CrowdSec

CrowdSec is an open source collaborative security platform that combines intrusion detection, automated remediation, and collective threat intelligence to preemptively block malicious IP addresses before they can attack infrastructure. Founded in Paris and developed by a team of security engineers, the platform processes over 15 million security signals daily from a network of more than 100,000 installed instances across 190 countries, building a curated blocklist that is 7 to 60 days ahead of competing threat intelligence vendors. Sixteen percent of proven aggressive IPs in the database remain unknown to other vendors for at least 15 to 20 additional days, and fifty percent of malicious IPs are unknown to 89 out of 92 tested threat intelligence providers. The detection engine analyzes logs from web servers, databases, operating systems, containers, and cloud services using scenario files written in YAML that define behavioral patterns like distributed SSH brute force, web scanning, port enumeration, and credential stuffing. When a scenario triggers, the local remediation component automatically bans the offending IP using iptables, nftables, Cloudflare, nginx, or any supported bouncer, while simultaneously contributing the IP to the global blocklist. The central intelligence API provides IP reputation lookup, attack category classification, and geolocation data. Users can search any IP address to see its threat score, attack history, and associated behaviors. The platform claims to reduce security alert volume by up to 80 percent by filtering mass scanner noise, and to block up to 95 percent of mass exploitation attempts preemptively. Customers include Google, Deloitte, Microsoft, eBay, Red Bull, Le Monde, the Olympic Games, Arkema, and Vinci Construction. Open source under the MIT license.