Crowdsec `Signals` starts banning me after some time

time="2026-08-29T07:44:50Z" level=error msg="Error performing request: Head \"http://0.0.0.0:8080/v1/decisions/stream\": context canceled" module=acquisition.appsec name=AppSecComponent type=appsec
time="2026-08-29T07:44:50Z" level=error msg="Error checking auth for API key: Head \"http://0.0.0.0:8080/v1/decisions/stream\": context canceled, extending cache duration" module=acquisition.appsec name=AppSecComponent type=appsec

time="2026-08-29T07:53:11Z" level=error msg="sending signal to central API: while performing request: context deadline exceeded"

time="2026-08-29T07:56:24Z" level=error msg="sending signal to central API: while performing request: Post \"https://api.crowdsec.net/v3/signals\": API error: Forbidden"

version: v1.7.8-63227459
Codename: alphaga
BuildDate: 2026-05-11_14:01:32
GoVersion: 1.26.3
Platform: docker
libre2: C++
User-Agent: crowdsec/v1.7.8-63227459-docker
Constraint_parser: >= 1.0, <= 3.0
Constraint_scenario: >= 1.0, <= 3.0
Constraint_api: v1
Constraint_acquis: >= 1.0, < 2.0
Built-in optional components: cscli_setup, datasource_appsec, datasource_cloudwatch, datasource_docker, datasource_file, datasource_http, datasource_journalctl, datasource_k8s-audit, datasource_kafka, datasource_kinesis, datasource_loki, datasource_s3, datasource_syslog, datasource_victorialogs, datasource_wineventlog, db_mysql, db_postgres, db_sqlite

$ cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 12 (bookworm)"
NAME="Debian GNU/Linux"
VERSION_ID="12"
VERSION="12 (bookworm)"
VERSION_CODENAME=bookworm
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"
$ uname -a
Linux d82d92388a08 5.15.153.1-microsoft-standard-WSL2 #1 SMP Fri Mar 29 23:14:13 UTC 2024 x86_64 GNU/Linux
$ 

$ cscli hub list -o raw
Loaded: 165 parsers, 12 postoverflows, 784 scenarios, 9 contexts, 6 appsec-configs, 223 appsec-rules, 165 collections
Unmanaged items: 2 local, 0 tainted
name,status,version,description,type
barnoux/caddy-coraza,enabled,0.1,"Parse coraza, logs from the web server caddy",parsers
crowdsecurity/appsec-logs,enabled,0.5,Parse Appsec events,parsers
crowdsecurity/caddy-logs,enabled,1.1,Parse caddy logs,parsers
crowdsecurity/cri-logs,enabled,0.1,CRI logging format parser,parsers
crowdsecurity/dateparse-enrich,enabled,0.2,,parsers
crowdsecurity/docker-logs,enabled,0.1,docker json logs parser,parsers
crowdsecurity/geoip-enrich,enabled,0.5,"Populate event with geoloc info : as, country, coords, source range.",parsers
crowdsecurity/http-logs,enabled,1.3,"Parse more Specifically HTTP logs, such as HTTP Code, HTTP path, HTTP args and if its a static ressource",parsers
crowdsecurity/iptables-logs,enabled,0.7,Parse iptables drop logs,parsers
crowdsecurity/mariadb-logs,enabled,0.4,Parse MariaDB logs,parsers
crowdsecurity/pkexec-logs,enabled,0.1,Parse pkexec logs specifically for CVE-2021-4034,parsers
crowdsecurity/public-dns-allowlist,enabled,0.1,Allow events from public DNS servers,parsers
crowdsecurity/segfault-logs,enabled,0.4,Parses segfault kernel side,parsers
crowdsecurity/sshd-logs,enabled,3.1,Parse openSSH logs,parsers
crowdsecurity/sshd-success-logs,enabled,0.1,Parse successful ssh logins,parsers
crowdsecurity/syslog-logs,enabled,1.0,,parsers
crowdsecurity/whitelists,enabled,0.3,Whitelist events from private ipv4 addresses,parsers
openappsec/openappsec-logs,enabled,0.3,Parse openappsec logs,parsers
crowdsecurity/cdn-whitelist,enabled,0.5,Whitelist CDN providers,postoverflows
crowdsecurity/discord-crawler-whitelist,enabled,0.1,Discord PTR whitelist,postoverflows
crowdsecurity/google-special-crawlers-whitelist,enabled,0.1,"Whitelist events from Google special crawlers (e.g. Google-InspectionTool, GoogleOther)",postoverflows
crowdsecurity/rdns,enabled,0.4,Lookup the DNS associated to the source IP only for overflows,postoverflows
crowdsecurity/seo-bots-whitelist,enabled,0.5,Whitelist good search engine crawlers,postoverflows
barnoux/crs-anomaly-score,enabled,0.1,Web exploitation detected via Core Rule Set inbound anomaly scoring set by the user in crs-setup.conf,scenarios
crowdsecurity/apache_log4j2_cve-2021-44228,enabled,0.7,Detect cve-2021-44228 exploitation attempts,scenarios
crowdsecurity/appsec-generic-test,enabled,0.2,Crowdsec Generic Test Scenario for AppSec: generate an alert for appsec out of band rule for testing,scenarios
crowdsecurity/appsec-native,enabled,0.3,Identify attacks flagged by CrowdSec AppSec via native rules,scenarios
crowdsecurity/appsec-vpatch,enabled,0.7,Identify attacks flagged by CrowdSec AppSec,scenarios
crowdsecurity/crowdsec-appsec-outofband,enabled,0.7,IP has made more than 5 requests that triggered out-of-band appsec rules,scenarios
crowdsecurity/CVE-2017-9841,enabled,0.2,Detect CVE-2017-9841 exploits,scenarios
crowdsecurity/CVE-2019-18935,enabled,0.2,Detect Telerik CVE-2019-18935 exploitation attempts,scenarios
crowdsecurity/CVE-2021-4034,enabled,0.2,Detect CVE-2021-4034 exploits,scenarios
crowdsecurity/CVE-2022-26134,enabled,0.4,Confluence - RCE (CVE-2022-26134),scenarios
crowdsecurity/CVE-2022-35914,enabled,0.2,Detect CVE-2022-35914 exploits,scenarios
crowdsecurity/CVE-2022-37042,enabled,0.2,Detect CVE-2022-37042 exploits,scenarios
crowdsecurity/CVE-2022-40684,enabled,0.3,Detect cve-2022-40684 exploitation attempts,scenarios
crowdsecurity/CVE-2022-41082,enabled,0.4,Detect CVE-2022-41082 exploits,scenarios
crowdsecurity/CVE-2022-41697,enabled,0.2,Detect CVE-2022-41697 enumeration,scenarios
crowdsecurity/CVE-2022-42889,enabled,0.3,Detect CVE-2022-42889 exploits (Text4Shell),scenarios
crowdsecurity/CVE-2022-44877,enabled,0.4,Detect CVE-2022-44877 exploits,scenarios
crowdsecurity/CVE-2022-46169,enabled,0.2,Detect CVE-2022-46169 brute forcing,scenarios
crowdsecurity/CVE-2023-22515,enabled,0.1,Detect CVE-2023-22515 exploitation,scenarios
crowdsecurity/CVE-2023-22518,enabled,0.3,Detect CVE-2023-22518 exploits,scenarios
crowdsecurity/CVE-2023-49103,enabled,0.3,Detect owncloud CVE-2023-49103 exploitation attempts,scenarios
crowdsecurity/CVE-2023-4911,enabled,0.5,exploitation of CVE-2023-4911: segfaulting in dynamic loader,scenarios
crowdsecurity/CVE-2024-0012,enabled,0.1,Detect CVE-2024-0012 exploitation attempts,scenarios
crowdsecurity/CVE-2024-38475,enabled,0.1,Detect CVE-2024-38475 exploitation attempts,scenarios
crowdsecurity/CVE-2024-9474,enabled,0.1,Detect CVE-2024-9474 exploitation attempts,scenarios
crowdsecurity/f5-big-ip-cve-2020-5902,enabled,0.3,F5 BIG-IP TMUI - RCE (CVE-2020-5902),scenarios
crowdsecurity/fortinet-cve-2018-13379,enabled,0.4,Detect cve-2018-13379 exploitation attempts,scenarios
crowdsecurity/grafana-cve-2021-43798,enabled,0.3,Grafana - Arbitrary File Read (CVE-2021-43798),scenarios
crowdsecurity/http-admin-interface-probing,enabled,0.5,Detect generic HTTP admin interface probing,scenarios
crowdsecurity/http-backdoors-attempts,enabled,0.6,Detect attempt to common backdoors,scenarios
crowdsecurity/http-bad-user-agent,enabled,1.2,Detect usage of bad User Agent,scenarios
crowdsecurity/http-bf-wordpress_bf,enabled,0.7,Detect WordPress bruteforce on admin interface,scenarios
crowdsecurity/http-crawl-non_statics,enabled,0.7,Detect aggressive crawl on non static resources,scenarios
crowdsecurity/http-cve-2021-41773,enabled,0.3,Apache - Path Traversal (CVE-2021-41773),scenarios
crowdsecurity/http-cve-2021-42013,enabled,0.3,Apache - Path Traversal (CVE-2021-42013),scenarios
crowdsecurity/http-cve-probing,enabled,0.6,Detect generic HTTP cve probing,scenarios
crowdsecurity/http-dos-bypass-cache,enabled,0.5,Detect DoS tools bypassing cache every request,scenarios
crowdsecurity/http-dos-invalid-http-versions,enabled,0.7,Detect DoS tools using invalid HTTP versions,scenarios
crowdsecurity/http-dos-random-uri,enabled,0.4,Detect DoS tools using random uri,scenarios
crowdsecurity/http-dos-switching-ua,enabled,0.5,Detect DoS tools switching user-agent too fast,scenarios
crowdsecurity/http-generic-bf,enabled,0.9,Detect generic http brute force,scenarios
crowdsecurity/http-generic-test,enabled,0.2,Crowdsec Generic Test Scenario: basic HTTP trigger,scenarios
crowdsecurity/http-open-proxy,enabled,0.5,Detect scan for open proxy,scenarios
crowdsecurity/http-path-traversal-probing,enabled,0.4,Detect path traversal attempt,scenarios
crowdsecurity/http-probing,enabled,0.4,Detect site scanning/probing from a single ip,scenarios
crowdsecurity/http-sap-interface-probing,enabled,0.1,Detect generic HTTP SAP interface probing,scenarios
crowdsecurity/http-sensitive-files,enabled,0.4,"Detect attempt to access to sensitive files (.log, .db ..) or folders (.git)",scenarios
crowdsecurity/http-sqli-probing,enabled,0.4,A scenario that detects SQL injection probing with minimal false positives,scenarios
crowdsecurity/http-technology-probing,enabled,0.1,Detect HTTP technology/vendor probing,scenarios
crowdsecurity/http-wordpress-scan,enabled,0.4,Detect exploitation attempts against common WordPress endpoints,scenarios
crowdsecurity/http-wordpress_user-enum,enabled,0.3,Detect WordPress probing: authors enumeration,scenarios
crowdsecurity/http-wordpress_wpconfig,enabled,0.3,Detect WordPress probing: variations around wp-config.php by wpscan,scenarios
crowdsecurity/http-xss-probing,enabled,0.4,A scenario that detects XSS probing with minimal false positives,scenarios
crowdsecurity/iptables-scan-multi_ports,enabled,0.3,Detect aggressive portscans,scenarios
crowdsecurity/jira_cve-2021-26086,enabled,0.4,Detect Atlassian Jira CVE-2021-26086 exploitation attempts,scenarios
crowdsecurity/mariadb-bf,enabled,0.2,Detect mariadb bruteforce,scenarios
crowdsecurity/netgear_rce,enabled,0.4,Detect Netgear RCE DGN1000/DGN220 exploitation attempts,scenarios
crowdsecurity/pulse-secure-sslvpn-cve-2019-11510,enabled,0.4,Detect cve-2019-11510 exploitation attempts,scenarios
crowdsecurity/spring4shell_cve-2022-22965,enabled,0.3,Detect cve-2022-22965 probing,scenarios
crowdsecurity/ssh-bf,enabled,0.3,Detect ssh bruteforce,scenarios
crowdsecurity/ssh-cve-2024-6387,enabled,0.2,Detect exploitation attempt of CVE-2024-6387,scenarios
crowdsecurity/ssh-generic-test,enabled,0.2,Crowdsec Generic Test Scenario: SSH brute force trigger,scenarios
crowdsecurity/ssh-refused-conn,enabled,0.1,Detect sshd refused connections,scenarios
crowdsecurity/ssh-slow-bf,enabled,0.4,Detect slow ssh bruteforce,scenarios
crowdsecurity/ssh-time-based-bf,enabled,0.3,Detect time-based ssh bruteforce attempts that evade rate limiting (with false positive reduction),scenarios
crowdsecurity/thinkphp-cve-2018-20062,enabled,0.7,Detect ThinkPHP CVE-2018-20062 exploitation attempts,scenarios
crowdsecurity/vmware-cve-2022-22954,enabled,0.3,Detect Vmware CVE-2022-22954 exploitation attempts,scenarios
crowdsecurity/vmware-vcenter-vmsa-2021-0027,enabled,0.3,Detect VMSA-2021-0027 exploitation attempts,scenarios
ltsich/http-w00tw00t,enabled,0.3,detect w00tw00t,scenarios
openappsec/openappsec-bot-protection,enabled,0.2,Detect openappsec 'prevent' securityActions on 'Bot Protection' events (when waf blocks malicious request),scenarios
openappsec/openappsec-cross-site-redirect,enabled,0.2,Detect openappsec 'prevent' securityActions on 'Cross Site Redirect' events (when waf blocks malicious request),scenarios
openappsec/openappsec-csrf,enabled,0.2,Detect openappsec 'prevent' securityActions on 'Cross Site Request Forgery' events (when waf blocks malicious request),scenarios
openappsec/openappsec-error-disclosure,enabled,0.2,Detect openappsec 'prevent' securityActions on 'Error Disclosure' events (when waf blocks malicious request),scenarios
openappsec/openappsec-error-limit,enabled,0.2,Detect openappsec 'prevent' securityActions on 'Error Limit' events (when waf blocks malicious request),scenarios
openappsec/openappsec-evasion-techniques,enabled,0.2,Detect openappsec 'prevent' securityActions on 'Evasion Techniques' events (when waf blocks malicious request),scenarios
openappsec/openappsec-general,enabled,0.2,Detect openappsec 'prevent' securityActions on 'General' events (when waf blocks malicious request),scenarios
openappsec/openappsec-http-limit-violation,enabled,0.2,Detect openappsec 'prevent' securityActions on 'Http limit violation' events (when waf blocks malicious request),scenarios
openappsec/openappsec-http-method-violation,enabled,0.2,Detect openappsec 'prevent' securityActions on 'Illegal http method violation' events (when waf blocks malicious request),scenarios
openappsec/openappsec-ldap-injection,enabled,0.2,Detect openappsec 'prevent' securityActions on 'LDAP Injection' events (when waf blocks malicious request),scenarios
openappsec/openappsec-open-redirect,enabled,0.2,Detect openappsec 'prevent' securityActions on 'Open Redirect' events (when waf blocks malicious request),scenarios
openappsec/openappsec-path-traversal,enabled,0.2,Detect openappsec 'prevent' securityActions on 'Path Traversal' events (when waf blocks malicious request),scenarios
openappsec/openappsec-probing,enabled,0.2,Detect openappsec 'prevent' securityActions on 'Vulnerability Scanning' events (when waf blocks malicious request),scenarios
openappsec/openappsec-rce,enabled,0.2,Detect openappsec 'prevent' securityActions on 'Remote Code Execution' events (when waf blocks malicious request),scenarios
openappsec/openappsec-request-rate-limit,enabled,0.2,Detect openappsec 'prevent' securityActions on 'Request Rate Limit' events (when waf blocks malicious request),scenarios
openappsec/openappsec-schema-validation,enabled,0.2,Detect openappsec 'prevent' securityActions on 'Schema Validation' events (when waf blocks malicious request),scenarios
openappsec/openappsec-sql-injection,enabled,0.2,Detect openappsec 'prevent' securityActions on 'SQL Injection' events (when waf blocks malicious request),scenarios
openappsec/openappsec-url-instead-of-file,enabled,0.2,Detect openappsec 'prevent' securityActions on 'URL instead of file' events (when waf blocks malicious request),scenarios
openappsec/openappsec-xss,enabled,0.2,Detect openappsec 'prevent' securityActions on 'Cross Site Scripting' events (when waf blocks malicious request),scenarios
openappsec/openappsec-xxe,enabled,0.2,Detect openappsec 'prevent' securityActions on 'XML External Entity' events (when waf blocks malicious request),scenarios
crowdsecurity/appsec_base,enabled,1.1,,contexts
crowdsecurity/bf_base,enabled,0.1,,contexts
crowdsecurity/firewall_base,enabled,0.2,,contexts
crowdsecurity/http_base,enabled,0.3,,contexts
crowdsecurity/http_extended,enabled,0.2,,contexts
crowdsecurity/appsec-default,enabled,0.4,,appsec-configs
crowdsecurity/generic-rules,enabled,0.4,,appsec-configs
crowdsecurity/virtual-patching,enabled,0.4,,appsec-configs
simbiat/simbiat-appsec,"enabled,local",,,appsec-configs
crowdsecurity/appsec-generic-test,enabled,0.3,AppSec Generic Test: trigger on GET /crowdsec-test-NtktlJHV4TfBSK3wvlhiOBnl`,appsec-rules
crowdsecurity/base-config,enabled,0.1,,appsec-rules
crowdsecurity/experimental-no-user-agent,enabled,0.2,Protect against no user agent,appsec-rules
crowdsecurity/generic-freemarker-ssti,enabled,0.4,Generic FreeMarker SSTI,appsec-rules
crowdsecurity/generic-wordpress-uploads-listing,enabled,0.4,Protect Wordpress uploads directory from listing files,appsec-rules
crowdsecurity/generic-wordpress-uploads-php,enabled,0.2,Detect php execution in wordpress uploads directory,appsec-rules
crowdsecurity/vpatch-connectwise-auth-bypass,enabled,0.4,Detect exploitation of auth bypass in ConnectWise ScreenConnect,appsec-rules
crowdsecurity/vpatch-CVE-2002-1131,enabled,0.1,"Detects XSS attempts in SquirrelMail 1.2.6/1.2.7 via unsanitized input in addressbook, options, search, and help modules.",appsec-rules
crowdsecurity/vpatch-CVE-2007-0885,enabled,0.1,Detects XSS vulnerability in Jira Rainbow.Zen via the id parameter in BrowseProject.jspa.,appsec-rules
crowdsecurity/vpatch-CVE-2014-5181,enabled,0.2,Detects path traversal in Last.fm Rotation plugin via snode parameter in lastfm-proxy.php,appsec-rules
crowdsecurity/vpatch-CVE-2017-9841,enabled,0.4,PHPUnit RCE (CVE-2017-9841),appsec-rules
crowdsecurity/vpatch-CVE-2018-1000861,enabled,0.1,Jenkins - RCE (CVE-2018-1000861),appsec-rules
crowdsecurity/vpatch-CVE-2018-10562,enabled,0.3,Dasan GPON RCE (CVE-2018-10562),appsec-rules
crowdsecurity/vpatch-CVE-2018-11511,enabled,0.2,Detects SQL injection attempts in ASUSTOR ADM via album_id parameter in /photo-gallery/api/album/tree_lists/.,appsec-rules
crowdsecurity/vpatch-CVE-2018-1207,enabled,0.1,Detects remote code injection in Dell iDRAC7/8 devices via LD_DEBUG CGI variable.,appsec-rules
crowdsecurity/vpatch-CVE-2018-13317,enabled,0.1,Detects unauthenticated access to TOTOLINK A3002RU password disclosure endpoint.,appsec-rules
crowdsecurity/vpatch-CVE-2018-13379,enabled,0.2,Fortinet FortiOS - Credentials Disclosure (CVE-2018-13379),appsec-rules
crowdsecurity/vpatch-CVE-2018-20062,enabled,0.1,ThinkPHP - RCE (CVE-2018-20062),appsec-rules
crowdsecurity/vpatch-CVE-2019-1003030,enabled,0.1,Jenkins - RCE (CVE-2019-1003030),appsec-rules
crowdsecurity/vpatch-CVE-2019-12989,enabled,0.4,Citrix SQLi (CVE-2019-12989),appsec-rules
crowdsecurity/vpatch-CVE-2019-18935,enabled,0.1,Telerik - RCE (CVE-2019-18935),appsec-rules
crowdsecurity/vpatch-CVE-2019-18952,enabled,0.1,Detects arbitrary file upload attempts to Xfilesharing up.cgi endpoint (CVE-2019-18952),appsec-rules
crowdsecurity/vpatch-CVE-2019-5418,enabled,0.2,Detects Rails file content disclosure via crafted Accept header (CVE-2019-5418),appsec-rules
crowdsecurity/vpatch-CVE-2019-7276,enabled,0.1,Detects unauthenticated remote code execution in Optergy Proton/Enterprise via backdoor console endpoint.,appsec-rules
crowdsecurity/vpatch-CVE-2019-9762,enabled,0.2,Detects SQL injection in PHPSHE 1.7 via the id parameter in pay.php,appsec-rules
crowdsecurity/vpatch-CVE-2020-10987,enabled,0.1,Detects command injection in Tenda AC15 AC1900 via deviceName parameter in setUsbUnload endpoint.,appsec-rules
crowdsecurity/vpatch-CVE-2020-11738,enabled,0.7,Wordpress Snap Creek Duplicator - Path Traversal (CVE-2020-11738),appsec-rules
crowdsecurity/vpatch-CVE-2020-13640,enabled,0.2,Detects SQL injection in wpDiscuz plugin via the order parameter in wpdLoadMoreComments action.,appsec-rules
crowdsecurity/vpatch-CVE-2020-17496,enabled,0.2,vBulletin RCE (CVE-2020-17496),appsec-rules
crowdsecuri