---
title: "Retrieve time-series DDoS metrics for a specific IP address"
method: GET
path: "/waap/v1/ip-info/ddos"
tags: ["IP Spotlight"]
---

# Retrieve time-series DDoS metrics for a specific IP address

`GET /waap/v1/ip-info/ddos`

Fetch and analyze DDoS (Distributed Denial of Service) attack metrics for a specified IP address. The endpoint provides time-series data, enabling users to evaluate the frequency and intensity of attacks across various time intervals, and it returns metrics in Prometheus format to offer a systematic view of DDoS attack patterns.

## Query parameters

- `ip` union, required — The IP address to check
  - string, ipv4
  - string, ipv6

## Response `200`

Successful Response

- IpDdosInfo
  - `botnet_client` boolean, required — Indicates if the IP is tagged as a botnet client
  - `time_series` TimeSeriesItem[], required — The time series data for the DDoS attacks from the IP address
    - `timestamp` integer, required — The timestamp of the time series item as a POSIX timestamp
    - `count` integer, required — The number of attacks

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Unauthenticated
- `404` — Not Found
- `422` — Unprocessable Entity
- `500` — Internal Server Error

---

[API](https://skmtc.dev/g-core/apis/gcore-openapi.md) · [All operations](https://skmtc.dev/g-core/apis/gcore-openapi/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/g-core/gcore-openapi/revisions/09e652815095/schema)