What Is Being Scanned Screensaver
The What Is Being Scanned screensaver shows the ports attracting the most attack traffic today, from the SANS Internet Storm Center, key-less. It's free, runs in your browser, and ESC exits.
Live preview
Press ESC to leave fullscreen. Settings are saved in your browser only.
How the What Is Being Scanned screensaver works
The saver reads the source described above and draws it on a canvas — no account, no tracking.
The ports attracting the most attack traffic today, from the SANS Internet Storm Center, key-less. The shape matters as much as the rank: many sources against few targets is a focused hunt, few sources against many is an untargeted spray.
It refreshes on a schedule, so what you see stays current.
Colours and any options can be changed in settings; nothing is stored beyond your own browser.
What the Internet Storm Center watches
The Internet Storm Center is part of the SANS Technology Institute and is supported by the SANS Institute. It is a free service that relies on volunteer effort, including a core team of volunteer incident handlers who watch the data for broad attacks and decide whether a possible attack is real and worth following up.
Its data comes from DShield, a distributed intrusion detection system. Participants submit firewall or intrusion detection logs after identifying information is removed, and thousands of sensors feed unwanted inbound traffic into the pool so patterns become visible.
The saver reads the ranking of ports attracting the most unsolicited traffic. A port is a numbered doorway on a machine that a service listens behind, and automated scanners probe common ones looking for exposed services. A scan is a knock on the door, not a break-in. The sensors are a volunteer sample and not the whole internet, so rankings reflect what those networks see. Ports named here are not a guide to what is secure or vulnerable.
A worked example
The ports attracting the most attack traffic today, from the SANS Internet Storm Center, key-less. The shape matters as much as the rank: many sources against few targets is a focused hunt, few sources against many is an untargeted spray.
Settings & tips
- Accent and Background recolour the display.
- Every value on screen comes from the live source — nothing is simulated.
- Press ESC to leave fullscreen.
Frequently asked questions
- Is this real data?
- Yes — it comes from the source named on this page and is refreshed on a schedule.
- Is a key needed?
- No. This source is fully key-less.
- Is it free?
- Yes — free, no download, in your browser.
- Does a heavily scanned port mean it is vulnerable?
- No. It means automated tools frequently try it, usually because the service on it is common or has a history of weaknesses.
- Where does the data come from?
- From DShield, the Internet Storm Center’s distributed intrusion detection system, which collects logs submitted by volunteers. It is a sample of internet background traffic and not a complete measurement.