Help Center/ Anti-DDoS Service/ API Reference/ AAD APIs/ AAD Overview/ Querying the List of Attack Events

Updated on 2026-01-06 GMT+08:00

Online Debugging

CLI Examples

View PDF

Querying the List of Attack Events

Function

This API is used to query the list of attack events.

Calling Method

For details, see Calling APIs.

URI

GET /v2/aad/domains/waf-info/attack/event

**Table 1** Query Parameters
Parameter	Mandatory	Type	Description
domains	No	String	If this parameter is not provided, all domain names are queried.
start_time	No	String	Start time.
end_time	No	String	End time.
recent	No	String	Enumeration values: yesterday, today, 3 days, 1 week, 1 month You need to configure either this parameter or the timestamp.
overseas_type	No	Integer	Instance type. 0: the Chinese mainland. 1: outside the Chinese mainland.
sip	No	String	Attack source IP address.
limit	No	Integer	limit
offset	No	Integer	offset

Request Parameters

**Table 2** Request header parameters
Parameter	Mandatory	Type	Description
X-Auth-Token	Yes	String	token
Content-Type	Yes	String	Content-Type

Response Parameters

Status code: 200

**Table 3** Response body parameters
Parameter	Type	Description
total	Integer	total
list	Array of ListWafAttackEventlist objects	list

**Table 4** ListWafAttackEventlist
Parameter	Type	Description
id	String	id
domain	String	Target domain name.
time	Integer	Attack time.
sip	String	Attack source IP address.
action	String	Protective action.
url	String	Attacking URL.
type	String	Attack type. The options are as follows: cc (frequency control), cmdi (command injection attack), anti_crawler (anti-crawler), custom_custom (precise protection), illegal (invalid request), sqli (SQL injection attack), lfi (local file inclusion), robot (crawler attack), custom_geoip (region blocking), rfi (remote file inclusion), vuln (vulnerability exploits), xss (XSS attack), custom_whiteip (whitelist), custom_whiteblackip (blacklist and whitelist), web shell (web shell attack), and leakage (privacy leakage).
backend	Backend object	Current backend.

**Table 5** Backend
Parameter	Type	Description
protocol	String	Current backend protocol.
port	Integer	Current backend port.
host	String	Current backend host value.

Example Requests

None

Example Responses

Status code: 200

{
  "list" : [ {
    "action" : "block",
    "backend" : {
      "host" : "1.1.1.1",
      "port" : 443,
      "protocol" : "HTTPS"
    },
    "domain" : "www.yangqi-cc.com",
    "id" : "20-4012b40c5dcd424c5488b53aa01ddfe1",
    "sip" : "10.172.190.37",
    "time" : 1726279906000,
    "type" : "cc",
    "url" : "/opt"
  } ],
  "total" : 1
}