CrowdSec Majority Report

IPv6 represents 20% of reported malicious IPs.

The number of compromised assets is not the most accurate method of evaluating an Autonomous System (AS).

Third-party reports of infected machines play a significant role.

Only 5% of reported IPs are flagged as VPN or proxy users.

Malevolent Duration (MD) is a more accurate metric for evaluating AS.

Low MD translates to a lower risk for a business to inherit a machine that has been flagged as malevolent.