I am sharing this as an example. I am still struggling to know how crowdsec works. I have some VPS with fail2ban but I just decided to include crowdsec a few days ago.
I see IPs like this trying to brute force and access sensitive information on my server.
I check and find out it has already been flagged in crowdsec as a malicious IP but this has not been added to any blocklist yet. Why was it not added to the blocklists?
I had assumed if this IP has been already flagged as malicious, it should have been added to blocklist and never allowed to reach my VPS but looks like my assumption is incorrect.
I am missing something?