I updated and cleaned up a bit our "daily sources" feed. This feed is created around 4am GMT daily, and includes a summary of all the source IPs for which we received reports the prior day.
you can retrieve the feed at http[s]://isc.sans.org/feeds/daily_sources.
Its a plain tab delimited ASCII file. Comments (e.g. header/footer) are indicated by a '#' as first character. The columns are:
- IP Address (we use our "sortable" 0 padded format... 10.1.100.10 -> 010.001.100.010 ).
NOTE! This is not a "blocklist". It needs further processing to be used as such. The data is distributed under a "Creative Commons Share Alike" license. You may use it for non-commercial use for free as long as you attribute DShield or the SANS Internet Storm Center as the source of the data. We always like to hear how our data is used.
I will be teaching next: Intrusion Detection In-Depth - SANS Las Vegas Spring 2020
Oct 15th 2007
1 decade ago