A Proxy Takedown Is Not a Security Control
Proxy-network enforcement can reduce supply and protect device owners. Your application still needs current intelligence, behaviour correlation, route-specific controls, and measured request decisions.
When a Proxy Network Dies but Its IPs Survive
A proxy takedown can erase a brand without removing all of its former exit addresses. Here is what post-takedown IP overlap proves, what it cannot prove, and the sourcing evidence buyers should demand.
IPIDEA and NetNut: What Two Residential Proxy Takedowns Actually Changed
Google's 2026 actions against IPIDEA and NetNut disrupted control infrastructure, applications and commercial supply. They did not make residential traffic safe by default.
When Home Devices Become Attack Infrastructure
Application teams cannot clean compromised televisions, routers, or household devices. They can stop treating the residential address as proof and control what the relayed request is allowed to do.
Residential Proxies Turn Layer 7 DDoS Into a Route Problem
A distributed pool can keep each residential IP quiet while expensive application routes fail. Mitigation has to follow request cost and behaviour, not only traffic volume.
Five Routes, Five Residential Proxy Decisions
Account creation, login, password reset, checkout, and public APIs should not share one residential-proxy action. Each route needs its own evidence and failure policy.
Privacy Relay, Corporate VPN, or Residential Proxy?
An anonymised connection is not automatically abusive. Security policy should distinguish expected privacy and corporate access from proxy use that appears beside risky behaviour.
What a Residential Proxy Decision Log Should Contain
A useful proxy event records the request, signal provenance, policy, action, and outcome. A timestamp and a risk score are not enough to explain an enforcement decision.
Keep Your CDN. Add Proxy and Bot Decisions at the Edge.
Replacing a CDN is not the only way to improve bot and proxy controls. The harder requirement is preserving trusted client context, enforceable policy, and decision evidence across the request path.
Credential Stuffing Through “Clean” Residential IPs
A residential IP with no bad reputation can still carry a credential-stuffing attempt. Defend the login workflow by joining credential, route, client, and outcome evidence.
The IP Changed. Did the Actor?
Residential proxy rotation defeats IP-only counters. The answer is not a new identity claim, but a carefully chosen set of cohort, account, route, and outcome keys.
Residential Proxy Detection for APIs Without JavaScript
APIs cannot depend on browser JavaScript to expose proxy abuse. They need server-side network, protocol, identity, route, and outcome evidence in the request path.
A Proxy Flag Is Not a Security Policy
Residential proxy detection is useful evidence. The security decision still has to account for the route, credentials, client history, behaviour, and cost of getting the action wrong.
How Bandwidth Sharing Feeds Residential Proxy Networks
Residential proxy capacity can come from bandwidth-sharing apps, monetisation SDKs, compromised servers, and pre-infected consumer devices. Here is why consent and a residential IP are not enough to establish trust.
How to Tune F5 BIG-IP Advanced WAF
Run F5 BIG-IP Advanced WAF in Transparent mode, review staged matches and learning suggestions, and limit each exception to the URL, parameter, cookie or content profile that needs it.
How to Tune Google Cloud Armor WAF Rules
Tune Cloud Armor preconfigured WAF rules with preview traffic, versioned signatures, sensitivity levels, field exclusions and policy priority.
How to Tune Cloudflare WAF When Rule 949110 Blocks a Request
Trace a Cloudflare OWASP anomaly-score block to the rules that raised the score, then choose the right override or exception.
How to Tune Azure Application Gateway WAF
Start Azure Application Gateway WAF in Detection mode, find false positives in Log Analytics, narrow each exclusion and move into Prevention mode.
How to Tune AWS WAF with Count, Labels and Rule Priority
Use Count overrides, managed-rule labels and rule priority to fix AWS WAF false positives while keeping the rest of the managed rule group in force.
How to Tune Coraza on Caddy
Run Coraza and OWASP CRS on Caddy in DetectionOnly, read the audit log and limit each exclusion to the field and route that need it.
How Browsers Decide Whether to Use HTTP/3
HTTP/3 discovery is standardised. The decision to wait, race QUIC against TCP, remember a failure, or fall back is still browser policy.
How to Protect APIs From Unwanted Automation
An API cannot simply block automation. The practical job is to decide which automated use belongs on each route, then control the rest without breaking legitimate clients.
How to Tune Your WAF Without Turning It Off
A practical process for running a CRS-based or managed WAF in detection mode, finding repeatable false positives and writing narrow exceptions that survive real application traffic.
When and Why to Use a WAF: A Guide for WAF Sceptics
WAFs are neither useless nor a security force field. Here is what they are good at, where they fail, and when putting one in front of an application makes sense.
Your Application Needs a WAF. Just Not for the Reason You Think
A web application firewall will not fix insecure code. It can still give applications a valuable layer of protection when bugs, bots and attacks reach the front door.
Everyone Says a WAF Is Useless. Are They Right?
Ten good reasons not to trust a web application firewall—and why most of them are arguments for using one properly, not going without one.
Two Lineages of TLS Fingerprinting: JA3, JA4 and Cisco Mercury
JA4 did not descend from Cisco Mercury. The two projects come from different strands of TLS fingerprinting research and solve different operational problems.
Before JA3: How TLS Handshakes Became Fingerprints
JA3 made TLS fingerprints easy to log and share, but the technical ideas behind it had already been tested in SSL Labs experiments, a p0f patch and FingerprinTLS.
A Network Fingerprint Is a Cohort, Not a Client
TLS fingerprints group similar protocol implementations. They do not prove which application, device or person made a request.
From Joy to Mercury and EVE: Following Cisco's Network Fingerprinting Work
Cisco's open-source collectors, fingerprinting research and Encrypted Visibility Engine form a clear lineage, but they are not interchangeable parts of one public system.
What an Open Network Fingerprint Database Should Publish
A useful open fingerprint database needs provenance, competing labels, raw evidence, format versions and licences—not another unexplained hash list.
Public Fingerprint Databases Are Not Ground Truth
We reviewed the main public fingerprint resources. The formats are open, but current application labels and auditable ground truth remain scarce.
Does TLS Fingerprint Canonicalisation Hide Attacker Variation? How to Test It
Sorting makes TLS fingerprints more stable, but it also removes ordering evidence. Here is how to test whether the discarded variation matters.
Using Network Fingerprints in Bot and Rate-Limit Decisions
A practical way to use network fingerprints for bot and rate-limit decisions without mistaking a shared client cohort for identity.
One ClientHello, Three Fingerprints: JA3, JA4 and Mercury
A reproducible lab runs JA3, JA4 and Cisco Mercury against the same TLS ClientHello and compares what each fingerprint preserves.
An Operating Model for API and Account Protection
API and account protection works best as an operating model: map routes, classify signals, choose proportionate actions, preserve evidence, and tune controls from monitor to enforce.
API Bot Abuse Does Not Stay in One Endpoint
API bot abuse moves across login, checkout, and account journeys. Defenders need route-aware bot, rate, and account controls that follow the campaign rather than treating each endpoint as a separate incident.
API Protection and Account Protection Are One Request-Path Problem
Account protection does not stop at the login form. The same request path carries API, bot, rate, token, and account-risk evidence, and that is where the decision needs to happen.
The Real Cost of Breached Credentials
Breached credentials keep creating cost after the original breach. They feed credential stuffing, account takeover, fraud, support, and reputation costs across login, recovery, checkout, and API flows.
Credential Stuffing Does Not Stop at the Login Form
Credential stuffing risk continues after a password works. Account protection needs to watch password reset, email change, stored payment, gift card, and checkout flows.
Fingerprints Are Evidence, Not Identity
Browser and network fingerprints are useful security evidence, but they should not be treated as proof of a person's identity.
Account Security Without Tracking People
Safer logins do not require treating people as products. Account defence should use minimised, purpose-bound risk signals and proportionate decisions.
How Residential Proxies Changed API and Account Abuse
Residential proxies have changed account abuse from obvious bursts into distributed, low-noise workflows across login, account, and API routes. Treat proxy use as a risk signal, not a blunt block rule.
Shadow APIs Are Account-Abuse Paths
Shadow APIs matter because attackers do not care whether a route is documented. Mobile, partner, browser-backed, and legacy APIs can all become account-abuse paths when they remain outside normal controls.
Price Transparency Is Now a Data Access Problem
Price comparison increasingly depends on current web and API data. Retailers need bot and API controls that can distinguish intended automated access from uncontrolled extraction.
The BOTS Act and the War on Ticket Scalping
A deep dive into the BOTS Act, how it's being used to investigate Ticketmaster, and the ongoing battle against ticket scalping bots.
Agentic AI vs. Your API
Understand the shift from scripted bots to reasoning AI agents and how to adapt your security strategy for this new reality.
Anatomy of a Credential Stuffing Attack
A deep dive into how credential stuffing attacks work, the tools used, and how to build a multi-layered defense.
Beyond the IP Address
Discover why traditional IP-based rate limiting is obsolete and how advanced techniques provide robust protection against modern distributed attacks.
The Invisibility Cloak
Residential proxies change the network path while anti-detect browsers change the client presentation. Detection works by finding inconsistencies across the request, not by treating either signal as identity.
The CAPTCHA Conundrum
Explore why traditional CAPTCHAs are failing both users and security, and discover modern, invisible alternatives.
Key Considerations for Effective Bot Management
With nearly half of all internet traffic being automated, a robust bot management strategy is essential. This article explores the key considerations for effective bot detection, classification, and response in the face of evolving threats.
The Bot Spectrum
Learn to classify bots into good, bad, and grey categories and apply the right management strategy for each.
How to Use Bot Management for IAM Use Cases
Bots are part of account takeover, fraud, scraping, and other abuse. Identity and access management leaders need a clear business case for bot management, or their organisations face avoidable account takeover losses and will be less prepared for the risks introduced when customers use AI agents.
Why Don't We Have an AI UI Yet?
If AI is the next great computer interface, why are we still clicking on icons and navigating menus? Exploring the major hurdles standing between us and a true AI-native operating system.
AI as the Translator Between Human and Machine
We've gone from command lines to graphical interfaces. The next great leap in how we interact with computers won't be seen, it will be understood. AI is poised to become the ultimate translator between human intent and machine execution.
From Research Paper to Running Code
Exploring how AI can dramatically accelerate the process of turning complex academic research into functional code, with examples from anomaly detection to small LLMs.
My Programming Journey
A personal journey through the evolution of programming, from the early days of DOS and BASIC to the current age of AI-assisted coding.
SMS Pumping Fraud: How Verification Traffic Inflates the Bill
SMS pumping turns verification endpoints into billable traffic. Trace the delivery chain, measure abnormal sends and stop expensive requests before the provider charge lands.
Why We Can't Trust IP Addresses
The proliferation of residential proxy networks has undermined traditional IP-based security, enabling attackers to bypass protection measures while appearing as legitimate users.
How AI Agents Are Writing Custom Exploits
AI agents with reasoning capabilities like DeepSeek are revolutionizing exploit development, marking the end of traditional security approaches based on static rules and patterns.
A/B Testing, Bots, and the New Normal
How AI agents are skewing marketing metrics and why traditional A/B testing needs to evolve for the age of autonomous digital interactions.
When Bots Are Your Primary Users
An exploration of how AI agents are reshaping API design principles and why we must evolve our approach to serve both machine and human consumers.
Data-Driven Risk Management
How Peakhour's contextual security aligns with Visa's data-driven risk management approach in the 2025-2028 Security Roadmap.
Why Reasoning Models Like DeepSeek Change Everything
How open reasoning models transform automation from rigid scripts to autonomous agents, fundamentally changing our approach to security and digital interactions.
Did Residential Proxies enable a $600 Billion loss?
How residential proxy networks may have enabled DeepSeek to bypass AI platform protections, leading to Nvidia's historic market value loss
Preventing Enumeration Attacks
An analysis of how Peakhour's solutions help prevent enumeration attacks, aligning with Visa's Security Roadmap 2025-2028 priorities.
Visa's Security Roadmap 2025-2028
An analysis of Visa's Security Roadmap 2025-2028 and how Peakhour's solutions help Australian businesses meet these security objectives.
How Bots Are Corrupting Your A/B Testing Data
Understand the impact of bot traffic on A/B testing results and learn how to protect your optimization efforts
How MTU Fingerprinting Identifies VPNs and Mobile Users
Infer an apparent path MTU from TCP handshake data, compare it with common tunnel overheads and use it as one bounded network-path signal.
Anti-Detect Browsers
Anti-detect browsers represent one of the most sophisticated threats facing modern web applications and APIs. Learn how these tools work, why they pose a significant threat to application security, and how modern security platforms can detect and mitigate their use.
Residential Proxies - The Growing Threat to Ad Campaigns
Learn how distributed bot networks using residential IPs are evolving to evade traditional fraud detection
Next-Generation Application Security Defence Strategies
Comprehensive analysis of AI-powered cyber threats and how modern application security platforms defend against machine learning-driven attacks. Learn advanced defence strategies for the AI cybersecurity arms race.
Managing Bots For Application Security
Comprehensive guide to enterprise bot management for modern application security platforms. Learn how to protect applications and APIs from sophisticated bot threats including anti-detect browsers, credential stuffing, and automated attacks targeting DevOps environments.
The Australian epidemic of Account Takeover attacks
An in-depth look at the growing threat of credential stuffing attacks on Australian businesses, including recent case studies, defense challenges, and practical recommendations.
The Challenge of Proxy Detection
Examine why current security solutions fail to detect and mitigate threats from residential proxies, and the need for comprehensive protection strategies.
Quantifying The Residential Proxy Threat
Explore the complexities of residential proxy detection and its impact on organisational risk, with a focus on quantifying the threat and reframing security approaches.
Account Protection and User Experience in Web Applications
Explore strategies to enhance web application security without compromising user experience, focusing on contextual security and adaptive authentication measures.
The Cost of Credential Stuffing
Explore how credential stuffing attacks and account takeovers affect business reputation and customer trust.
2024 Survey Insights
Our 2024 survey of Australian CISOs and CTOs looks at how businesses are approaching account protection, particularly credential stuffing and residential proxies.
2024 Survey Insights
Survey data from Australian CISOs and CTOs shows broad MFA adoption, lower bot protection uptake, and early attention on residential proxy detection for credential stuffing and account takeover risk.
Application Security Beyond MFA
MFA helps, but it does not stop social engineering, residential proxy abuse, credential stuffing, or session risk on its own.
Addressing Key Cloud Security Categories
An analysis of Peakhour's role in addressing key cloud security categories identified in recent industry analysis, demonstrating its comprehensive approach to modern cloud security challenges.
Managing Breached Credential Usage
How breached credential checks and risk signals help detect credential stuffing without adding unnecessary login friction.
Rate Limiting for API Security
How advanced rate limiting protects modern applications and APIs from sophisticated threats including proxy networks, distributed attacks, and automated abuse in enterprise security environments.
HTTP Security Headers
Comprehensive guide to HTTP security headers for protecting web applications from client-side attacks. Learn essential browser security configurations for modern application security platforms and DevSecOps workflows.
RFC 9460
Introducing SVCB and HTTPS records in DNS and their impact on web connectivity.
Dive into CVSS Scores
Understand CVSS by examining the Atlassian CVE-2023-22515 and CVE-2023-22518.
A Risk Based Approach To Vulnerability Scoring
An in-depth exploration of EPSS, its data-driven approach to assessing cybersecurity threats, and how it complements CVSS.
A Tale Of Two Scoring Systems
Reviewing the CVSS an EPSS CVE scoring systems in light of the Atlassian Confluence-Aggedon
Navigating CDN Consolidation
Explore the complexities of switching CDN providers amid industry consolidation and how Peakhour can assist in the transition
Google Chrome IP Protection vs Apple Private Relay
Apple Private Relay and Chrome IP Protection both reduce IP exposure, but they protect different traffic and should not be treated as residential proxies or automatic fraud signals.
JA4 and JA4+ Network Fingerprinting
How JA4 constructs a TLS client fingerprint, what JA4+ names, and which details sorting and hashing discard.
Google Chrome's IP Protection and Online Privacy
Chrome IP Protection masks a user's address for selected third-party requests in Incognito. That is narrower than a VPN and should be treated as privacy infrastructure, not proof of abuse.
ModSecurity’s End-of-Life
ModSecurity's end-of-life marks a pivotal moment in application security evolution. Discover how modern Application Security Platforms are advancing beyond traditional WAF approaches to provide comprehensive protection for web applications and APIs at the edge.
HTTP/2 Rapid Reset Attack Deepdive
The technicalities of the HTTP/2 Rapid Reset vulnerability and steps to fortify against DDoS threats.
Understanding the HTTP/2 Rapid Reset Attack
A comprehensive breakdown of the HTTP/2 Rapid Reset flaw and guidance on bolstering defences against potential DDoS attacks.
The Rise of OpenBullet
How OpenBullet packages browser and HTTP automation for credential attacks, and which signals defenders can use without treating any one fingerprint as proof.
A Secure Internet
Google Chrome is advancing towards making the web secure by default through HTTPS-First Mode.
ZDNS - scan the entire internet
Details the use of ZDNS, a high-performance DNS toolkit, to create a comprehensive Reverse DNS (rDNS) lookup database by scanning the entire internet, and how randomizing the IP space overcomes UDP timeout issues.
Enterprise DDoS Protection
Analysis of the Microsoft 365 DDoS attack by Storm-1359 reveals critical lessons for enterprise application security platforms. Learn advanced Layer 7 DDoS protection strategies and rate limiting techniques for modern applications.
Maximising Website Speed
How can maximising website speed boost your company's revenue, especially during an impending economic recession?
Down But Not Out - JXL Will Return on Safari
What Apple's announcement of JPEG-XL support means for the web ecosystem.
The Rise of the Dragon
Residential proxy malware, and its implications for traditional cybersecurity measures, emphasising the need for evolving threat detection and mitigation strategies.
Where Residential Proxies Fit in MITRE ATT&CK
MITRE ATT&CK technique T1090 covers adversary proxying for command and control. It does not turn every case of residential proxy abuse into an ATT&CK technique.
Residential Proxy Detection
A practical entry point to residential proxy supply, detection, policy and current research for security and fraud teams.
Advanced Anomaly Detection
Deep dive into Robust Random Cut Forest (RRCF) implementation for real-time anomaly detection in Application Security Platforms. Learn how advanced machine learning algorithms enhance threat detection and automated response capabilities.
Consistent Hash with Bounded Loads
An overview of consistent hashing with bounded loads, an advanced load balancing technique that ensures a more even distribution of keys across servers, preventing overload and improving system stability.
Double MAD?
This article explores the use of Double Median Absolute Deviation (Double MAD) for anomaly detection in time series data, particularly in skewed or non-symmetric distributions.
Double MAD vs the Rest
A look at the limitations of Double MAD for anomaly detection, and a comparison with the Z-score method, to help you choose the right approach for your data.
Efficiently Generating and Printing All IPv4 Addresses in a Random Order
Explains how to efficiently generate all IPv4 addresses in a random order using a Linear Congruential Generator (LCG), a memory-efficient method for tasks like security testing and network simulation.
Locality Sensitive Hashing
An introduction to Locality Sensitive Hashing (LSH) and its application in load balancing, including consistent hashing and its use in CDNs and Google's Maglev for efficient server pool management.
Scaling anomaly detection with RRCF
Discusses strategies for scaling the Robust Random Cut Forest (RRCF) algorithm for large-scale anomaly detection, including using summary statistics, buffering input, and parallelisation.
Applied RRCF - thresholding techniques.
Explores various thresholding techniques like Median Absolute Deviation (MAD), Min/Max, and Z-Score for interpreting Robust Random Cut Forest (RRCF) anomaly scores, crucial for classifying data points as normal or anomalous.
The Death of JPEG-XL
We bid farewell to JPEG-XL after its abrupt deprecation by Google, reinforcing the tech giant's domineering influence over the web and sparking a call for resilient alternatives.
Layer 7 DDoS Protection
Comprehensive guide to Layer 7 DDoS protection using strategic caching within application security platforms. Learn how intelligent caching strategies provide robust defence against sophisticated application-layer attacks.
Chrome's TLS Extension Randomisation Experiment
Does TLS extension randomisation assist in hiding Chrome?
TLS Fingerprinting
What is fingerprinting, and in particular TLS fingerprinting?
Automatic Image Optimisation
Image optimisation saves you bandwidth and designer effort while reduces page load time.
IP Threat Intelligence
Comprehensive guide to IP threat intelligence for modern application security platforms. Learn how managed IP reputation lists and threat intelligence feeds protect applications from known malicious sources and emerging threats.
Origin shield
Origin shield is a CDN must have feature that increases your Cache Hit Rate by consolidating requests from POPs.
CVE-2022-26134
Peakhour clients are protected against CVF-2022-26134 Atlassian Confluence RCE
CDN Cache Keys
Cache keys allows the segmenting of the Peakhour.IO cache by elements of both the request and response, enabling effective and flexible caching of content.
Intelligent Rate Limiting
Comprehensive guide to intelligent rate limiting for modern application security platforms. Learn how sophisticated rate limiting protects APIs and web applications from abuse, DDoS attacks, and automated threats whilst maintaining optimal user experience.
Rate limiting
How can rate limiting protect your web application and the key items to consider when enabling.
Request collapsing
Request collapsing - saving your origin by reducing concurrent requests and re-using responses for resources.
Cdn-Cache-Control
CDN-Cache-Control is a proposed new header to augment the venerable Cache-Control. Its aim is to make controlling caching easier as CDNs become ubiquitous.
Cache-Status
Cache-Status is a proposed standard header to provide visibility into how caching providers interact and handle a request.
Why Manage Bots?
Comprehensive guide to enterprise bot management and advanced countermeasures for protecting applications against sophisticated malicious bot threats. Learn proven strategies for bot detection, mitigation, and automated defence systems.
Are Australian Magento Stores Ready For Web Vitals?
Are Australian Magento stores prepared for the introduction of Core Web Vitals as a search signal? Read on to find out.
Malicious Bot Threats
Comprehensive analysis of malicious bot threats targeting modern applications and APIs. Learn how enterprise bot management protects against automated attacks, credential stuffing, price scraping, and sophisticated bot-driven financial damage.