SANS ISC // DSHIELD Live Stream
Font 100%
Return to Tools
GLOBAL THREAT TELEMETRY // SANS ISC DSHIELD

Live Global Attack Telemetry Map

Real-time adversary scanning and port exploitation telemetry streamed directly from the SANS Internet Storm Center (DShield) global sensor grid.

Last updated: --:--:-- • Telemetry Provider: SANS Institute (DShield Grid) • Poll Interval: 60s Live Sync
Threat Level
INFOCON: GREEN
SANS ISC Threat Condition
Today's Scanned Records
204,850+
Packets Ingested Across Grid
Active Adversary Sources
20,120+
Unique Scanning IP Addresses
Sensor Grid Nodes
274 Sensors
Global Distributed Honeypots
SANS ISC / DSHIELD GLOBAL ATTACK TELEMETRY ● LIVE SANS ISC FEED
REAL-TIME INGESTION FEED STREAMING // 60 FPS
SSH Brute Force
Mirai / Telnet IoT
Web Vulnerability Probes
Proxy / Development Alt Ports
Last Polled: --:--:-- • Source: SANS Internet Storm Center
Top 10 Targeted Exploitation Ports (Today)
Rank Port Service Scan Volume Unique Sources Targets Hit Observed Attack Vector
Top Hostile Scanning Sources (Threat Actors)
Rank Source IP Risk Rating Attacks Logged Total Hits Origin Country Autonomous System Status
Live Sensor Ingestion Stream
Timestamp Adversary IP Origin Target Port Honeypot Sensor Node Ingest
Telemetry Data Source & Access

Telemetry is queried directly from the SANS Internet Storm Center (ISC) / DShield open public API. No user accounts, subscriptions, or API keys are required to view or stream this data. All sensor records, port statistics, and threat actor indicators are published openly by SANS for global defense situational awareness.