Skip to content
Install MCP

Threat feed

DShield Top 20 Attackers

Last fetched

General Blacklists · refreshed daily · last verified

DShield Top 20 Attackers is a General Blacklists threat-intelligence feed, refreshed daily, indexed by WhisperGraph.

Live data for this page is temporarily unavailable.

The graph returned an error for this lookup. Refresh in a moment to retry — fresh data is fetched on the next visit.

What is DShield Top 20 Attackers

DShield Top 20 Attackers is the SANS Internet Storm Center's daily ranking of the twenty source networks generating the most corroborated attack traffic across the DShield sensor network, ordered by report volume rather than a fixed inclusion list. Because it is a ranking rather than a static block list, it changes membership day to day and is best used as an alerting or enrichment signal, flagging whichever sources are currently the internet's noisiest attackers, rather than as a permanent deny-list. It draws on the same multi-decade DShield contributor base as the project's Recommended Block List. It is indexed here as a current-activity companion to that longer-running list.

Source
https://isc.sans.edu/
Refresh cadence
daily

Indicators currently listed

Related pages

Pivot from DShield Top 20 Attackers into the indicators it lists.

Queries

Resolves the feed's categories.


MATCH (f:FEED_SOURCE {name: $slug})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
WITH f, collect(c.name) AS categories
RETURN f.name AS slug, f.id AS id, categories
Run yourself →

The indicator-kind rollup and sample listed above.


MATCH (f:FEED_SOURCE {name: $slug})<-[:LISTED_IN]-(x)
WITH labels(x)[0] AS kind, count(*) AS listed, collect(x.name)[0..5] AS sample
RETURN kind, listed, sample
ORDER BY listed DESC
Run yourself →

Or query Whisper from your own LLM workflow via the Whisper MCP server.