{ "schemaVersion": 1, "reports": [ { "id": "applydjinn-live-auto-fast-20261010", "siteId": "applydjin", "target": "applydjinn.com", "startedAt": "2026-10-10T22:45:25.987985Z", "endedAt": "2026-10-10T22:51:15.071427414Z", "authority": "auto", "attackPattern": "Repeated known-path probes through the real TLS origin. Two completed twenty-second ClickHouse windows corroborated the trusted exact-source live detector. The automatic rule matched known probe paths from this source only.", "transport": "HTTPS, HTTP/1.1; real external generator; normal navigation from both external addresses", "detectionSeconds": 4.146501064300537, "applySeconds": 1.3726320266723633, "archiveWaitSeconds": 71.12052798271179, "sustainedRPS": 10643.91073932482, "maximumRPS": 10643.91073932482, "rollbackVerified": true, "baseline": { "cpuPercent": 37.008, "memoryMiB": 3196.08, "swapMiB": 2115.898, "rxMiBPS": 0.313, "txMiBPS": 0.071, "agentCPUPercent": 8.7, "agentMiB": 617.214453125, "appCPUPercent": 1.6, "appMiB": 321.84322916698454 }, "secondaryBaseline": { "cpuPercent": 16.773, "memoryMiB": 3269.504, "swapMiB": 0.0, "rxMiBPS": 0.437, "txMiBPS": 0.072, "agentCPUPercent": 0.3, "agentMiB": 24.383984375, "appCPUPercent": 0.0, "appMiB": 511.65651041698453 }, "denialEvidence": { "fromTime": "2026-10-10T22:45:00Z", "toTime": "2026-10-10T22:51:16Z", "verifiedDenials": 461020, "http404": 7858, "http404Verified": 0 }, "phases": [ { "label": "20k \u00b7 256 clients", "offeredRPS": 20000, "completedRPS": 10643.91073932482, "seconds": 21.559556973, "responses": 229478, "transportErrors": 0, "dropped": 170522, "limited429": 229435, "admitted": 0, "otherResponses": 43, "p95MS": 51.319, "resources": { "cpuPercent": 92.586, "memoryMiB": 3065.471, "swapMiB": 2265.094, "rxMiBPS": 2.199, "txMiBPS": 6.157, "agentCPUPercent": 31.7, "agentMiB": 572.047805059433, "appCPUPercent": 2.8000000000000003, "appMiB": 368.29743303585053 }, "secondaryResources": { "cpuPercent": 96.661, "memoryMiB": 4263.537, "swapMiB": 0.0, "rxMiBPS": 5.887, "txMiBPS": 2.196, "agentCPUPercent": 0.5, "agentMiB": 17.714657737731933, "appCPUPercent": 5.2, "appMiB": 425.3519345235825 }, "transport": "HTTP/1.1", "workers": 256, "startedAt": "2026-10-10T22:47:37.287377823Z", "endedAt": "2026-10-10T22:47:58.869275197Z", "warmup": true, "normalRequests": 51, "normalOK": 51, "normalBlocked": 0, "normalErrors": 0, "normalP95MS": 930.899 }, { "label": "20k \u00b7 512 clients", "offeredRPS": 20000, "completedRPS": 10103.646382930068, "seconds": 22.386571286, "responses": 226186, "transportErrors": 0, "dropped": 173814, "limited429": 226142, "admitted": 0, "otherResponses": 44, "p95MS": 101.528, "resources": { "cpuPercent": 90.088, "memoryMiB": 3002.301, "swapMiB": 2259.392, "rxMiBPS": 2.813, "txMiBPS": 5.992, "agentCPUPercent": 30.099999999999998, "agentMiB": 595.899857954979, "appCPUPercent": 5.0, "appMiB": 351.1461292610168 }, "secondaryResources": { "cpuPercent": 95.903, "memoryMiB": 4601.584, "swapMiB": 0.0, "rxMiBPS": 5.647, "txMiBPS": 2.17, "agentCPUPercent": 0.5, "agentMiB": 20.675071022987364, "appCPUPercent": 10.0, "appMiB": 446.4129971590042 }, "transport": "HTTP/1.1", "workers": 512, "startedAt": "2026-10-10T22:49:43.862944293Z", "endedAt": "2026-10-10T22:50:06.269947022Z", "warmup": true, "normalRequests": 60, "normalOK": 60, "normalBlocked": 0, "normalErrors": 0, "normalP95MS": 870.128 } ], "normalRequests": 111, "normalOK": 111, "normalBlocked": 0, "normalErrors": 0, "normalP95MS": 930.899, "notes": [ "Two short production intervals offered 20,000 requests/s and completed 10,644 and 10,104 requests/s. Stable 20,000 completed production RPS is not established. The preceding six-phase record retains the earlier best of 11,535 requests/s.", "First detection took 4.15 seconds. Eligibility took another 71.12 seconds while exact-source live coverage and closed ClickHouse windows accumulated. Applying the eligible Auto action took 1.37 seconds; no operator-created protection rule substituted for Auto.", "The legacy per-minute 100-Mbit/s egress writer was disabled after a timed rollback was prepared. Hostwatch now owns the qdisc at its existing normal policy, approximately 200 Mbit/s. Offered rates still exceeded measured completion capacity.", "ClickHouse recorded 461,020 verified 429 denials from the single Auto action between 22:45:00 and 22:51:16 UTC. In the same window 7,858 HTTP 404 responses had zero verified-denial attribution. Status and action attribution are separate measurements.", "All selected-interval normal navigation checks returned 200. Five anonymous paths were checked from both real source addresses, including a filtered salary page. This does not prove every authenticated, arbitrary or distributed workload.", "The first interval averaged 92.6% primary CPU and 96.7% analytics-node CPU. Secondary resources include the external generator; host RAM excludes reclaimable memory, while application cgroup memory includes cache.", "The baseline is the idle recorded interval 22:42:00\u201322:42:30 UTC, before the primary agent update and load warmup. Deployment and warmup intervals are excluded from the two measured load phases.", "Test generators and observers were stopped. The exact temporary Auto contribution was removed and verified at 22:51:15 UTC. Existing owner policy and permanent investigation history remain available." ] }, { "id": "applydjinn-live-auto-20261010", "siteId": "applydjin", "target": "applydjinn.com", "startedAt": "2026-10-10T21:11:12.27297529Z", "endedAt": "2026-10-10T21:47:05.845785871Z", "authority": "auto", "attackPattern": "Repeated known-path probes through the real TLS origin. Auto required fresh ClickHouse IP history and repeated complete live windows; the applied rule matched probe paths from the specific source only.", "transport": "HTTPS, HTTP/1.1 and HTTP/2; two real external source addresses", "detectionSeconds": 8.516825199127197, "applySeconds": 1.544847011566162, "archiveWaitSeconds": 501.2364888191223, "sustainedRPS": 11535.395553720746, "maximumRPS": 11535.395553720746, "rollbackVerified": true, "baseline": { "cpuPercent": 39.212, "memoryMiB": 3098.069, "swapMiB": 2080.852, "rxMiBPS": 0.22, "txMiBPS": 1.133, "agentCPUPercent": 3.9, "agentMiB": 625.8290178575515, "appCPUPercent": 3.9, "appMiB": 383.82790178585054 }, "secondaryBaseline": { "cpuPercent": 18.529, "memoryMiB": 3089.488, "swapMiB": 0.0, "rxMiBPS": 0.465, "txMiBPS": 0.2, "agentCPUPercent": 0.2, "agentMiB": 23.025892857551575, "appCPUPercent": 8.0, "appMiB": 445.4098214282989 }, "phases": [ { "label": "5k H1", "offeredRPS": 5000, "completedRPS": 4751.379758318754, "seconds": 15.036684844, "responses": 71445, "transportErrors": 0, "dropped": 3555, "limited429": 71413, "admitted": 0, "otherResponses": 32, "p95MS": 11.421, "resources": { "cpuPercent": 86.266, "memoryMiB": 3079.868, "swapMiB": 2080.686, "rxMiBPS": 1.068, "txMiBPS": 3.608, "agentCPUPercent": 24.4, "agentMiB": 613.5875, "appCPUPercent": 13.600000000000001, "appMiB": 375.03541666698453 }, "secondaryResources": { "cpuPercent": 46.356, "memoryMiB": 3183.255, "swapMiB": 0.0, "rxMiBPS": 2.981, "txMiBPS": 1.044, "agentCPUPercent": 0.1, "agentMiB": 24.3203125, "appCPUPercent": 2.6, "appMiB": 462.4013020830154 }, "transport": "HTTP/1.1", "workers": 512, "startedAt": "2026-10-10T21:11:12.27297529Z", "endedAt": "2026-10-10T21:11:27.314775283Z", "warmup": false, "normalRequests": 40, "normalOK": 40, "normalBlocked": 0, "normalErrors": 0, "normalP95MS": 693.035 }, { "label": "10k H2", "offeredRPS": 10000, "completedRPS": 4419.465111410656, "seconds": 19.342159706, "responses": 85482, "transportErrors": 4, "dropped": 64514, "limited429": 85462, "admitted": 0, "otherResponses": 20, "p95MS": 834.122, "resources": { "cpuPercent": 84.031, "memoryMiB": 3179.322, "swapMiB": 2044.112, "rxMiBPS": 1.536, "txMiBPS": 3.965, "agentCPUPercent": 17.0, "agentMiB": 620.0372121706009, "appCPUPercent": 4.5, "appMiB": 328.1531661186218 }, "secondaryResources": { "cpuPercent": 86.97, "memoryMiB": 3279.168, "swapMiB": 0.0, "rxMiBPS": 3.524, "txMiBPS": 1.139, "agentCPUPercent": 0.1, "agentMiB": 26.96484375, "appCPUPercent": 1.7999999999999998, "appMiB": 495.35649671077726 }, "transport": "HTTP/2.0", "workers": 1024, "startedAt": "2026-10-10T21:26:22.884976301Z", "endedAt": "2026-10-10T21:26:42.234394197Z", "warmup": true, "normalRequests": 46, "normalOK": 46, "normalBlocked": 0, "normalErrors": 0, "normalP95MS": 670.492 }, { "label": "20k H1", "offeredRPS": 20000, "completedRPS": 11535.395553720746, "seconds": 20.117992393, "responses": 232069, "transportErrors": 0, "dropped": 167931, "limited429": 232029, "admitted": 0, "otherResponses": 40, "p95MS": 49.399, "resources": { "cpuPercent": 98.063, "memoryMiB": 3041.427, "swapMiB": 2138.879, "rxMiBPS": 2.358, "txMiBPS": 7.255, "agentCPUPercent": 34.599999999999994, "agentMiB": 615.6696134872436, "appCPUPercent": 16.1, "appMiB": 359.24856085491183 }, "secondaryResources": { "cpuPercent": 55.504, "memoryMiB": 3214.637, "swapMiB": 0.0, "rxMiBPS": 6.262, "txMiBPS": 2.255, "agentCPUPercent": 0.2, "agentMiB": 25.82109375, "appCPUPercent": 2.1999999999999997, "appMiB": 445.54453125 }, "transport": "HTTP/1.1", "workers": 256, "startedAt": "2026-10-10T21:28:42.910498539Z", "endedAt": "2026-10-10T21:29:03.050663509Z", "warmup": true, "normalRequests": 51, "normalOK": 51, "normalBlocked": 0, "normalErrors": 0, "normalP95MS": 1077.698 }, { "label": "20k H1 \u00d74", "offeredRPS": 20000, "completedRPS": 9049.507569154992, "seconds": 21.78107466, "responses": 197108, "transportErrors": 0, "dropped": 202892, "limited429": 197065, "admitted": 0, "otherResponses": 43, "p95MS": 206.743, "resources": { "cpuPercent": 97.108, "memoryMiB": 3238.622, "swapMiB": 2103.059, "rxMiBPS": 2.209, "txMiBPS": 6.76, "agentCPUPercent": 34.9, "agentMiB": 615.419140625, "appCPUPercent": 21.2, "appMiB": 345.13515625 }, "secondaryResources": { "cpuPercent": 59.275, "memoryMiB": 3476.184, "swapMiB": 0.0, "rxMiBPS": 5.807, "txMiBPS": 2.002, "agentCPUPercent": 0.1, "agentMiB": 22.703125, "appCPUPercent": 5.7, "appMiB": 502.1196056547165 }, "transport": "HTTP/1.1", "workers": 1024, "startedAt": "2026-10-10T21:33:14.129269445Z", "endedAt": "2026-10-10T21:33:35.92807395Z", "warmup": true, "normalRequests": 45, "normalOK": 45, "normalBlocked": 0, "normalErrors": 0, "normalP95MS": 1761.829 }, { "label": "Mac 10k", "offeredRPS": 10000, "completedRPS": 3497.112395622478, "seconds": 23.024138458, "responses": 80518, "transportErrors": 2424, "dropped": 67058, "limited429": 80491, "admitted": 0, "otherResponses": 27, "p95MS": 1212.024, "resources": { "cpuPercent": 76.93, "memoryMiB": 3049.561, "swapMiB": 2073.457, "rxMiBPS": 0.921, "txMiBPS": 3.003, "agentCPUPercent": 21.099999999999998, "agentMiB": 580.2721946020126, "appCPUPercent": 3.9, "appMiB": 369.58806818199156 }, "secondaryResources": { "cpuPercent": 12.25, "memoryMiB": 3270.234, "swapMiB": 0.0, "rxMiBPS": 0.53, "txMiBPS": 0.072, "agentCPUPercent": 0.2, "agentMiB": 24.817595108985902, "appCPUPercent": 1.6, "appMiB": 520.37109375 }, "transport": "HTTP/2.0", "workers": 1024, "startedAt": "2026-10-10T21:38:15.980724Z", "endedAt": "2026-10-10T21:38:39.011185Z", "warmup": true, "normalRequests": 64, "normalOK": 64, "normalBlocked": 0, "normalErrors": 0, "normalP95MS": 1065.989 }, { "label": "Mac 20k", "offeredRPS": 20000, "completedRPS": 2589.644231314982, "seconds": 24.662847208, "responses": 63868, "transportErrors": 6483, "dropped": 224049, "limited429": 63824, "admitted": 0, "otherResponses": 44, "p95MS": 1650.145, "resources": { "cpuPercent": 91.331, "memoryMiB": 3290.556, "swapMiB": 2135.217, "rxMiBPS": 1.634, "txMiBPS": 3.37, "agentCPUPercent": 14.2, "agentMiB": 621.2977241849899, "appCPUPercent": 34.1, "appMiB": 400.82965353298187 }, "secondaryResources": { "cpuPercent": 17.229, "memoryMiB": 3383.413, "swapMiB": 0.0, "rxMiBPS": 0.429, "txMiBPS": 0.322, "agentCPUPercent": 0.2, "agentMiB": 23.341634114265442, "appCPUPercent": 4.1000000000000005, "appMiB": 499.06819661426545 }, "transport": "HTTP/1.1", "workers": 2048, "startedAt": "2026-10-10T21:43:05.183498Z", "endedAt": "2026-10-10T21:43:29.85285Z", "warmup": true, "normalRequests": 59, "normalOK": 59, "normalBlocked": 0, "normalErrors": 0, "normalP95MS": 2335.354 } ], "normalRequests": 305, "normalOK": 305, "normalBlocked": 0, "normalErrors": 0, "normalP95MS": 1251.229, "notes": [ "These are short 15\u201325-second production intervals, not an endurance or universal capacity guarantee. Best: 11,535 completed requests/s over 20.12 seconds at 20,000 offered RPS. Stable 20,000 completed RPS was not achieved.", "At the best interval primary CPU averaged 98.1%. Secondary generation saturated four CPUs in the H2 interval. Mac runs had generator transport errors; those are separate from HTTP rate-limit responses.", "Five anonymous navigation paths were checked from both generator source addresses, including a filtered salary URL. Every selected-interval check returned 200. This does not prove every authenticated or arbitrary high-cardinality workload.", "Gray 429 is the HTTP outcome. ClickHouse independently recorded 674,624 verified denials attributable to two Auto actions between 21:20:00 and 21:47:06 UTC. 25,675 HTTP 404s in that window had zero verified denial attribution.", "New-source first detection took 8.52 seconds; two closed five-minute history windows delayed eligibility by 501.24 seconds. Applying the eligible action took 1.54 seconds. Existing corroborated-source reapplication took 1.67 seconds.", "Resource values are interval means. Host CPU uses all host cores; process CPU is a percentage of one core. Analytics-node CPU includes the generator for secondary-origin runs.", "SQLite authority, mobile reads, MongoDB catalog cache and public rendering run on the secondary node. Private/authenticated routes remain on the primary. Deployment intervals are excluded from these six measurements.", "Test-generated restrictions were removed and verified at 21:47:05 UTC. Historical test evidence is retained and labeled; older unattributed 429 or 404 counts are not rewritten as verified mitigation." ] } ] }