How to Protect Your Website from Layer 7 and large scale DDoS attacks and many other exploits for free 2022

The internet is now more sophisticated than ever before and so are the new tools attackers are using to try to compromise your web site and services.

Crowdsec has a nice free opensource solution that works great and has a smart intelligence system helping making the decisions.

This works with IPtables, PHP level, and many other Bounder Services can also be deployed.

Outnumbering cybercriminals all together

CrowdSec is a free, open-source and collaborative IPS.
Analyze behaviors, respond to attacks & share signals across the community.

Get Started

Check our CTI console to monitor your alert data and find out more about your attackers.

01 Parse logs

Acquire data from any source (syslog, cloudtrails, SIEM, etc.)
02 Set up your own intrusion detection system

Apply behavior scenarios to identify cyberthreats
03 Automate your security

Define the type of remediation you want to apply and where
04 Leverage the community’s IP blocklist

Share and benefit from a crowdsourced and curated cyber threat intelligence system

The open-source and participative IPS

CrowdSec is designed to run seamlessly on virtual machines, bare-metal servers, containers or to be called directly from your code with our API.

Read the Documentation

Collaborative Security

Our strength comes from our cybersecurity community that is burning cybercriminals’ anonymity. By sharing IP addresses that aggressed you, you help us curate and redistribute a qualified IP blocklist to protect everyone.

Stateless & Decoupled

By decoupling detection (agent) and remediation (bouncer), CrowdSec doesn’t interrupt your data streams nor creates any single point of failure. It can fit any serverless, cloud-based, VM or bare-metal context in one (agent) to one (bouncer), one to many, many to one, and many to many typologies.

High performance

Written in Golang, CrowdSec is 60x faster than tools like Fail2ban and can parse massive amounts of logs in no time. Agents can read log files, SIEM events, through a network socket and can be used in high throughput networks. For CPU & RAM-constrained assets, bouncers can just make very light API calls.

Observability

Dashboards are great steering tools. CrowdSec is instrumented with Metabase & Prometheus to help you make smarter investments of both time & money and better defend yourself. Compliance reporting like PCI-DSS, ISO, GDPR are also on our roadmap.

Multilayer & IPV6 ready

No matter if your servers or attackers are using IPV4 or IPV6 addresses, CrowdSec will do the job. This next-gen HIDS has been designed to not only deal with IPs but also with user sessions and more business-oriented layers.

Ease of use

CrowdSec is designed and developed by former pentesters, SecOps & DevOps, to be a fire-and-forget, easy-to-deploy, automate, configure and maintain software. This is what CrowdSec is about: bringing security to the largest number.

GDPR Compliant

Sharing is caring but privacy matters even more. We collect the very strict minimum in order to be GDPR compliant. Hence, we never export your logs and the only data sent for curation are a timestamp, the aggressive IP, and the scenario used in the attack.

Join the crowd

Cybercriminals constantly collaborate together, on a world scale. Each IP they control are anonymity tokens to hide their hacktivities. Our only chance is to stand as a crowd and act in a coordinated way, as they do. When you, Sysadmins, Devops & Secops join forces, you outnumber them and can burn their IPs one by one, crippling this precious anonymity.

1.9M rogue IPs detected
4.9k stars on GitHub
150 countries

False positive & Poisoning resilient

Minimum necessary remediation
3-day probing mechanism (auto-deban)
Self-unban
Consensus involving range qualification
Tailor-made lists to avoid broadcasting all IPs blindy

Get Started

Install the Agent

Debian/Ubuntu

$ curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | sudo bash
$ sudo apt-get install crowdsec
RHEL/CentOS/Amazon Linux

$ curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.rpm.sh | sudo bash
$ sudo yum install crowdsec
Debian (Official)

$ sudo apt-get install crowdsec
Docker

$ docker run -d -v acquis.yaml:/etc/crowdsec/acquis.yaml -e COLLECTIONS=”crowdsecurity/sshd” -v /var/log/auth.log:/var/log/auth.log -v /path/mycustom.log:/var/log/mycustom.log –name crowdsec crowdsecurity/crowdsec
FreeBSD

$ pkg install crowdsec
Tarball

$ wget -qO – https://github.com/crowdsecurity/crowdsec/releases/latest/download/crowdsec-release.tgz | tar zxvf –
$ cd crowdsec-v* && sudo ./wizard.sh -i

Install a Bouncer

Firewall: Debian/Ubuntu

$ curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | sudo bash
$ sudo apt install crowdsec-firewall-bouncer-iptables
Firewall: RHEL/CentOS/Amazon Linux

$ curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.rpm.sh | sudo bash
$ sudo yum install crowdsec-firewall-bouncer-iptables
Custom: Debian/Ubuntu

$ curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | sudo bash
$ sudo apt install crowdsec-custom-bouncer
Custom: RHEL/CentOS/Amazon Linux

$ curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.rpm.sh | sudo bash
$ sudo yum install crowdsec-custom-bouncer
AWS/GCP

https://hub.crowdsec.net/author/fallard84/bouncers/cs-cloud-firewall-bouncer
Nginx: Debian/Ubuntu

$ curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | sudo bash
$ sudo apt install crowdsec-nginx-bouncer
WordPress

Click here to download the official plugin

Download v1.3.2

Luxottica - 77,093,812 breached accounts May 19, 2023

In March 2021, the world's largest eyewear company Luxoticca suffered a data breach via one of their partners that exposed the personal information of more than 70M people. The data was subsequently sold via a popular hacking forum in late 2022 and included email and physical addresses, names, genders, dates of birth and phone numbers. […]

RentoMojo - 2,185,697 breached accounts May 10, 2023

In April 2023, the Indian rental service RentoMojo suffered a data breach. The breach exposed over 2M unique email addresses along with names, phone, passport and Aadhaar numbers, genders, dates of birth, purchases and bcrypt password hashes.

MEO - 8,227 breached accounts April 24, 2023

In early 2023, a corpus of data sourced from the New Zealand based face mask company MEO was discovered. Dating back to December 2020, the data contained over 8k customer records including names, addresses, phone numbers and passwords stored as MD5 Wordpress hashes. MEO did not respond to multiple attempts to report the breach.

Terravision - 2,075,625 breached accounts April 23, 2023

In February 2023, the European airport transfers service Terravision suffered a data breach. The breach exposed over 2M records of customer data including names, phone numbers, email addresses, salted password hashes and in some cases, date of birth and country of origin. Terravision did not respond to multiple attempts by individuals period over a period […]

OGUsers (2022 breach) - 529,020 breached accounts April 14, 2023

In July 2022, the account hijacking and SIM swapping forum OGusers suffered a data breach, the fifth since December 2018. The breach contained usernames, email and IP addresses and passwords stored as argon2 hashes. A total of 529k unique email addresses appeared in the breach.

The Kodi Foundation - 400,635 breached accounts April 13, 2023

In February 2023, The Kodi Foundation suffered a data breach that exposed more than 400k user records. Attributed to an account belonging to "a trusted but currently inactive member of the forum admin team", the breach involved the administrator account creating a database backup that was subsequently downloaded before being sold on a hacking forum. […]

Sundry Files - 274,461 breached accounts March 31, 2023

In January 2022, the now defunct file upload service Sundry Files suffered a data breach that exposed 274k unique email addresses. The data also included usernames, IP addresses and passwords stored as salted SHA-256 hashes.

Leaked Reality - 114,907 breached accounts March 31, 2023

In January 2022, the now defunct uncensored video website Leaked Reality suffered a data breach that exposed 115k unique email addresses. The data also included usernames, IP addresses and passwords stored as either MD5 or phpass hashes.

TheGradCafe - 310,975 breached accounts March 24, 2023

In February 2023, the grad school admissions search website TheGradCafe suffered a data breach that disclosed the personal records of 310k users. The data included email addresses, names and usernames, genders, geographic locations and passwords stored as bcrypt hashes. Some records also included physical address, phone number and date of birth. TheGradCafe did not respond […]

Shopper+ - 878,290 breached accounts March 11, 2023

In March 2023, "Canada's online shopping mall" Shopper+ disclosed a data breach discovered on a public hacking forum. The breach dated back to September 2020 and included 878k customer records with email and physical addresses, names, phone numbers and in some cases, genders and dates of birth.