SANS Internet Storm Center API

Free SANS Internet Storm Center DShield API with no key: most-targeted ports, attacking source counts, IP reputation and daily internet threat data from a global sensor network.

No API key requiredCORS enabledHTTPSFree tier

Endpoint tested and returned HTTP 200 on 21 Aug 2026

What is the SANS Internet Storm Center API?

The SANS Internet Storm Center API is a free, key-free interface to DShield data, aggregated from firewall and IDS logs submitted worldwide. It reports which ports are being scanned most heavily, how many distinct sources and targets are involved, and reputation information for individual IP addresses.

DShield has collected firewall logs from volunteers since 2000, which makes the Internet Storm Center one of the longest-running views of internet background noise. The `topports` endpoint is the headline product: which ports attackers are probing most today, with counts of distinct source addresses and targeted destinations. A sudden climb in a port's ranking is one of the earliest public signals that a new exploit is being weaponised.

The data reflects what participating sensors observed, so it is a sample of the internet rather than a census, and it is weighted towards where the volunteers are. Format is another quirk: `topports` returns an object whose keys are the strings `"0"`, `"1"`, `"2"` and so on rather than a JSON array, with `date` and `limit` mixed in at the same level — iterate carefully. ISC asks that automated clients send a User-Agent identifying themselves with contact details, and enforces that expectation. Every endpoint takes `?json` to switch from the default XML.

Quick facts

Base URL: https://isc.sans.edu/api
Authentication: No API key or account. ISC asks that automated users set a descriptive User-Agent including a contact email, and reserves the right to block clients that do not.
Rate limit: No published numeric limit, but ISC actively blocks abusive or unidentified clients. Most products update daily; poll accordingly.
Pricing: Free. DShield data is provided by the SANS Institute as a community service.
CORS: Enabled — callable directly from browser JavaScript
Official docs: Read the docs

How to use the SANS Internet Storm Center API

Every request below was executed against the live API on 21 Aug 2026, and the response shown is the real body it returned — not an illustration.

1. Fetch the five most-targeted ports today

GET https://isc.sans.edu/api/topports/records/5?json

curl

curl 'https://isc.sans.edu/api/topports/records/5?json'

JavaScript (fetch)

const res = await fetch("https://isc.sans.edu/api/topports/records/5?json");
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);

Python (requests)

import requests

res = requests.get("https://isc.sans.edu/api/topports/records/5?json", timeout=20)
res.raise_for_status()
print(res.json())

Response — HTTP 200

{
  "0": {
    "rank": 1,
    "targetport": 443,
    "records": 15386,
    "targets": 80,
    "sources": 1199
  },
  "1": {
    "rank": 2,
    "targetport": 123,
    "records": 15249,
    "targets": 81,
    "sources": 1000
  },
  "2": {
    "rank": 3,
    "targetport": 23,
    "records": 12470,
    "targets": 97,
    "sources": 3898
  },
  "3": {
    "rank": 4,
    "targetport": 80,
    "records": 11335,
    "targets": 66,
    "sources": 1044
  },
  "4": {
    "rank": 5,
    "targetport": 0,
    "records": 9238,
    "targets": 39,
    "sources": 334
  },
  "date": "2026-08-21",
  "limit": 5
}

Parameters

Parameter	Type	Required	Description
`(endpoint) topports/records/{n}`	path	Optional	The n most-targeted ports, ranked by record count. `topports/records/5`
`(endpoint) ip/{address}`	path	Optional	Reputation and attack history for a single IP address. `ip/185.220.101.1`
`(endpoint) port/{number}`	path	Optional	Activity history and service description for a specific port. `port/22`
`(endpoint) sources/attacks/{n}`	path	Optional	The most active attacking source networks. `sources/attacks/10`
`(endpoint) dailysummary`	path	Optional	Daily totals of records, targets and sources. `dailysummary`
`json`	query	Required	Switch the response from the default XML to JSON. A bare flag with no value. `json`
`date`	query	Optional	Historical data for a specific date. `2026-08-01`

Response fields

"0", "1", "2" ...object: Numbered string keys holding each ranked result. This is an object, not an array — do not assume you can iterate it directly.
[n].rankinteger: Position in the ranking.
[n].targetportinteger: The destination port being probed.
[n].recordsinteger: Number of log records reported for that port.
[n].targetsinteger: Distinct destination addresses seen. A low target count with high records suggests focused rather than broad scanning.
[n].sourcesinteger: Distinct source addresses. High source counts suggest botnet-scale activity.
datestring: The day the data covers, sitting at the top level alongside the numbered keys.

What you can build with the SANS Internet Storm Center API

Watch for new mass-scanning campaigns against a port
Check whether an IP address has a history of attack traffic
Add internet background-noise context to firewall log analysis
Track scanning trends for a security newsletter or dashboard
Correlate a spike in your own logs with global activity

Common errors and how to fix them

XML instead of JSON

The `json` flag was omitted.

Fix: Append `?json` to every request. It is a bare flag, not a key-value pair.

Cannot iterate the response

Results are numbered object keys, not an array.

Fix: Read `Object.keys()` and skip the non-numeric `date` and `limit` entries, or convert to an array first.

Blocked or throttled

No identifying User-Agent.

Fix: ISC asks for a User-Agent naming your tool with a contact address, and enforces it. Anonymous scrapers get blocked.

Data looks unrepresentative

DShield is a volunteer sensor network.

Fix: It samples the internet through participating firewalls, weighted to where volunteers are. Treat it as a strong indicator, not a census.

SANS Internet Storm Center API — frequently asked questions

Is the SANS Internet Storm Center API free?

Yes, free with no key or registration. The SANS Institute runs it as a community service, and asks in return that automated clients identify themselves with a descriptive User-Agent including contact details.

Where does the data come from?

DShield, a volunteer sensor network that has been collecting firewall and intrusion detection logs from participants worldwide since 2000. It is a sample of internet attack traffic rather than a complete census.

How do I get JSON instead of XML?

Append `?json` to the request. It is a bare flag with no value, and omitting it gives you the default XML representation.

What does a spike in a port's ranking mean?

Usually that a new exploit or scanning tool is being deployed against a service on that port. Sudden climbs in the topports ranking are among the earliest publicly visible signs that a vulnerability is being actively weaponised.

Tools that pair with this API

Port Number Lookup

Look up what a TCP or UDP port is used for — search 150+ common well-known and registered ports by number, service name or protocol. Instant and offline.

IP Address Validator

Validate lists of IPv4, IPv6 and CIDR entries with the exact failure reason per line — compressed ::, IPv4-mapped forms and prefixes included. Free.

JSON to CSV Converter

Convert a JSON array of objects to CSV online. Automatic column headers from the union of all keys, delimiter choice and proper quoting — all in-browser.

Alternatives to SANS Internet Storm Center API

If SANS Internet Storm Center does not fit, these security & auth apis cover similar ground. Every one was called before publishing, and each links to its own reference page with a working curl command and the response it returned.

API	What it does	Auth	CORS	Last verified
Pwned Passwords	Free Have I Been Pwned password API with no key. Check if a password appears in known breaches using k-anonymity — the password never leaves your server. Tested.	No key	Yes	19 Aug 2026
Have I Been Pwned Breaches	Free Have I Been Pwned breach list API with no key: every catalogued data breach with date, affected accounts and compromised data types. Tested curl example.	No key	Yes	19 Aug 2026
NVD CVE	Free NIST National Vulnerability Database API: search CVEs by id, keyword, severity, CVSS score and date with full descriptions and references. Tested example.	No key	Yes	19 Aug 2026
CIRCL CVE Search	Free CIRCL CVE Search API with no key: query vulnerabilities by id, vendor or product, and pull the latest published CVEs. CORS enabled. Tested example.	No key	Yes	19 Aug 2026
Kickbox Disposable	Free Kickbox open API with no key: check whether an email domain is disposable. Returns a single boolean, extremely fast and simple. Tested curl example.	No key	No	19 Aug 2026
MITRE ATT&CK TAXII	Free MITRE ATT&CK TAXII 2.1 server with no key: fetch the Enterprise, Mobile and ICS knowledge bases as STIX 2.1 objects — techniques, tactics, groups, software and mitigations.	No key	No	21 Aug 2026

All Security & Auth APIs

SANS Internet Storm Center is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 21 Aug 2026; always check the official documentation before relying on this API in production, as terms and limits can change.