The sensor checks its sources every 5 minutes and records here whatever changed since the previous check.
A single address seen by several defences at once. These are no longer scattered lines in the feed, but a sequence of actions: reconnaissance, password guessing, an attempted login.
| Address | Defences | Events | Last seen |
|---|---|---|---|
| 198.51.100.26 | ssh fail2ban suricata crowdsec | 22 | 11.10.2026 18:37 |
| 198.51.100.17 | ssh suricata | 13 | 08.10.2026 01:21 |
| 198.51.100.24 | ssh crowdsec | 2 | 11.10.2026 13:49 |
| Time | Severity | Source | Message | Count |
|---|---|---|---|---|
| 11.10.2026 18:37 | Warning | ssh |
SSH: login from a new address deploy@198.51.100.26
|
1 |
| 11.10.2026 17:52 | Warning | fail2ban | Fail2ban: new bans | 6 |
| 11.10.2026 16:52 | Warning | suricata |
Suricata: new alerts ET SCAN Nmap Scripting Engine User-Agent 198.51.100.26
|
14 |
| 11.10.2026 14:49 | Warning | ssh |
SSH: login from a new address admin@198.51.100.14
|
1 |
| 11.10.2026 13:49 | Critical | ssh |
SSH: root login sergey@198.51.100.24
|
1 |
| 11.10.2026 13:13 | Info | service | Protection service is running again: crowdsec | 1 |
| 11.10.2026 07:50 | Warning | network |
A new port is reachable from outside 5432
|
1 |
| 11.10.2026 07:45 | Warning | crowdsec |
CrowdSec: new decisions 198.51.100.26 (crowdsecurity/http-probing)
|
1 |
| 11.10.2026 04:33 | Warning | ssh |
SSH: login from a new address deploy@198.51.100.20
|
1 |
| 11.10.2026 03:17 | Critical | service | Protection service stopped: suricata | 1 |
| 10.10.2026 22:52 | Warning | network |
A new port is reachable from outside 9000
|
1 |
| 10.10.2026 19:14 | Critical | falco |
Falco: critical events Write below /usr/bin
|
1 |
| 10.10.2026 10:20 | Info | service | Protection service is running again: crowdsec | 1 |
| 10.10.2026 08:46 | Warning | network |
A new port is reachable from outside 5432
|
1 |
| 09.10.2026 09:05 | Info | service | Protection service is running again: crowdsec | 1 |
| 09.10.2026 03:32 | Warning | network |
A new port is reachable from outside 9000
|
1 |
| 09.10.2026 02:55 | Info | service | Protection service is running again: crowdsec | 1 |
| 09.10.2026 01:42 | Info | service | Protection service is running again: crowdsec | 1 |
| 08.10.2026 10:57 | Warning | crowdsec |
CrowdSec: new decisions 198.51.100.24 (crowdsecurity/http-probing)
|
1 |
| 08.10.2026 01:21 | Warning | ssh |
SSH: login from a new address deploy@198.51.100.17
|
1 |
| 07.10.2026 04:55 | Warning | network |
A new port is reachable from outside 8080
|
1 |
| 06.10.2026 20:06 | Critical | service | Protection service stopped: suricata | 1 |
| 06.10.2026 16:26 | Warning | suricata |
Suricata: new alerts ET WEB_SERVER SQL Injection Attempt 198.51.100.17
|
12 |
| 06.10.2026 13:35 | Warning | crowdsec |
CrowdSec: new decisions 198.51.100.35 (crowdsecurity/http-probing)
|
1 |
| 06.10.2026 02:24 | Info | service | Protection service is running again: crowdsec | 1 |