You’re not wrong. If CrowdSec is your entire approach, it’s a little weird. But I use it as a (small) part of my overall blocking strategy. I use other lists and frankly, block most IPs by default. Those other IPs aren’t counted in the email screenshot though… only the CrowdSec based ones are coming through. I think a lot of the 137k above are just scanning bots to be frank.

Sure. So OpnSense is the real gem here. Or really any solid firewall/edge device CrowdSec is an optional (free) add-on module in OpnSense. It’s immediately operational at a minimal level without any registration. However, if you choose to register within the CrowdSec UI then you can load up more lists and tie it to your instance.

I also load up Hagezi’s Threat Intelligence Blocklists into my OpnSense firewall rules, which get updated (by him) on a rolling 12 hour basis. I also have OpnSense query Github every 12 hours to pull the updates.