Peakhour.IO

An Operating Model for API and Account Protection

AC — Fri, 19 Jun 2026 00:00:00 +1000

API and account protection works best as an operating model: map routes, classify signals, choose proportionate actions, preserve evidence, and tune controls from monitor to enforce.

API Bot Abuse Does Not Stay in One Endpoint

AC — Fri, 19 Jun 2026 00:00:00 +1000

API bot abuse moves across login, checkout, and account journeys. Defenders need route-aware bot, rate, and account controls that follow the campaign rather than treating each endpoint as a separate incident.

API Protection and Account Protection Are One Request-Path Problem

AC — Fri, 19 Jun 2026 00:00:00 +1000

Account protection does not stop at the login form. The same request path carries API, bot, rate, token, and account-risk evidence, and that is where the decision needs to happen.

The Real Cost of Breached Credentials

AC — Fri, 19 Jun 2026 00:00:00 +1000

Breached credentials keep creating cost after the original breach. They feed credential stuffing, account takeover, fraud, support, and reputation costs across login, recovery, checkout, and API flows.

Credential Stuffing Does Not Stop at the Login Form

AC — Fri, 19 Jun 2026 00:00:00 +1000

Credential stuffing risk continues after a password works. Account protection needs to watch password reset, email change, stored payment, gift card, and checkout flows.

Fingerprints Are Evidence, Not Identity

AC — Fri, 19 Jun 2026 00:00:00 +1000

Browser and network fingerprints are useful security evidence, but they should not be treated as proof of a person's identity.

Account Security Without Tracking People

AC — Fri, 19 Jun 2026 00:00:00 +1000

Safer logins do not require treating people as products. Account defence should use minimised, purpose-bound risk signals and proportionate decisions.

How Residential Proxies Changed API and Account Abuse

AC — Fri, 19 Jun 2026 00:00:00 +1000

Residential proxies have changed account abuse from obvious bursts into distributed, low-noise workflows across login, account, and API routes. Treat proxy use as a risk signal, not a blunt block rule.

Shadow APIs Are Account-Abuse Paths

AC — Fri, 19 Jun 2026 00:00:00 +1000

Shadow APIs matter because attackers do not care whether a route is documented. Mobile, partner, browser-backed, and legacy APIs can all become account-abuse paths when they remain outside normal controls.

Price Transparency Is Now a Data Access Problem

AC — Mon, 18 May 2026 00:00:00 +1000

Price comparison increasingly depends on current web and API data. Retailers need bot and API controls that can distinguish intended automated access from uncontrolled extraction.

Cloudflare outage proves Plan B depends on controlling DNS

Dan — Tue, 18 Nov 2025 21:00:00 +1100

Tuesday’s Cloudflare incident reminded everyone that you can’t execute a Plan B if your DNS knobs are trapped behind the provider that’s failing. Here’s how Peakhour runs a detect-decide-divert playbook without touching your existing third-party DNS vendors.

The BOTS Act and the War on Ticket Scalping

AC — Wed, 17 Sep 2025 00:00:00 +1000

A deep dive into the BOTS Act, how it's being used to investigate Ticketmaster, and the ongoing battle against ticket scalping bots.

Agentic AI vs. Your API

AC — Mon, 01 Sep 2025 00:00:00 +1000

Understand the shift from scripted bots to reasoning AI agents and how to adapt your security strategy for this new reality.

Anatomy of a Credential Stuffing Attack

AC — Mon, 01 Sep 2025 00:00:00 +1000

A deep dive into how credential stuffing attacks work, the tools used, and how to build a multi-layered defense.

Beyond the IP Address

AC — Mon, 01 Sep 2025 00:00:00 +1000

Discover why traditional IP-based rate limiting is obsolete and how advanced techniques provide robust protection against modern distributed attacks.

The Invisibility Cloak

AC — Mon, 01 Sep 2025 00:00:00 +1000

Learn how attackers combine residential proxies and anti-detect browsers to evade detection and how modern security tools can fight back.

The CAPTCHA Conundrum

AC — Mon, 01 Sep 2025 00:00:00 +1000

Explore why traditional CAPTCHAs are failing both users and security, and discover modern, invisible alternatives.

Key Considerations for Effective Bot Management

AC — Mon, 01 Sep 2025 00:00:00 +1000

With nearly half of all internet traffic being automated, a robust bot management strategy is essential. This article explores the key considerations for effective bot detection, classification, and response in the face of evolving threats.

The Bot Spectrum

AC — Mon, 01 Sep 2025 00:00:00 +1000

Learn to classify bots into good, bad, and grey categories and apply the right management strategy for each.

How to Use Bot Management for IAM Use Cases

AC — Wed, 20 Aug 2025 00:00:00 +1000

Bots are part of account takeover, fraud, scraping, and other abuse. Identity and access management leaders need a clear business case for bot management, or their organisations face avoidable account takeover losses and will be less prepared for the risks introduced when customers use AI agents.

The Negative Impact of Visible CAPTCHAs on Bounce Rates and Conversions

Dan — Wed, 06 Aug 2025 13:00:00 +1000

CAPTCHAs have long been a mainstay of bot management solutions, but the tradeoffs are lower conversions, find out just how bad it is.

Protecting Against a Share Point Zero Day Vulnerability with Network Fingerprinting

Dan — Wed, 23 Jul 2025 13:00:00 +1000

Analysis of attempts to exploit a recent Share Point zero day vulnerability reveal network fingerprinting and classification is a robust defense.

Why Don't We Have an AI UI Yet?

AC — Sun, 20 Jul 2025 00:00:00 +1000

If AI is the next great computer interface, why are we still clicking on icons and navigating menus? Exploring the major hurdles standing between us and a true AI-native operating system.

AI as the Translator Between Human and Machine

AC — Sat, 19 Jul 2025 00:00:00 +1000

We've gone from command lines to graphical interfaces. The next great leap in how we interact with computers won't be seen, it will be understood. AI is poised to become the ultimate translator between human intent and machine execution.

From Research Paper to Running Code

AC — Fri, 18 Jul 2025 00:00:00 +1000

Exploring how AI can dramatically accelerate the process of turning complex academic research into functional code, with examples from anomaly detection to small LLMs.

My Programming Journey

AC — Thu, 17 Jul 2025 00:00:00 +1000

A personal journey through the evolution of programming, from the early days of DOS and BASIC to the current age of AI-assisted coding.

A Complete Guide to SMS Pumping Fraud

AC — Thu, 13 Mar 2025 14:00:00 +1100

SMS pumping fraud cost businesses $6.7 billion in 2021. Learn how these sophisticated attacks work, which companies face the highest risk, and the most effective protection strategies.

Why We Can't Trust IP Addresses

AC — Tue, 11 Mar 2025 14:00:00 +1100

The proliferation of residential proxy networks has undermined traditional IP-based security, enabling attackers to bypass protection measures while appearing as legitimate users.

How AI Agents Are Writing Custom Exploits

AC — Mon, 17 Feb 2025 14:00:00 +1100

AI agents with reasoning capabilities like DeepSeek are revolutionizing exploit development, marking the end of traditional security approaches based on static rules and patterns.

A/B Testing, Bots, and the New Normal

AC — Thu, 13 Feb 2025 14:00:00 +1100

How AI agents are skewing marketing metrics and why traditional A/B testing needs to evolve for the age of autonomous digital interactions.

When Bots Are Your Primary Users

AC — Wed, 12 Feb 2025 14:00:00 +1100

An exploration of how AI agents are reshaping API design principles and why we must evolve our approach to serve both machine and human consumers.

Data-Driven Risk Management

AC — Fri, 07 Feb 2025 00:00:00 +1100

How Peakhour's contextual security aligns with Visa's data-driven risk management approach in the 2025-2028 Security Roadmap.

Why Reasoning Models Like DeepSeek Change Everything

AC — Mon, 03 Feb 2025 08:13:00 +1100

How open reasoning models transform automation from rigid scripts to autonomous agents, fundamentally changing our approach to security and digital interactions.

Did Residential Proxies enable a $600 Billion loss?

AC — Fri, 31 Jan 2025 00:00:00 +1100

How residential proxy networks may have enabled DeepSeek to bypass AI platform protections, leading to Nvidia's historic market value loss

Preventing Enumeration Attacks

AC — Fri, 24 Jan 2025 00:00:00 +1100

An analysis of how Peakhour's solutions help prevent enumeration attacks, aligning with Visa's Security Roadmap 2025-2028 priorities.

Visa's Security Roadmap 2025-2028

AC — Tue, 21 Jan 2025 00:00:00 +1100

An analysis of Visa's Security Roadmap 2025-2028 and how Peakhour's solutions help Australian businesses meet these security objectives.

How Bots Are Corrupting Your A/B Testing Data

AC — Mon, 20 Jan 2025 00:00:00 +1100

Understand the impact of bot traffic on A/B testing results and learn how to protect your optimization efforts

How MTU Fingerprinting Identifies VPNs and Mobile Users

AC — Wed, 15 Jan 2025 14:00:00 +1100

Learn how MTU fingerprinting reveals VPN usage, mobile connections, and network technologies through TCP handshake analysis. Discover practical SQL techniques for dynamic network intelligence.

How Bots Contaminate Your A/B Testing Results and Marketing Strategy

Dan — Wed, 15 Jan 2025 13:00:00 +1100

Bot traffic corrupts A/B testing results, leading to flawed marketing decisions. Learn how to protect your tests and ensure accurate data for strategic planning.

Anti-Detect Browsers

AC — Wed, 15 Jan 2025 10:00:00 +1100

Anti-detect browsers represent one of the most sophisticated threats facing modern web applications and APIs. Learn how these tools work, why they pose a significant threat to application security, and how modern security platforms can detect and mitigate their use.

The Hidden Cost of Click Fraud

Dan — Tue, 14 Jan 2025 13:00:00 +1100

Click fraud drains marketing budgets and corrupts campaign data. Learn how bots and residential proxies impact your ad spend and marketing strategy.

Residential Proxies - The Growing Threat to Ad Campaigns

AC — Mon, 30 Dec 2024 00:00:00 +1100

Learn how distributed bot networks using residential IPs are evolving to evade traditional fraud detection

Next-Generation Application Security Defence Strategies

AC — Fri, 15 Nov 2024 14:00:00 +1100

Comprehensive analysis of AI-powered cyber threats and how modern application security platforms defend against machine learning-driven attacks. Learn advanced defence strategies for the AI cybersecurity arms race.

Your Anti-Fraud Residential Proxy Detection Sucks

Dan — Fri, 04 Oct 2024 13:00:00 +1000

Your anti fraud IP Intelligence service is no longer fit for purpose. Learn about the challenges in detecting residential proxies and why traditional methods don't work.

Managing Bots For Application Security

AC — Sun, 15 Sep 2024 00:00:00 +1000

Comprehensive guide to enterprise bot management for modern application security platforms. Learn how to protect applications and APIs from sophisticated bot threats including anti-detect browsers, credential stuffing, and automated attacks targeting DevOps environments.

Application Security for Financial Services Under CPS 234

Dan — Mon, 29 Jul 2024 10:00:00 +1000

Comprehensive analysis of credential stuffing threats against Australian financial institutions and how application security platforms help meet CPS 234 disclosure requirements whilst preventing account takeover attacks.

The Australian epidemic of Account Takeover attacks

AC — Mon, 29 Jul 2024 10:00:00 +1000

An in-depth look at the growing threat of credential stuffing attacks on Australian businesses, including recent case studies, defense challenges, and practical recommendations.

The Challenge of Proxy Detection

AC — Fri, 19 Jul 2024 10:00:00 +1000

Examine why current security solutions fail to detect and mitigate threats from residential proxies, and the need for comprehensive protection strategies.

Quantifying The Residential Proxy Threat

AC — Thu, 18 Jul 2024 10:00:00 +1000

Explore the complexities of residential proxy detection and its impact on organisational risk, with a focus on quantifying the threat and reframing security approaches.

Account Protection and User Experience in Web Applications

AC — Wed, 17 Jul 2024 10:00:00 +1000

Explore strategies to enhance web application security without compromising user experience, focusing on contextual security and adaptive authentication measures.

The Cost of Credential Stuffing

AC — Wed, 17 Jul 2024 00:00:00 +1000

Explore how credential stuffing attacks and account takeovers affect business reputation and customer trust.

2024 Survey Insights

AC — Tue, 16 Jul 2024 10:00:00 +1000

Our 2024 survey of Australian CISOs and CTOs looks at how businesses are approaching account protection, particularly credential stuffing and residential proxies.

2024 Survey Insights

AC — Tue, 16 Jul 2024 10:00:00 +1000

Survey data from Australian CISOs and CTOs shows broad MFA adoption, lower bot protection uptake, and early attention on residential proxy detection for credential stuffing and account takeover risk.

Application Security Beyond MFA

AC — Mon, 15 Jul 2024 10:00:00 +1000

MFA helps, but it does not stop social engineering, residential proxy abuse, credential stuffing, or session risk on its own.

How To Exclude Query String Parameters from Search Engine crawling

Dan — Tue, 21 May 2024 13:00:00 +1000

Double crawling of pages by search engines due to filtering options and query strings can be a massive drain on server resources. Learn how to control it using robots.txt.

Addressing Key Cloud Security Categories

AC — Wed, 01 May 2024 10:00:00 +1000

An analysis of Peakhour's role in addressing key cloud security categories identified in recent industry analysis, demonstrating its comprehensive approach to modern cloud security challenges.

Managing Breached Credential Usage

AC — Fri, 15 Mar 2024 00:00:00 +1100

How breached credential checks and risk signals help detect credential stuffing without adding unnecessary login friction.

Rate Limiting for API Security

AC — Wed, 24 Jan 2024 13:00:00 +1100

How advanced rate limiting protects modern applications and APIs from sophisticated threats including proxy networks, distributed attacks, and automated abuse in enterprise security environments.

The Iconic is the latest Account Takeover victim in the news

Dan — Mon, 15 Jan 2024 13:00:00 +1100

Popular Australian fashion website TheIconic recently suffered reputational damage from fraudsters placing orders after an account takeover. Learn how this happens and what you can do to stop it.

HTTP Security Headers

AC — Tue, 28 Nov 2023 14:00:00 +1100

Comprehensive guide to HTTP security headers for protecting web applications from client-side attacks. Learn essential browser security configurations for modern application security platforms and DevSecOps workflows.

RFC 9460

AC — Thu, 16 Nov 2023 00:00:00 +1100

Introducing SVCB and HTTPS records in DNS and their impact on web connectivity.

Dive into CVSS Scores

AC — Fri, 10 Nov 2023 00:00:00 +1100

Understand CVSS by examining the Atlassian CVE-2023-22515 and CVE-2023-22518.

A Risk Based Approach To Vulnerability Scoring

AC — Fri, 10 Nov 2023 00:00:00 +1100

An in-depth exploration of EPSS, its data-driven approach to assessing cybersecurity threats, and how it complements CVSS.

A Tale Of Two Scoring Systems

AC — Wed, 08 Nov 2023 00:00:00 +1100

Reviewing the CVSS an EPSS CVE scoring systems in light of the Atlassian Confluence-Aggedon

Enterprise-Level Caching for All

Dan — Thu, 02 Nov 2023 13:00:00 +1100

Elevate your e-commerce with our newly released Magento 2 plugin. Experience enterprise-level caching features accessible to all Peakhour customers.

Useful tips to accelerate your Magento store

Dan — Wed, 01 Nov 2023 13:00:00 +1100

There are many things you can do to speed up your Magento store, here are just a few.

Navigating CDN Consolidation

AC — Wed, 01 Nov 2023 00:00:00 +1100

Explore the complexities of switching CDN providers amid industry consolidation and how Peakhour can assist in the transition

Google Chrome's "IP Protection" vs Apple Private Relay

AC — Wed, 25 Oct 2023 13:00:00 +1100

An exploration of Google Chrome's new "IP Protection" feature and a comparison with Apple's iCloud Private Relay.

An Overview of JA4+ Network Fingerprinting and Its Implications

AC — Wed, 25 Oct 2023 13:00:00 +1100

An in-depth exploration of the JA4+ network fingerprinting method, its applications, and its role in cybersecurity.

Google Chrome's "IP Protection" and Online Privacy

AC — Tue, 24 Oct 2023 13:00:00 +1100

An exploration of Google Chrome's new "IP Protection" feature, its promise of enhanced privacy.

ModSecurity’s End-of-Life

AC — Mon, 16 Oct 2023 13:00:00 +1100

ModSecurity's end-of-life marks a pivotal moment in application security evolution. Discover how modern Application Security Platforms are advancing beyond traditional WAF approaches to provide comprehensive protection for web applications and APIs at the edge.

APRA Cybersecurity Guidelines

Dan — Thu, 12 Oct 2023 12:31:00 +1100

Comprehensive guide to APRA cybersecurity requirements for Australian financial institutions. Learn how application security platforms help meet CPS 234 compliance and Information Security Manual guidelines for protecting financial services infrastructure.

HTTP/2 Rapid Reset Attack Deepdive

AC — Thu, 12 Oct 2023 00:00:00 +1100

The technicalities of the HTTP/2 Rapid Reset vulnerability and steps to fortify against DDoS threats.

Web scraping another Business' website

Legalvision — Wed, 11 Oct 2023 13:00:00 +1100

Scraping competitor websites is a common practice, but is it legal? Read on to find out.

Understanding the HTTP/2 Rapid Reset Attack

AC — Wed, 11 Oct 2023 00:00:00 +1100

A comprehensive breakdown of the HTTP/2 Rapid Reset flaw and guidance on bolstering defences against potential DDoS attacks.

Interaction to Next Paint (INP)

Dan — Mon, 11 Sep 2023 13:00:00 +1000

Google is introducing a new Core Web Vital to replace First Input Delay, read on to learn all about it.

The Rise of OpenBullet

AC — Fri, 01 Sep 2023 14:00:00 +1000

A comprehensive look at OpenBullet, its capabilities, and the implications for cybersecurity in the face of its misuse.

A Secure Internet

AC — Wed, 16 Aug 2023 00:00:00 +1000

Google Chrome is advancing towards making the web secure by default through HTTPS-First Mode.

Vary Cache on Cookie Value

Dan — Thu, 03 Aug 2023 13:00:00 +1000

Varying the cache on a specific cookie value is a powerful way to cache personalised content. Many CDNs consider this an enterprise feature, but it's essential for modern dynamic websites.

Content and Origin Mounting

Dan — Thu, 29 Jun 2023 13:00:00 +1000

Content/Origin mounting allows you to seamlessly bring content together from multiple sources, on to your main website.

Cache Tags/Surrogate Keys

Dan — Wed, 28 Jun 2023 13:00:00 +1000

Surrogate Keys, or cache tags, are a powerful mechanism for targeted flushing of content from a cache, not all CDNs support them though.

Headless Commerce Security

Dan — Wed, 28 Jun 2023 00:00:00 +1000

Comprehensive analysis of security challenges in headless commerce and Single Page Applications. Learn how to protect modern e-commerce APIs and microservices architectures from scraping, fraud, and automated attacks.

ZDNS - scan the entire internet

AC — Tue, 20 Jun 2023 13:00:00 +1000

Details the use of ZDNS, a high-performance DNS toolkit, to create a comprehensive Reverse DNS (rDNS) lookup database by scanning the entire internet, and how randomizing the IP space overcomes UDP timeout issues.

Enterprise DDoS Protection

AC — Mon, 19 Jun 2023 00:00:00 +1000

Analysis of the Microsoft 365 DDoS attack by Storm-1359 reveals critical lessons for enterprise application security platforms. Learn advanced Layer 7 DDoS protection strategies and rate limiting techniques for modern applications.

Maximising Website Speed

AC — Wed, 07 Jun 2023 12:31:00 +1000

How can maximising website speed boost your company's revenue, especially during an impending economic recession?

Down But Not Out - JXL Will Return on Safari

AC — Sun, 04 Jun 2023 00:00:00 +1000

What Apple's announcement of JPEG-XL support means for the web ecosystem.

Understanding HTTP Link Headers

Dan — Wed, 24 May 2023 13:00:00 +1000

HTTP Link headers are a relatively unknown but powerful way to improve page load times.

The Rise of the Dragon

AC — Wed, 17 May 2023 13:00:00 +1000

Residential proxy malware, and its implications for traditional cybersecurity measures, emphasising the need for evolving threat detection and mitigation strategies.

Residential Proxies and MITRE Framework

AC — Wed, 17 May 2023 13:00:00 +1000

Explore residential proxies within the context of the MITRE ATT&CK framework, highlighting the security implications and ethical considerations.

Residential Proxy Detection

AC — Wed, 17 May 2023 13:00:00 +1000

Comprehensive analysis of residential proxy threats and detection strategies for modern application security platforms. Learn how sophisticated threat actors use residential proxies to bypass traditional security measures.

When Bots Break Bad

Dan — Tue, 16 May 2023 13:00:00 +1000

Even 'good' bots can end up abusing your site and impacting performance, learn why and how to stop it.

Advanced Anomaly Detection

AC — Mon, 15 May 2023 13:00:00 +1000

Deep dive into Robust Random Cut Forest (RRCF) implementation for real-time anomaly detection in Application Security Platforms. Learn how advanced machine learning algorithms enhance threat detection and automated response capabilities.

Consistent Hash with Bounded Loads

AC — Mon, 15 May 2023 13:00:00 +1000

An overview of consistent hashing with bounded loads, an advanced load balancing technique that ensures a more even distribution of keys across servers, preventing overload and improving system stability.

Double MAD?

AC — Mon, 15 May 2023 13:00:00 +1000

This article explores the use of Double Median Absolute Deviation (Double MAD) for anomaly detection in time series data, particularly in skewed or non-symmetric distributions.

Double MAD vs the Rest

AC — Mon, 15 May 2023 13:00:00 +1000

A look at the limitations of Double MAD for anomaly detection, and a comparison with the Z-score method, to help you choose the right approach for your data.

Efficiently Generating and Printing All IPv4 Addresses in a Random Order

AC — Mon, 15 May 2023 13:00:00 +1000

Explains how to efficiently generate all IPv4 addresses in a random order using a Linear Congruential Generator (LCG), a memory-efficient method for tasks like security testing and network simulation.

Locality Sensitive Hashing

AC — Mon, 15 May 2023 13:00:00 +1000

An introduction to Locality Sensitive Hashing (LSH) and its application in load balancing, including consistent hashing and its use in CDNs and Google's Maglev for efficient server pool management.

Scaling anomaly detection with RRCF

AC — Mon, 15 May 2023 13:00:00 +1000

Discusses strategies for scaling the Robust Random Cut Forest (RRCF) algorithm for large-scale anomaly detection, including using summary statistics, buffering input, and parallelisation.

Applied RRCF - thresholding techniques.

AC — Mon, 15 May 2023 13:00:00 +1000

Explores various thresholding techniques like Median Absolute Deviation (MAD), Min/Max, and Z-Score for interpreting Robust Random Cut Forest (RRCF) anomaly scores, crucial for classifying data points as normal or anomalous.

Multi-Origin Load Balancing

Dan — Tue, 11 Apr 2023 13:00:00 +1000

Websites with a global audience need more than just a traditional CDN. They need geographic multi origin load balancing.