍 broad scan
34.55.4.3631129 🔍 broad scan
35.221.191.24932125 🔍 broad scan
35.238.129.24426125 🔍 broad scan
52.176.17.5826122 🔍 broad scan
45.148.10.2126121 🔍 broad scan

Hover “Sites” / “Different URLs” for the lists.

Active bans (blocked right now)

Live from CrowdSec. Local = your CrowdSec caught this IP attacking you. Community blocklist bans (15002 IPs shared by other CrowdSec users) aren't listed one by one and can't be unbanned here — they're re-synced from CrowdSec automatically.

IPWhyOriginCountryBanned atTime leftEnds
85.155.14.41Web probing LocalESNov 5, 4:24 PM CST 3h 59mNov 5, 8:24 PM CST
85.155.14.41Looking for secret files LocalESNov 5, 4:21 PM CST 3h 55mNov 5, 8:21 PM CST (same IP)
146.70.194.228Web probing LocalFRNov 5, 4:07 PM CST 3h 41mNov 5, 8:07 PM CST
45.45.237.39Aggressive web crawling LocalUSNov 5, 3:35 PM CST 3h 9mNov 5, 7:35 PM CST
45.45.237.39Known bad bot / scanner LocalUSNov 5, 3:35 PM CST 3h 9mNov 5, 7:34 PM CST (same IP)
45.45.237.39Web probing LocalUSNov 5, 3:35 PM CST 3h 9mNov 5, 7:34 PM CST (same IP)
45.45.237.39Looking for secret files LocalUSNov 5, 3:35 PM CST 3h 9mNov 5, 7:34 PM CST (same IP)
159.89.174.87Web probing LocalINNov 5, 3:24 PM CST 2h 58mNov 5, 7:24 PM CST
159.89.174.87Known exploit attempt (CVE-2021-26086, Jira) LocalINNov 5, 3:24 PM CST 2h 58mNov 5, 7:24 PM CST (same IP)
167.172.232.142Known exploit attempt (CVE-2021-26086, Jira) LocalUSNov 5, 3:23 PM CST 2h 58mNov 5, 7:23 PM CST
34.7.225.149Looking for admin pages LocalNLNov 5, 2:16 PM CST 1h 50mNov 5, 6:16 PM CST
34.7.225.149Web probing LocalNLNov 5, 2:15 PM CST 1h 50mNov 5, 6:15 PM CST (same IP)
34.7.225.149Looking for secret files LocalNLNov 5, 2:15 PM CST 1h 50mNov 5, 6:15 PM CST (same IP)
95.214.53.196Open proxy abuse attempt LocalPLNov 5, 1:42 PM CST 1h 16mNov 5, 5:42 PM CST
45.138.12.51Looking for secret files LocalLTNov 5, 1:22 PM CST 56mNov 5, 5:22 PM CST
103.160.205.37Known exploit attempt (CVE-2021-42013) LocalIDNov 5, 1:03 PM CST 37mNov 5, 5:03 PM CST
103.160.205.37Known exploit attempt (CVE-2021-41773) LocalIDNov 5, 1:03 PM CST 37mNov 5, 5:03 PM CST (same IP)
34.32.94.3Looking for admin pages LocalDENov 5, 12:50 PM CST 24mNov 5, 4:50 PM CST
34.32.66.58Looking for admin pages LocalDENov 5, 12:49 PM CST 23mNov 5, 4:49 PM CST
34.32.94.3Web probing LocalDENov 5, 12:49 PM CST 23mNov 5, 4:49 PM CST (same IP)
34.32.94.3Looking for secret files LocalDENov 5, 12:49 PM CST 23mNov 5, 4:49 PM CST (same IP)
34.32.66.58Web probing LocalDENov 5, 12:48 PM CST 22mNov 5, 4:48 PM CST (same IP)
34.32.66.58Looking for secret files LocalDENov 5, 12:48 PM CST 22mNov 5, 4:48 PM CST (same IP)
45.138.12.16WordPress config theft attempt LocalLTNov 5, 12:28 PM CST 2mNov 5, 4:28 PM CST
45.138.12.16Web probing LocalLTNov 5, 12:28 PM CST 2mNov 5, 4:28 PM CST (same IP)
45.138.12.16Looking for secret files LocalLTNov 5, 12:28 PM CST 2mNov 5, 4:28 PM CST (same IP)

Ban an IP yourself

Block an address you don't trust. It shows up under Active bans as Local and you can Unban it any time. Home-network (192.168.x, 10.x), loopback, and Tailscale addresses are refused so you can't lock yourself out.

Your recent actions

When (Central)ActionIPLengthReasonResult
No bans or unbans done from the dashboard yet.

Top offending IPs

IPCountryASAlertsStatus
93.123.109.103BGTechoff Srv Limited21 not banned
32.195.61.205US12 not banned
158.23.145.82MXMICROSOFT-CORP-MSN-AS-BLOCK9 not banned
34.174.154.87USGOOGLE-CLOUD-PLATFORM8 not banned
34.156.35.188USGOOGLE-CLOUD-PLATFORM8 not banned
93.123.109.230BGTechoff Srv Limited7 not banned
35.221.191.249TWGOOGLE-CLOUD-PLATFORM7 not banned
45.148.10.120NLTechoff Srv Limited6 not banned
34.55.4.36USGOOGLE-CLOUD-PLATFORM6 not banned
95.214.53.196PLMEVSPACE sp. z o.o.5
52.176.17.58USMICROSOFT-CORP-MSN-AS-BLOCK5 not banned
45.148.10.21NLTechoff Srv Limited5 not banned
35.238.129.244USGOOGLE-CLOUD-PLATFORM5 not banned
34.77.173.196BEGOOGLE-CLOUD-PLATFORM5 not banned
34.76.27.30BEGOOGLE-CLOUD-PLATFORM5 not banned

Attack types

Attack typeWhat it meansAlertsIPs
Web probingRequesting many pages that do not exist, looking for something to attack.6254
Looking for secret filesTrying to download files like .env, .git or backups.5437
Known bad bot / scannerThe visitor identified itself as a known attack tool or scanner.3837
Looking for admin pagesSearching for login/admin panels (phpMyAdmin, /admin, etc.).3228
Software fingerprintingChecking which web software you run, usually before attacking.2823
Aggressive web crawlingA bot hammering many pages very fast.2117
Open proxy abuse attemptTrying to use your server to relay their traffic.115
WordPress scanningProbing for WordPress pages and plugins.108
Web backdoor attemptsLooking for web shells left by earlier hacks.87
Known exploit attempt (CVE-2021-26086, Jira)Trying a specific published software vulnerability.76
Known exploit (CVE) scanningTrying many published vulnerabilities to see if any work.64
WordPress config theft attemptTrying to download wp-config.php (contains database passwords).53
Known exploit attempt (CVE-2021-41773)Trying a specific published software vulnerability.33
Path traversal attemptsUsing ../ tricks to read files outside the website.22
Known exploit attempt (CVE-2021-42013)Trying a specific published software vulnerability.22

Recent alerts

When (Central)IPScenarioCountryEvents
Nov 5, 4:24 PM CST85.155.14.41Web probingES23
Nov 5, 4:21 PM CST85.155.14.41Looking for secret filesES5
Nov 5, 4:07 PM CST146.70.194.228Web probingFR11
Nov 5, 3:35 PM CST45.45.237.39Aggressive web crawlingUS48
Nov 5, 3:35 PM CST45.45.237.39Known bad bot / scannerUS2
Nov 5, 3:35 PM CST45.45.237.39Web probingUS11
Nov 5, 3:35 PM CST45.45.237.39Looking for secret filesUS5
Nov 5, 3:24 PM CST159.89.174.87Web probingIN14
Nov 5, 3:24 PM CST159.89.174.87Software fingerprintingIN1
Nov 5, 3:24 PM CST159.89.174.87Known exploit attempt (CVE-2021-26086, Jira)IN1
Nov 5, 3:23 PM CST167.172.232.142Known exploit attempt (CVE-2021-26086, Jira)US1
Nov 5, 2:16 PM CST34.7.225.149Looking for admin pagesNL5
Nov 5, 2:16 PM CST34.7.225.149Software fingerprintingNL1
Nov 5, 2:15 PM CST34.7.225.149Web probingNL11
Nov 5, 2:15 PM CST34.7.225.149Looking for secret filesNL5
Nov 5, 1:42 PM CST95.214.53.196Open proxy abuse attemptPL1
Nov 5, 1:22 PM CST45.138.12.51Looking for secret filesLT5
Nov 5, 1:03 PM CST103.160.205.37Known exploit attempt (CVE-2021-42013)ID1
Nov 5, 1:03 PM CST103.160.205.37Known exploit attempt (CVE-2021-41773)ID1
Nov 5, 12:50 PM CST34.32.94.3Looking for admin pagesDE6
Nov 5, 12:50 PM CST34.32.94.3Software fingerprintingDE1
Nov 5, 12:49 PM CST34.32.66.58Looking for admin pagesDE5
Nov 5, 12:49 PM CST34.32.66.58Software fingerprintingDE1
Nov 5, 12:49 PM CST34.32.94.3Web probingDE11
Nov 5, 12:49 PM CST34.32.94.3Looking for secret filesDE5