Newsletter
SANS Internet Storm Center
SANS ISC handlers and Johannes Ullrich
Daily handler diaries and a five-minute weekday podcast on what the internet's honeypots saw. Free, technical, and running since 2001. Situational awareness for defenders; not OSINT method.
The Internet Storm Center publishes short diaries most days from volunteer handlers, on honeypot observations, malware samples, scanning trends, and tools, plus the weekday Stormcast podcast of three to five headlines. There is no conventional newsletter; you subscribe by RSS, podcast feed, or a pager-style notification.
Worth it if
- You defend networks and want a daily pulse of what attackers are scanning for
- You like short technical write-ups by people reading packet captures
- You commute and want a five-minute security briefing
Skip it if
- You want OSINT or investigative method
- You are not technical; the diaries assume network literacy
What is inside
- 01
Handler diaries
Short write-ups on honeypot activity, malware samples, scanning trends, tool releases, and occasional opinion.
- 02
Stormcast
A weekday podcast of three to five headlines from honeypot data and vendor advisories.
- 03
Data
Honeypot and sensor data, with custom reports for contributors.
What you will be able to do
- Know what is being scanned and exploited this week
- Follow a malware or scanning trend as it develops
- Keep CVE awareness without reading vendor marketing
How current it is
Active, with a diary on 10 October and a podcast episode on 13 October 2026, and thousands of episodes behind them.
- Updated
- Diary 10 October 2026; podcast 13 October 2026
- Maintained
- Actively maintained
How to get the most from it
- 01
Subscribe to the podcast first
Five minutes a day is the lowest-effort way to stay current in security.
- 02
Use the diary archive as a reference
Decades of write-ups on specific protocols and attacks are searchable.
Strengths
- Practitioner-written
- Daily and brief
- A deep public archive
Limitations
- Not OSINT
- Technical
- No editorial email digest
Pair it with
FAQ
Questions, answered
Is there an email newsletter?
Not in the usual sense. Use RSS for diaries, the podcast feed for Stormcast, or the pager-style diary notification.
Who writes the diaries?
Volunteer handlers, many of them well-known analysts, with Johannes Ullrich hosting the podcast.
Learned the method? Practise it on real data
The resources above teach the craft. When you want to run real lookups across breach, people, domain, and crypto sources without opening a dozen vendor accounts, that is what SearchIn is for.
- Free account, no card
- Credits never expire
- Refund unused balance in 7 days