Curated Threat IntelligencePowered by the Crowd

Maximize your security investments with ultra-curated data

CrowdSec application screenshots

CrowdSec is trusted by


Unmatched Data Curation

Get more than just a list of unwanted IPs

We ultra-curate our data to provide you with detailed context on the behavior of aggressive IPs and build curated lists — DDoS, botnets, VPNs, residential proxies, and more — to equip you with the intelligence you need to safeguard your services.

Learn more about our data
application screenshot

Real-Life Data

While blocklists are typically built on data collected from honeypots or data scraped from not-so-reliable third-party sources, our data comes from real users, real servers, in real production environments.

Data Diversity

Nothing better guarantees data quality than data diversity. The growing CrowdSec Network consists of 70,000+ active users in more than 190 countries around the world, sharing an average of 10 million signals on aggressive IPs daily.

Safeguarded Quality

We shield our data against false positives and poisoning using a combination of methods, including reporter trust score and diversity, machine profiling, cross-checking data sources to guarantee information consistency, and more.

Top-Priority Updates

Honeypots and third-party blocklists provide insufficient updates, resulting in cleared IPs remaining on blocklists and new infections taking longer to be added. You won’t get any of that here. CrowdSec Blocklists offer an average of 5% daily rotation of IPs.


False Positives


Protection Against Data Poisoning


Daily Rotation

Plug N’ Play with Immediate Benefits

Integrating the CrowdSec Blocklists into your infrastructure is simple, effortless, and fail-proof.


Generate a CrowdSec CTI API key via the CrowdSec Console

Get started

Implement the Blocklists as automated blocking rules on your existing firewall or CDN


Enjoy an immediate reduction in security alerts and a decrease in operational costs

Philosophy and Vision

CrowdSec embraces a unique approach to cyber intelligence by leveraging the power of the crowd to provide an open source and collaborative method for data collection. This is what we call, The Network Effect of Cyber Threat Intelligence.

The reason we chose the collaborative approach is simple. Solely relying on a honeypot network could never yield the results needed for building a global CTI. Honeypots are expensive to run, and the services to which they are exposed are not as trustworthy as a real machine. Running a fake WordPress server with low SEO will only catch very spammy attackers. On the other hand, having access to real machines with thousands of visitors, hosting content of interest, and reporting real targeted attacks, is what makes the difference between an average CTI and a top-quality CTI.


Active users


Countries Worldwide


Signals/Day on Aggressive IPs Shared on Average

Boosting SOC Efficiency & Cutting Costs

We turn Crowd-Powered Intelligence into actionable blocklists to maximize the efficiency of your security operations and reduce your costs.

Be Proactive & Minimize Downtime

Proactively block known malicious IPs to avoid service downtime and potential data losses that can lead to a significant loss in revenue and customer trust, as well as regulatory fines.

block malicious ip

Reduce Server Load & Egress Costs

Proactively block offensive IP addresses and make sure your servers dedicate all their resources to serving customers rather than attackers.


Optimize Incident Response Costs

Filter out background noise to reduce the number of security alerts at the SOC level by 80% and allow your security experts to focus on critical security events.

Explore the CrowdSec Ecosystem

We take data quality very seriously and nothing speaks of higher data quality than data diversity. That is why we are making sure we can collect data from a great variety of sources. The CrowdSec Security Engine, CrowdSec’s open-source software, sits at the heart of our data collection process.

The Security Engine is OS and infrastructure-agnostic and integrates with many popular tools with the CrowdSec ecosystem constantly expanding.

More integrations mean more signals on aggressive IPs generated. The higher the number of signals generated, the higher the data quality.

Discover our integrations

Leverage thePower of the Crowd

Gain Efficiency in Your Security Posture