Results
We run DBshieldX on our own sites first.
Every figure on this site comes from DBshieldX's own records on our production sites, carries a date, and is explained below. We refresh them monthly.
The 7 days to 7 November 2026
requests a week inspected across 16 sites on 4 servers
clients block mode would have stopped in a week were scanners or fuzzers
of those attackers were on no CrowdSec blocklist
false-positive blocks on our first blocking route in its first 7.8 days
7 days to 7 November 2026, from DBshieldX's own event records. Latency: p95 added by the proxy on live traffic, October 2026. How we measure
How we measure
| Figure | Value | What it means and how it was measured |
|---|---|---|
| Traffic inspected | about 158,000 requests | Requests inspected by DBshieldX across 16 production sites on 4 servers in the 7 days to 7 November 2026, counted from its event records. |
| Would-block clients | 159 | Distinct clients that block mode would have stopped in the same 7 days. Every one we profiled was a scanner or fuzzer. |
| Already on CrowdSec blocklists | 11 of 159 (7%) | How many of those clients CrowdSec already knew about. The other 93% would have got through a blocklist alone. |
| False-positive blocks | 0 | On our first blocking route, in its first 7.8 days. A false positive is any block later marked as expected traffic in the review queue. |
| Sites in block mode | 8 | Since 8 November 2026, after their routes ran in monitor mode with settled review queues. |
| Added latency | 3.2 ms at p95 | Time the DBshieldX proxy added to requests on live traffic, October 2026. 95% of requests had at most this much added. |
| Policy rollback | under 7 seconds | Time for an activated policy version to reach every proxy, with no restart. |
| Redis round trip | 0.17 ms at p95 | Round trip to the Redis store DBshieldX uses for shared state. |
Lab evaluation, kept separate
Some figures come from test sets, not live traffic, and we label them that way:
- In evaluation, false positives on benign test traffic held at 0.10%.
- After engine 0.9.0, base64-wrapped, shell-trick and path-encoding evasions in our evasion test set were caught 93–100% of the time.
A machine-learning scorer is in evaluation and only observes for now. Its test results are not production results, and we don't quote them as such.
What we don't do
- We don't publish attack payloads or anything that identifies a visitor: totals and category names only.
- We don't show logos of companies that aren't customers, or testimonials we don't have permission for.
- We don't round figures up, and every one carries the period it covers.
Monthly figures are published as attack reports.
See your own numbers.
We'll run DBshieldX in monitor mode on one of your sites for a week and show you the same figures for your traffic.