CrowdSec Blocklists are curated IP threat feeds: lists of IPs that are attacking right now, which your firewall, CDN or proxy pulls on its own. Plug them in as a Palo Alto External Dynamic List, a FortiGate threat feed, a Check Point IoC feed, a Cisco Security Intelligence feed, a Juniper dynamic address feed or a Sophos third-party threat feed, in minutes and with no agent to install. The lists are built from more than 40 million attack signals a day from 500,000 servers, and come by industry, country or attack type.
Honeypots and third-party blocklists provide insufficient updates, resulting in cleared IPs remaining on blocklists and new infections taking longer to be added.
With a 5% daily rotation on average, you won’t get any of that with CrowdSec.
We shield our data against false positives and poisoning using a combination of methods, including:
An efficient blocklist offers more than just a list of unwanted IPs.
We employ behavior analysis on the data collected from the CrowdSec Network to provide you with ultra-curated lists — DDoS, botnets, VPNs, residential proxies, and more — to equip you with the intelligence you need to safeguard your services.
CrowdSec Blocklists offer an average of 5% daily rotation of IPs.
They are updated in real time and at top priority, providing you with fresh and relevant data daily and ensuring that the list of IPs you feed to your firewall is never out of date.
reduction in security alarm volume. Measured by our customers after using CrowdSec blocklists.
false positives in the CrowdSec Blocklists, thanks to our unique curation process.
Of proven aggressive IPs that CrowdSec proactively blocks are unknown to any other vendor for at least a week.
daily rotation of malicious IPs on average in the CrowdSec Intelligence Blocklist.
days on average ahead in adding malicious IPs to our blocklists compared to others list on the market
Of proven aggressive IPs that CrowdSec proactively blocks are still unknown to any other vendor for at least 15-20 days.
Wondering how we collect, analyze, and curate data?
Learn more about our data
Blocking any and all aggressive IPs is a solid option. But blocking IPs based on unwanted behaviors that have the potential to harm your infrastructure, gives you greater flexibility and targeted protection for your perimeter.
Explore the crowd-powered and ultra-curated CrowdSec Blocklists
Contains all IPs in our database that have been identified as actively aggressive, performing a wide variety of attacks. Proactively block these IPs if you don’t want to take any chances with malicious IPs potentially reaching your systems.
Contain IPs frequently attacking organizations in a specific sector. We currently cover Banking & Insurance, Healthcare, Hosting, MSSPs, Retail & Ecommerce, IT & Services. Block these IPs to reduce security alerts and establish a safer perimeter to protect critical systems.
Contain a CrowdSec-aggregated list of the most aggressive IPs specifically targeting entities in a specific country. Proactively block these IPs to reduce the volume of your security alerts and establish an overall safer perimeter.
Contains IPs identified as malicious or potential threats performing mass exploitation attempts contributing to your internet background noise and high volume of security alerts. Blocking these IPs can reduce your alert volume and save infrastructure resources.
Contain IPs that have been mainly reported for performing HTTP DoS attacks or HTTP exploitation attempts. Proactively block these IPs to prevent DoS and HTTP exploitation attempts on your systems and establish an overall safer perimeter.
Do you need custom blocklists for specific use cases? We work with you to make sure you have the intelligence you need to safeguard your services.
Integrating the CrowdSec Blocklists into your infrastructure is simple, effortless, and fail-proof.
2Implement the Blocklists as an automated blocking rules on your existing firewall or CDN
3Enjoy an immediate reduction in security alerts and a decrease in operational costs
We turn Crowd-Powered Intelligence into actionable blocklists to maximize the efficiency of your security operations and reduce your costs.
Proactively block known malicious IPs to avoid service downtime and potential data losses that can lead to a significant loss in revenue and customer trust, as well as regulatory fines.
Proactively block offensive IP addresses and make sure your servers dedicate all their resources to serving customers rather than attackers.
Filter out background noise to reduce the number of security alerts at the SOC level by 80% and allow your security experts to focus on critical security events.
Download our Guide to Cost-Effective Security Operations and learn how to maximize protection while reducing security & operational costs.
Download Now
The CrowdSec Blocklists integrate with a large number of tools, making you security ecosystem more powerful and efficient.
AWS Network Firewall
Azure Firewall
(GCP) Network Firewall
Cloudflare
MikroTik RouterOS
Windows Firewall
Palo Alto
CISCO
Fortinet
Check PointHow do I add a threat intelligence feed to my firewall?
Is a CrowdSec blocklist the same as a threat feed?
Do I need to install anything?
How often are the lists updated?
Will a blocklist block legitimate traffic?
Can I get lists targeting my industry or country?
What's free and what's paid?
