Handler's Diary (Title Only) (https://isc.sans.edu/rssfeed.xml)
Handler's Diary (Full text) (https://isc.sans.edu/rssfeed_full.xml)
Consolidated Security News Feed (Title Only, included ISC Diary)
Security News feed selected and rated by the handlers
Text (Tab Delimited) Feeds
- Up and Coming Ports
- Top 100 Source IPs (DO NOT USE AS BLOCKLIST)
- All Source IPs (large: 40-50MB. DO NOT USE AS BLOCKLIST)
- Block List
Why Should I Not Use the "Top 100" data as blocklist?
DShield's primary purpose is to collect data for network security research. In order to fullfill this role, we collect data "as is" with little filtering. Filters are applied to the raw data for specific purposes, but we can not delete data from our raw database without compromissing the data integrity.
Our data does include false positives, and we will not remove them. It would make it harder to observe long term trends. If a report is a false positive or not depends to a large extend on the question being asked.
We offer one blocklist, and one blocklist only (http://isc.sans.edu/block.txt). Unlike for our other lists, we will remove IPs from this blocklist if asked to.
Diary Notification (for pagers)
We do offer a number of customizable reports for data submitters. Please log in to find out more.