What this box is blocking
A live view of CrowdSec on the server behind divyam.top. CrowdSec parses Caddy's access logs on this box and pulls the community blocklist; a Caddy bouncer answers 403 to banned addresses. Decisions expire on their own — the numbers here are what is active right now.
Top scenarios
| crowdsecurity/http-bad-user-agent | 1 | |
| crowdsecurity/http-probing | 1 | |
| crowdsecurity/jira_cve-2021-26086 | 1 |
By origin
| crowdsec | 3 |
crowdsec / cscli: decided here from this box's own logs. CAPI / lists: shared by the CrowdSec community.
Agent counters
| alerts_in_database | 5 |
| local_detections_since_start | 4 |
A sample of current decisions
Addresses are masked; local detections are listed first.
| address | scenario | origin | type | expires in |
|---|---|---|---|---|
| 159.65.18.x | crowdsecurity/jira_cve-2021-26086 | crowdsec | ban | 3h2m6s |
| 159.65.18.x | crowdsecurity/http-probing | crowdsec | ban | 3h2m11s |
| 108.129.183.x | crowdsecurity/http-bad-user-agent | crowdsec | ban | 3h56m21s |
How it works
Caddy writes access logs; a CrowdSec agent on the same box parses them with the standard HTTP scenarios (probing, bad user agents, path traversal, brute force …) and subscribes to the community blocklist. When a decision is made, a CrowdSec bouncer inside Caddy answers 403 to that address until the decision expires. This page asks the local API for the active decisions and shows the shape of them — nothing here identifies a visitor.
Snapshot at 04:09:26 UTC, cached 30s. curl https://security.divyam.top/ returns the same data as JSON.