List detected attacks

GET

/domains/{domain}/attacks

curl --request GET \
  --url 'https://api.nsin.ir/domains/example.com/attacks?limit=50' \
  --header 'Authorization: Bearer <token>'

• Production

Attacks NSIN detected on the domain, newest first. An attack is a flood of at least 5× the domain’s usual requests per minute for this hour (and at least 3000 per minute) for two minutes. NSIN then looks for what only the attack’s requests have (fingerprint, cookie name, path, …) and, when automatic attack rules are on, adds a managed custom rule in dry run (managed_by: attack_signature): it only counts what it would block until it is enforced. An attack ends — and its rule is switched off — after 30 minutes back near normal traffic. active is the open attack, if any. Requires domain.view.

Authorizations

• bearerAuth
• apiKeyAuth

Parameters

Path Parameters

domain

required

string

The domain name (for example example.com) — not a numeric id.

Example

example.com

Query Parameters

limit

integer

default: 50 >= 1 <= 200

Responses

200

The attacks.

Media type application/json

object

attacks

Array<object>

object

id

integer

domain_id

integer

domain_name

string

status

string

Allowed values: detected mitigating ended ignored

kind

volume: a flood, far more requests than usual. behaviour: the traffic suddenly behaves differently (for example no CSS/JS/image requests, no cookies, one HTTP version only), even at normal volume. A behaviour attack ends after 30 minutes without the change.

string

Allowed values: volume behaviour

drift

What changed (behaviour attacks; empty for floods), strongest first, at most 8.

Array<object>

object

feature

string

Allowed values: asset html api no_referer no_cookie many_cookie s2 s3 s4 s404 s5 post other_method h1 h2 h3 bot_low bot_high req_per_path req_per_ip

group

string

Allowed values: assets cookies status protocol bot paths ips

unit

share: 0–1 of requests. ratio: requests per path or per IP.

string

Allowed values: share ratio

normal

The usual value at this hour of day.

number

now

The value during the attack.

number

z

How unusual the change is (larger = stronger).

number

started_at

string format: date-time

ended_at

string format: date-time

nullable

calm_since

string format: date-time

nullable

peak_rpm

Highest requests per minute seen.

integer

baseline_rpm

Usual requests per minute for this hour of day.

number

signature

object

features

Array<object>

object

field

string

Allowed values: ja4h ja4 user_agent cookie header_set_hash path method asn country

key

The cookie name for cookie; else empty.

string

value

string

coverage

Share of the attack’s requests with this value (0–1).

number

baseline_share

Share of normal requests with this value (0–1).

number

expression

The rule’s conditions as text; empty without a rule.

string

attack_requests

integer

baseline_requests

integer

baseline_window

reference_day: the same time on the most normal recent day (behaviour attacks).

string

Allowed values: hour_before day_before reference_day none

coverage

Share of the attack the rule matches.

number

fp_estimate

Share of normal requests the rule would have hit; -1 = unknown.

number

rule_id

integer

nullable

rule

object

id

integer

name

string

enabled

boolean

action_mode

string

Allowed values: enforce dry_run

enforced_by

"", “user:” or “admin:”.

string

note

string

created_at

string format: date-time

updated_at

string format: date-time

active

object

id

integer

domain_id

integer

domain_name

string

status

string

Allowed values: detected mitigating ended ignored

kind

volume: a flood, far more requests than usual. behaviour: the traffic suddenly behaves differently (for example no CSS/JS/image requests, no cookies, one HTTP version only), even at normal volume. A behaviour attack ends after 30 minutes without the change.

string

Allowed values: volume behaviour

drift

What changed (behaviour attacks; empty for floods), strongest first, at most 8.

Array<object>

object

feature

string

Allowed values: asset html api no_referer no_cookie many_cookie s2 s3 s4 s404 s5 post other_method h1 h2 h3 bot_low bot_high req_per_path req_per_ip

group

string

Allowed values: assets cookies status protocol bot paths ips

unit

share: 0–1 of requests. ratio: requests per path or per IP.

string

Allowed values: share ratio

normal

The usual value at this hour of day.

number

now

The value during the attack.

number

z

How unusual the change is (larger = stronger).

number

started_at

string format: date-time

ended_at

string format: date-time

nullable

calm_since

string format: date-time

nullable

peak_rpm

Highest requests per minute seen.

integer

baseline_rpm

Usual requests per minute for this hour of day.

number

signature

object

features

Array<object>

object

field

string

Allowed values: ja4h ja4 user_agent cookie header_set_hash path method asn country

key

The cookie name for cookie; else empty.

string

value

string

coverage

Share of the attack’s requests with this value (0–1).

number

baseline_share

Share of normal requests with this value (0–1).

number

expression

The rule’s conditions as text; empty without a rule.

string

attack_requests

integer

baseline_requests

integer

baseline_window

reference_day: the same time on the most normal recent day (behaviour attacks).

string

Allowed values: hour_before day_before reference_day none

coverage

Share of the attack the rule matches.

number

fp_estimate

Share of normal requests the rule would have hit; -1 = unknown.

number

rule_id

integer

nullable

rule

object

id

integer

name

string

enabled

boolean

action_mode

string

Allowed values: enforce dry_run

enforced_by

"", “user:” or “admin:”.

string

note

string

created_at

string format: date-time

updated_at

string format: date-time

Example

{
  "attacks": [
    {
      "status": "detected",
      "kind": "volume",
      "drift": [
        {
          "feature": "asset",
          "group": "assets",
          "unit": "share"
        }
      ],
      "signature": {
        "features": [
          {
            "field": "ja4h"
          }
        ],
        "baseline_window": "hour_before"
      },
      "rule": {
        "action_mode": "enforce"
      }
    }
  ],
  "active": {
    "status": "detected",
    "kind": "volume",
    "drift": [
      {
        "feature": "asset",
        "group": "assets",
        "unit": "share"
      }
    ],
    "signature": {
      "features": [
        {
          "field": "ja4h"
        }
      ],
      "baseline_window": "hour_before"
    },
    "rule": {
      "action_mode": "enforce"
    }
  }
}

401

Missing, malformed, revoked or expired API key. (A valid key whose account has been deactivated gets 403 account is inactive instead.)

Media type application/json

The single error shape used by every endpoint.

object

error

required

Human-readable description of what went wrong.

string

Examples

Example invalidKey

{
  "error": "invalid API key"
}

404

No such domain, or it is not visible to this account. Domains you cannot access are reported as not found rather than forbidden.

Media type application/json

The single error shape used by every endpoint.

object

error

required

Human-readable description of what went wrong.

string

Example

{
  "error": "read-only API key"
}

429

The key exceeded its request budget (300 requests per minute by default).

Media type application/json

The single error shape used by every endpoint.

object

error

required

Human-readable description of what went wrong.

string

Examples

Example limited

{
  "error": "rate limit exceeded"
}