CrowdSec: Last 20 Banned IPs (gluebox server)

Window: 2026-10-23, 04:43 to 13:54 UTC (about 9 hours) Source: cscli alerts list --origin crowdsec on the gluebox server (hostname d0pe), most recent 20 unique IPs that received a ban, enriched with reverse DNS and whois. Totals: 20 IPs, 37 alerts. One IP is our own home connection (TID-2601).

1. Who they are

xychart-beta horizontal
    title "Banned IPs by category"
    x-axis ["Research scanners", "Cloud VMs probing", "Shady hosting", "Residential (infected?)", "Us (TID-2601)"]
    y-axis "IPs" 0 --> 10
    bar [8, 6, 4, 1, 1]

Category	IPs
Research scanners	8	`████████████████`
Cloud VMs probing	6	`████████████`
Shady hosting	4	`████████`
Residential (infected?)	1	`██`
Us (TID-2601)	1	`██`

2. What tripped them

xychart-beta horizontal
    title "Banned IPs by scenario type"
    x-axis ["Bad user agent", "Known-CVE exploit", "Path probing", "Admin page probing", "SSH slow brute force", "Crawl non-statics"]
    y-axis "IPs" 0 --> 8
    bar [7, 6, 3, 2, 1, 1]

Scenario	IPs
`http-bad-user-agent`	7	`██████████████`
Known CVEs (Fortinet 2, Jira 2, Exchange 1, Apache 1)	6	`████████████`
`http-probing`	3	`██████`
`http-admin-interface-probing`	2	`████`
`ssh-slow-bf`	1	`██`
`http-crawl-non_statics` (us)	1	`██`

None of the targeted CVEs (Fortinet, Exchange, Jira, old Apache) apply to anything we run.

3. Where they come from (network owner)

xychart-beta horizontal
    title "Banned IPs by network owner"
    x-axis ["DigitalOcean", "Google Cloud", "Censys", "Microsoft Azure", "OVH", "Indiana Univ.", "Verizon (us)", "Cox", "Techoff SRV", "RocketCloud", "TC Datacenter", "Railnet"]
    y-axis "IPs" 0 --> 7
    bar [6, 3, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1]

DigitalOcean alone is 30% of the list: cheap VMs are the scanning industry's default.

4. When (UTC, by hour)

xychart-beta
    title "Bans per hour (UTC)"
    x-axis ["04", "05", "06", "07", "08", "09", "10", "11", "12", "13"]
    y-axis "IPs" 0 --> 7
    bar [3, 0, 3, 2, 1, 1, 6, 3, 0, 1]

The 10:00 spike includes our own ban (10:46 UTC = 06:46 EDT) and both Google Cloud Japan admin probers.

5. Most persistent

xychart-beta horizontal
    title "Alerts per IP (top 8)"
    x-axis ["34.146.84.210 GCP JP", "34.85.69.111 GCP JP", "2604:a880:…:7001 BinaryEdge", "45.138.12.16 TC DC", "195.178.110.159 Techoff", "157.230.0.48 DO", "188.166.233.129 DO", "206.81.24.227 LeakIX"]
    y-axis "Alerts" 0 --> 7
    bar [6, 6, 3, 2, 2, 2, 2, 2]

6. Full list

Time (UTC)	IP	Category	Scenario	Network / rDNS	Alerts
13:54	45.138.12.16	Shady hosting	http-bad-user-agent	TC Datacenter (LT)	2
11:12	195.178.110.159	Shady hosting	http-probing	Techoff SRV (BG); abuse contact is a Gmail address	2
11:02	157.230.0.48	Cloud VM	http-probing	DigitalOcean (US)	2
11:01	2602:80d:1007::60	Research scanner	http-bad-user-agent	Censys	1
10:46	74.109.25.35	Us	http-crawl-non_statics	Verizon Fios, Philadelphia	1
10:44	2001:41d0:303:3522::1	Cloud VM	http-bad-user-agent	OVH (FR)	1
10:38	149.165.155.230	Research scanner	http-bad-user-agent	Indiana Univ. Jetstream cloud	1
10:28	34.146.84.210	Cloud VM	http-admin-interface-probing	Google Cloud (JP)	6
10:14	188.166.233.129	Cloud VM	http-bad-user-agent	DigitalOcean (SG)	2
10:06	34.85.69.111	Cloud VM	http-admin-interface-probing	Google Cloud (JP)	6
09:44	34.91.229.116	Cloud VM	http-bad-user-agent	Google Cloud (NL)	1
08:12	66.132.224.84	Research scanner	http-bad-user-agent	Censys (`censys-scanner.com`)	1
07:16	2604:a880:400:d1:0:4:ded9:7001	Research scanner	fortinet-cve-2018-13379	BinaryEdge on DigitalOcean	3
07:16	137.184.140.91	Research scanner	fortinet-cve-2018-13379	BinaryEdge on DigitalOcean	1
06:56	40.124.187.32	Research scanner	CVE-2022-41082 (Exchange)	Stretchoid on Azure	1
06:33	77.239.124.220	Shady hosting	ssh-slow-bf	RocketCloud / Alfahost (NL)	1
06:03	184.185.26.51	Residential	http-cve-2021-41773 (Apache)	Cox cable customer	1
04:44	209.38.208.202	Research scanner	jira_cve-2021-26086	LeakIX on DigitalOcean	1
04:43	206.81.24.227	Research scanner	jira_cve-2021-26086	LeakIX on DigitalOcean	2
04:43	130.12.180.117	Shady hosting	http-probing	Railnet / Netiface ("PRIVATE-NETWORK")	1

Takeaways

Background noise, not targeting. Everything here is internet-wide scanning; CrowdSec is doing its job.
SSH: a slow brute force is coming from 77.239.124.0/24 (a neighbor, .222, was trying usernames at 14:06). Key-only authentication makes this harmless; confirm PasswordAuthentication no on gluebox.
Automate this: a Node-RED flow could send a daily version of this digest to ntfy.

Charts use Mermaid xychart-beta (renders in Gitea, GitHub and Obsidian with a recent Mermaid). The block-bar tables are a plain-text fallback.