Loudest On The Wire Screensaver
The Loudest On The Wire screensaver shows the source addresses filing the most reports to the SANS Internet Storm Center right now, read live and key-less. It’s free, runs in your browser, and ESC exits.
Live preview
Press ESC to leave fullscreen. Settings are saved in your browser only.
How the Loudest On The Wire screensaver works
The saver reads the source described above and draws it on a canvas — no account, no tracking.
The source addresses filing the most reports to the SANS Internet Storm Center right now, read live and key-less. The target count separates the two shapes: hundreds of thousands of reports against one host is a flood, a few against thousands is a sweep.
It refreshes on a schedule, so what you see stays current.
Colours and any options can be changed in settings; nothing is stored beyond your own browser.
The SANS Internet Storm Center and its sensors
The Internet Storm Center is a program of the SANS Technology Institute, part of the SANS Institute, and runs as an all-volunteer effort that SANS supports as a free service. Its data collection system is DShield: firewalls, intrusion detection systems and home broadband devices send logs of unwanted traffic, with identifying information removed, to a shared database where volunteers and software look for abnormal trends.
Each row on the board is an IP address and the number of reports it generated, along with how many distinct targets those reports touched. That ratio matters. A single address blasting one machine is not the same pattern as a scanner probing the same port across thousands of hosts, which is the signature of an automated sweep looking for something exploitable.
Read it as noise measurement, not a threat list. Many top sources are research scanners, misconfigured devices, or hosts that were themselves compromised. Addresses can be shared or reassigned, so an entry does not identify who is behind it. The counts reflect only what the contributing sensors saw, which skews towards the networks that participate.
A worked example
The source addresses filing the most reports to the SANS Internet Storm Center right now, read live and key-less. The target count separates the two shapes: hundreds of thousands of reports against one host is a flood, a few against thousands is a sweep.
Settings & tips
- Accent and Background recolour the display.
- Every value on screen comes from the live source — nothing is simulated.
- Press ESC to leave fullscreen.
Frequently asked questions
- Is this real data?
- Yes — it comes from the source named on this page and is refreshed on a schedule.
- Is a key needed?
- No. This source is fully key-less.
- Is it free?
- Yes, and it runs entirely in your browser.
- Does a high report count mean the address is malicious?
- Not necessarily. It means many sensors logged connection attempts from it, which can come from scanners, research projects, or compromised machines.
- What is DShield?
- The distributed intrusion detection system the Internet Storm Center uses for data collection and analysis. Contributors send firewall logs to its database, and the aggregated data is examined for trends.
- Can I act on an address shown here?
- The screen is for awareness only. An address alone does not establish who is responsible, and shared hosting or reassignment can make single entries misleading.