---
title: "Get top attack types for a specific IP (account-wide)"
method: GET
path: "/waap/v1/ip-info/top-attacks"
tags: ["IP Spotlight"]
---

# Get top attack types for a specific IP (account-wide)

`GET /waap/v1/ip-info/top-attacks`

Returns top attack types with associated domains, paths, and counts across all account domains

## Query parameters

- `ip` union, required — The IP address to check
  - string, ipv4
  - string, ipv6

## Response `200`

Successful Response

- TopAttack[]
  - `attack_type` string, required — The attack type (rule name)
  - `domains` string[] — Full list of domains where this attack type was seen
  - `paths` string[] — Full list of paths where this attack type was seen
  - `attacks` integer, required — Total number of attack requests (blocked + monitored)
  - `blocked` integer, required — Number of blocked attack requests

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Unauthenticated
- `404` — Not Found
- `422` — Unprocessable Entity
- `500` — Internal Server Error

---

[API](https://skmtc.dev/g-core/apis/gcore-openapi.md) · [All operations](https://skmtc.dev/g-core/apis/gcore-openapi/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/g-core/gcore-openapi/revisions/09e652815095/schema)