2024
A Year of
Digital Resilience

Note: this summary is based on the last 3 months of data.

15 million attacks per day

Together, the CrowdSec Community blocked 15 million attacks from 650'000 unique attackers per day.

A growing herd

Our herd also grew at a consistent rate this year, leading to a 95% increase in active Security Engines.

Supreme Leader Debian

Similar to last year, a majority of our users are hosting their services on Debian , but FreeBSD-based systems beat them in growth this year, contributing about 25% of our network growth.

Attacking us? Attacking US!

When it comes to the origin of attackers, big countries continue to dominate. Leader of the pack is the US with 4.7 million unique malicious IPs, followed by India with 1.8 million attackers and Germany with 1.6 million.

Hosting captured machines

When it comes to Autonomous Systems, hosters lead the charts, making up 80% of our top 10 AS . The remaining 2 are internet service providers from Brazil and China respectively. As with previous years, most of the attackers hitting servers are themselves captured machines .

HTTP dethrones SSH

This year was the first time that we prevented more HTTP attacks than SSH attacks. This coincides with our renewed focus on the web with the release of the CrowdSec Web Application Firewall . At its peak, the CrowdSec network detected 16.5 million unique attackers engaging in scanning and reconnaisance behaviors.

Lots of love for PHP

We caught a lot of CVEs this year. Good old CVE-2017-9841 was still the most attempted exploit for this year. For a breakdown of each countries favorite CVE, check the following table:

Brazil	CVE-2021-43798: Path Traversal in Grafana
USA	CVE-2017-9841: Remote Code Execution in PHPUnit
Germany	CVE-2021-26086: Path Traversal in Atlassian Jira
China	CVE-2024-6387: Race Condition in OpenSSH (RegreSSHion)
Great Britain	CVE-2021-26086: Path Traversal in Atlassian Jira
France	CVE-2023-22515: Remote Code Execution in Atlassian Confluence
India	CVE-2021-41773: Path Traversal in Apache HTTP Server
Japan	CVE-2018-20062: Remote Code Execution in NoneCMS
Russia	CVE-2021-43798: Path Traversal in Grafana
Australia	CVE-2022-26134: Remote Code Execution in Atlassian Confluence

Drop it like it's hot

With version 1.6.3 of the Security Engine, we released the Remediation Component metrics to help our users understand the impact of our blocklists. Among the 6000 organizations that have already enabled this, we drop over 35 billion packets per month . If those packets were not blocked they would produce an estimated 60 TB of server logs

Talk is cheap, send patches!

Together with our open source community we received around 670 contributions to the Security Engine. In addition to this, 39 people contributed their scenarios and parsers to our Hub, helping us improve the protection for the whole CrowdSec Network. Whether its raising issues or contributing code, we thank you very much for your help!

225 socks for Christmas

Our marketing team was busy at events this year, handing out 225 of our super stylish CrowdSec socks . If you missed them, you can always find more at our swag store. Who knows, they might even come with a special surprise .

2024A Year of Digital Resilience