Clients whose traffic resembles a proxy tunnel

GET

/analytics/tunnel-suspects

const url = 'https://api.nsin.ir/analytics/tunnel-suspects?period=3h';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url 'https://api.nsin.ir/analytics/tunnel-suspects?period=3h' \
  --header 'Authorization: Bearer <token>'

Clients whose WebSocket/gRPC traffic looks like a VPN or proxy tunnel run behind the CDN: sustained volume over a single fixed path, with opaque payloads and no sign of ordinary browsing (no real assets fetched, no referer).

This is a heuristic for investigation, not proof of abuse. balance is informational — tunnels used for browsing are download-heavy, so symmetry is not a criterion.

Authorizations

bearerAuth
apiKeyAuth

Parameters

Query Parameters

period

string

default: 24h

Allowed values: 3h 6h 12h 24h 7d 30d

Time window, ending now. Buckets are hourly up to 24h and daily for 7d and 30d. An unrecognised value falls back to 24h.

Responses

200

Suspected tunnel clients.

application/json

object

suspects

Array<object>

object

remote_addr

string

network

The client’s network operator (AS organisation).

string

country

string

hostname

string

transport

string

Allowed values: ws grpc xhttp http

reqs

All requests from this client to this host.

integer

tunnel_reqs

Requests with opaque payloads.

integer

tunnel_paths

Distinct paths used — around 1 for a tunnel.

integer

Client-to-edge bytes.

integer

down

Edge-to-client bytes.

integer

balance

min/max of up and down. Informational only.

number

max_secs

Longest single connection, in seconds.

integer

sample_path

The heaviest single path.

string

ja4

TLS fingerprint.

string

ja4h

HTTP fingerprint.

string

Example

{
  "suspects": [
    {
      "transport": "ws"
    }
  ]
}

401

Missing, malformed, revoked or expired API key — or the owning account is inactive.

application/json

The single error shape used by every endpoint.

object

error

required

Human-readable description of what went wrong.

string

Examples

invalidKey

{
  "error": "invalid API key"
}

429

The key exceeded its request budget (300 requests per minute by default).

application/json

The single error shape used by every endpoint.

object

error

required

Human-readable description of what went wrong.

string

Examples

limited

{
  "error": "rate limit exceeded"
}

503

The analytics backend is temporarily unreachable. Retry; no data is lost.

application/json

The single error shape used by every endpoint.

object

error

required

Human-readable description of what went wrong.

string

Examples

unavailable

{
  "error": "analytics unavailable"
}