Internet Storm Center / DShield API

We are using a simple REST API. The following functions are available:

Note: Output formats include xml (default), json, text and php. For some feeds that are simple enough, csv and tab (TAB delimited) are available. Just add on to the url as a parameter such as http://isc.sans.edu/api/handler?text

Our data often uses lable to identify the type of data for a particular IP address. See here for details about the types we identify.

Proper Use of the API

  • This API is provided as-is, on a "best-effort" basis. Do not build your business critical applications around it.
  • We do not have strict rate limits, but at times of high load, you may get "429" responses. Please stop sending queries for 5 minutes if you get a 429 error. You may want to obey the time specified in the "Retry-After" header. See RFC6585 for what this may look like if it works right. But doing so may require a basic understanding of HTTP requests and responses.
  • Do not resell the data.
  • Please let us know how you use the data.
  • Consider contributing data by running a honeypot. Don't just be a leach and use data without giving back.
  • Currently, we do not require authentication (we may in the future). But please add contact information ,for example an email address, as a User-Agent, to allow us to reach out if there is a problem.
  • We block some "default" user-agents and follow the "you have to be smart enough to set a custom user agent to use this API" rule.
  • Our customer service bots respond to email (jullrich - at - sans.edu) and enforce rate limits by using snarky short replies when under high load.
  • It is ok to use this data for commercial purposes, for example to protect your own company's network. But again: do not resell, do not complain if it doesn't work sometimes, don't blame us if patients start dying in your hospital because the anti-ransomware script you built around our data turned off the IV pumps after it saw some badly formatted data.
  • If your lawyers ask, the data is provided using a Attribution-NonCommercial-ShareAlike 4.0 International (CC BY-NC-SA 4.0) License. For non lawyers: A generic "Play nice and don't be an idiot" license applies.

Bulk Data Feeds

Please also consider our bulk downloads that offer daily summaries in one file. They are often more efficient if you need to lookup many IP addresses. See our data feed documentation for details.

API Calls

backscatter

Returns possible backscatter data. This report only includes "syn ack" data and is summarized by source port
Parameters: Date (in Y-M-D format), optional: number of rows returned (default 1000)


    http://isc.sans.edu/api/backscatter/2011-12-01/10

<?xml version="1.0" encoding="UTF-8"?>
<backscatter>
 <sourceport> 6000 </sourceport>
 <count> 563542 </count>
 <sources> 518 </sources>
 <targets> 94654 </targets>
 </sourceport>
...
</backscatter>
Top of page

cloudips

Returns a current list of subnets used by cloud providers (Amazon, Google, ...) 


https://isc.sans.edu/api/cloudips
<?xml version="1.0" encoding="UTF-8"?>
<cloudips>
<cidr>
<ip>129.146.0.0</ip>
<netmask>21</netmask>
<provider>oracle</provider>
</cidr>
...
</cloudips>

cloudcidrs

Same as above, but instead of returning the prefix and netmask in different fields, the standard "CIDR" notation is used

Top of page

handler

Returns the name of the handler of the day
No Parameters

    
http://isc.sans.edu/api/handler

<?xml version="1.0" encoding="UTF-8"?>
<handler>
 <name>Chris Mohan<name>
</handler>
Top of page

header_summary

A summary of all the HTTP request headers received by our web honeypots. The data includes the first and last date the particular header was seen, and how often the header was seen
No Parameters 

<header>
   host
</header>
<firstseen>
  2024-06-10
</firstseen>
<lastseen>
  2025-03-26
</lastseen>
<count>
  230331778
 </count>

Top of page