Oct 17, 2025

CrowdSec VulnTracking Report: September 2025

Welcome to the CrowdSec VulnTracking Report. In these monthly reports, we explore key insights on emerging vulnerabilities and CVE exploitation trends, as spotted by the CrowdSec Network.

In September 2025, we added detection for 55 vulnerabilities and/or exploits to our database, translating them into scenarios for the CrowdSec Security Engine, AppSec rules for the CrowdSec WAF, and updated entries in our CTI.

DataCenter IPs are seven times more likely to be used to exploit known vulnerabilities than residential IPs.

Out of the tens of millions of IPs that we track every other month, a significant number are residential. According to various sources, more than 90% of all IPs fall into this category, which aligns with expectations.

What We Mean by “Residential”

In our case, we’re defining residential IPs as IPs attributed to a household via an ISP’s broadband/fibre /mobile network, as opposed to IP addresses assigned to a hosting provider, cloud provider, or colocation facility.

The Numbers Tell the Story

However, while more than 7% of tracked DataCenter IPs are actively (ie, last 15 days) exploiting known vulnerabilities, this number drops to below 1% for residential IPs. Yes, DataCenter IPs are seven times more likely to be used to exploit known vulnerabilities than residential IPs.

Why is that?

First of all, it’s much (really a lot) more expensive to use residential IPs, most of which are rented via “residential proxy” providers.

How much?

Well, Bright Data (the “biggest” and “most legitimate” Residential Proxy Providers—notice the quotes) charges around $4 per GB.

Secondly, some of those providers perform KYC. Yes, while it might come as a surprise, the biggest names out there (such as Bright Data) are legitimate businesses with a “Know Your Customer” process. They will clearly track potential abuse of their service and revoke customers’ accounts. On the other hand, a vast majority of DataCenter IPs – especially those on the low-cost end – completely ignore rampant abuse or even abuse reports.

What We Mean by “Residential”

The Numbers Tell the Story

Vulnerability signatures added to the CrowdSec database in September 2025