SANS Internet Storm Center API
Free SANS Internet Storm Center DShield API with no key: most-targeted ports, attacking source counts, IP reputation and daily internet threat data from a global sensor network.
Endpoint tested and returned HTTP 200 on 2026-08-21
What is the SANS Internet Storm Center API?
The SANS Internet Storm Center API is a free, key-free interface to DShield data, aggregated from firewall and IDS logs submitted worldwide. It reports which ports are being scanned most heavily, how many distinct sources and targets are involved, and reputation information for individual IP addresses.
DShield has collected firewall logs from volunteers since 2000, which makes the Internet Storm Center one of the longest-running views of internet background noise. The `topports` endpoint is the headline product: which ports attackers are probing most today, with counts of distinct source addresses and targeted destinations. A sudden climb in a port's ranking is one of the earliest public signals that a new exploit is being weaponised.
The data reflects what participating sensors observed, so it is a sample of the internet rather than a census, and it is weighted towards where the volunteers are. Format is another quirk: `topports` returns an object whose keys are the strings `"0"`, `"1"`, `"2"` and so on rather than a JSON array, with `date` and `limit` mixed in at the same level — iterate carefully. ISC asks that automated clients send a User-Agent identifying themselves with contact details, and enforces that expectation. Every endpoint takes `?json` to switch from the default XML.
Quick facts
- Base URL
https://isc.sans.edu/api- Authentication
- No API key or account. ISC asks that automated users set a descriptive User-Agent including a contact email, and reserves the right to block clients that do not.
- Rate limit
- No published numeric limit, but ISC actively blocks abusive or unidentified clients. Most products update daily; poll accordingly.
- Pricing
- Free. DShield data is provided by the SANS Institute as a community service.
- CORS
- Enabled — callable directly from browser JavaScript
- Official docs
- Read the docs
How to use the SANS Internet Storm Center API
Every request below was executed against the live API on 2026-08-21, and the response shown is the real body it returned — not an illustration.
1. Fetch the five most-targeted ports today
GET https://isc.sans.edu/api/topports/records/5?json
curl 'https://isc.sans.edu/api/topports/records/5?json'const res = await fetch("https://isc.sans.edu/api/topports/records/5?json");
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);import requests
res = requests.get("https://isc.sans.edu/api/topports/records/5?json", timeout=20)
res.raise_for_status()
print(res.json()){
"0": {
"rank": 1,
"targetport": 443,
"records": 15386,
"targets": 80,
"sources": 1199
},
"1": {
"rank": 2,
"targetport": 123,
"records": 15249,
"targets": 81,
"sources": 1000
},
"2": {
"rank": 3,
"targetport": 23,
"records": 12470,
"targets": 97,
"sources": 3898
},
"3": {
"rank": 4,
"targetport": 80,
"records": 11335,
"targets": 66,
"sources": 1044
},
"4": {
"rank": 5,
"targetport": 0,
"records": 9238,
"targets": 39,
"sources": 334
},
"date": "2026-08-21",
"limit": 5
}Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
(endpoint) topports/records/{n} | path | Optional | The n most-targeted ports, ranked by record count. topports/records/5 |
(endpoint) ip/{address} | path | Optional | Reputation and attack history for a single IP address. ip/185.220.101.1 |
(endpoint) port/{number} | path | Optional | Activity history and service description for a specific port. port/22 |
(endpoint) sources/attacks/{n} | path | Optional | The most active attacking source networks. sources/attacks/10 |
(endpoint) dailysummary | path | Optional | Daily totals of records, targets and sources. dailysummary |
json | query | Required | Switch the response from the default XML to JSON. A bare flag with no value. json |
date | query | Optional | Historical data for a specific date. 2026-08-01 |
Response fields
"0", "1", "2" ...object- Numbered string keys holding each ranked result. This is an object, not an array — do not assume you can iterate it directly.
[n].rankinteger- Position in the ranking.
[n].targetportinteger- The destination port being probed.
[n].recordsinteger- Number of log records reported for that port.
[n].targetsinteger- Distinct destination addresses seen. A low target count with high records suggests focused rather than broad scanning.
[n].sourcesinteger- Distinct source addresses. High source counts suggest botnet-scale activity.
datestring- The day the data covers, sitting at the top level alongside the numbered keys.
What you can build with the SANS Internet Storm Center API
- Watch for new mass-scanning campaigns against a port
- Check whether an IP address has a history of attack traffic
- Add internet background-noise context to firewall log analysis
- Track scanning trends for a security newsletter or dashboard
- Correlate a spike in your own logs with global activity
Common errors and how to fix them
XML instead of JSON
The `json` flag was omitted.
Fix: Append `?json` to every request. It is a bare flag, not a key-value pair.
Cannot iterate the response
Results are numbered object keys, not an array.
Fix: Read `Object.keys()` and skip the non-numeric `date` and `limit` entries, or convert to an array first.
Blocked or throttled
No identifying User-Agent.
Fix: ISC asks for a User-Agent naming your tool with a contact address, and enforces it. Anonymous scrapers get blocked.
Data looks unrepresentative
DShield is a volunteer sensor network.
Fix: It samples the internet through participating firewalls, weighted to where volunteers are. Treat it as a strong indicator, not a census.
SANS Internet Storm Center API — frequently asked questions
Is the SANS Internet Storm Center API free?
Yes, free with no key or registration. The SANS Institute runs it as a community service, and asks in return that automated clients identify themselves with a descriptive User-Agent including contact details.
Where does the data come from?
DShield, a volunteer sensor network that has been collecting firewall and intrusion detection logs from participants worldwide since 2000. It is a sample of internet attack traffic rather than a complete census.
How do I get JSON instead of XML?
Append `?json` to the request. It is a bare flag with no value, and omitting it gives you the default XML representation.
What does a spike in a port's ranking mean?
Usually that a new exploit or scanning tool is being deployed against a service on that port. Sudden climbs in the topports ranking are among the earliest publicly visible signs that a vulnerability is being actively weaponised.
Tools that pair with this API
Port Number Lookup
Look up what a TCP or UDP port is used for — search 150+ common well-known and registered ports by number, service name or protocol. Instant and offline.
IP Address Validator
Validate lists of IPv4, IPv6 and CIDR entries with the exact failure reason per line — compressed ::, IPv4-mapped forms and prefixes included. Free.
JSON to CSV Converter
Convert a JSON array of objects to CSV online. Automatic column headers from the union of all keys, delimiter choice and proper quoting — all in-browser.
SANS Internet Storm Center is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 2026-08-21; always check the official documentation before relying on this API in production, as terms and limits can change.