Fleet Security & Threat Audit Dashboard
2026-09-21 – 2026-09-27 (7 Days, PDT)
Failed SSH Logins (7d)
16,907
HTTP Exploit Probes
26,039
Deception Traps Hit
816 (162.6 hrs pinned)
Active CrowdSec Bans
52
CrowdSec Alerts
4,148
System Health & Stale Daemons
11 Stale Services
Daily Attack Timelines & Fleet Dynamics
Daily Attack Timeline (Fleet Aggregated)
Daily Attacks by Server Host
Geographic & Threat Pattern Intelligence
Top Attacking Countries
Top Attacking Data Centers & ASNs
Attack Pattern & Threat Vectors
Infrastructure Fleet Posture & Health Status
| Host | Status | CrowdSec | SSH Attacks (7d) | Web Probes (7d) | Stale Daemons | Reboot |
|---|---|---|---|---|---|---|
c1.mwan.dev |
Online | 8 Bans (713 alerts) | 3,317 | 1,512 | 2 services | No |
c2.mwan.dev |
Online | 10 Bans (449 alerts) | 3,424 | 2,870 | 2 services | No |
c3.mwan.dev |
Online | 7 Bans (313 alerts) | 3,643 | 2,262 | Clean | No |
home.mwan.dev |
Online | 27 Bans (2673 alerts) | 6,523 | 19,395 | 7 services | No |
Targeted Accounts & Credential Spraying Analysis
Breakdown of targeted usernames across SSH authentication attempts grouped by account status. Highlights attempts matching existing local system accounts.
Threat Actors & Sub-Threshold Repeat Scanners
Unbanned and sub-threshold scanning IPs observed across the infrastructure nodes during the audit window.
Alerted Attackers (No Ban)
894
Triggered alerts below ban threshold
Undetected Scanners
1,452
Scanned below alert rate limits
Unbanned Scanning IPs
2,068
No active firewall drop enforced
Observed Threat Actors (0 total)
Scroll to view all actors
| Attacking IP | Target Host | Observed Hits | Country / ASN | CrowdSec Status |
|---|