Peakhour.IO - Threat Detection

Two Lineages of TLS Fingerprinting: JA3, JA4 and Cisco Mercury

AC — Sun, 26 Jul 2026 09:00:00 +1000

JA4 did not descend from Cisco Mercury. The two projects come from different strands of TLS fingerprinting research and solve different operational problems.

API Bot Abuse Does Not Stay in One Endpoint

AC — Fri, 19 Jun 2026 00:00:00 +1000

API bot abuse moves across login, checkout, and account journeys. Defenders need route-aware bot, rate, and account controls that follow the campaign rather than treating each endpoint as a separate incident.

API Protection and Account Protection Are One Request-Path Problem

AC — Fri, 19 Jun 2026 00:00:00 +1000

Account protection does not stop at the login form. The same request path carries API, bot, rate, token, and account-risk evidence, and that is where the decision needs to happen.

How Residential Proxies Changed API and Account Abuse

AC — Fri, 19 Jun 2026 00:00:00 +1000

Residential proxies have changed account abuse from obvious bursts into distributed, low-noise workflows across login, account, and API routes. Treat proxy use as a risk signal, not a blunt block rule.

Shadow APIs Are Account-Abuse Paths

AC — Fri, 19 Jun 2026 00:00:00 +1000

Shadow APIs matter because attackers do not care whether a route is documented. Mobile, partner, browser-backed, and legacy APIs can all become account-abuse paths when they remain outside normal controls.

Agentic AI vs. Your API

AC — Mon, 01 Sep 2025 00:00:00 +1000

Understand the shift from scripted bots to reasoning AI agents and how to adapt your security strategy for this new reality.

Anatomy of a Credential Stuffing Attack

AC — Mon, 01 Sep 2025 00:00:00 +1000

A deep dive into how credential stuffing attacks work, the tools used, and how to build a multi-layered defense.

Key Considerations for Effective Bot Management

AC — Mon, 01 Sep 2025 00:00:00 +1000

With nearly half of all internet traffic being automated, a robust bot management strategy is essential. This article explores the key considerations for effective bot detection, classification, and response in the face of evolving threats.

The Bot Spectrum

AC — Mon, 01 Sep 2025 00:00:00 +1000

Learn to classify bots into good, bad, and grey categories and apply the right management strategy for each.

How to Use Bot Management for IAM Use Cases

AC — Wed, 20 Aug 2025 00:00:00 +1000

Bots are part of account takeover, fraud, scraping, and other abuse. Identity and access management leaders need a clear business case for bot management, or their organisations face avoidable account takeover losses and will be less prepared for the risks introduced when customers use AI agents.

Protecting Against a Share Point Zero Day Vulnerability with Network Fingerprinting

Dan — Wed, 23 Jul 2025 13:00:00 +1000

Analysis of attempts to exploit a recent Share Point zero day vulnerability reveal network fingerprinting and classification is a robust defense.

Why We Can't Trust IP Addresses

AC — Tue, 11 Mar 2025 14:00:00 +1100

The proliferation of residential proxy networks has undermined traditional IP-based security, enabling attackers to bypass protection measures while appearing as legitimate users.

How AI Agents Are Writing Custom Exploits

AC — Mon, 17 Feb 2025 14:00:00 +1100

AI agents with reasoning capabilities like DeepSeek are revolutionizing exploit development, marking the end of traditional security approaches based on static rules and patterns.

Data-Driven Risk Management

AC — Fri, 07 Feb 2025 00:00:00 +1100

How Peakhour's contextual security aligns with Visa's data-driven risk management approach in the 2025-2028 Security Roadmap.

Did Residential Proxies enable a $600 Billion loss?

AC — Fri, 31 Jan 2025 00:00:00 +1100

How residential proxy networks may have enabled DeepSeek to bypass AI platform protections, leading to Nvidia's historic market value loss

Preventing Enumeration Attacks

AC — Fri, 24 Jan 2025 00:00:00 +1100

An analysis of how Peakhour's solutions help prevent enumeration attacks, aligning with Visa's Security Roadmap 2025-2028 priorities.

How MTU Fingerprinting Identifies VPNs and Mobile Users

AC — Wed, 15 Jan 2025 14:00:00 +1100

Learn how MTU fingerprinting reveals VPN usage, mobile connections, and network technologies through TCP handshake analysis. Discover practical SQL techniques for dynamic network intelligence.

Anti-Detect Browsers

AC — Wed, 15 Jan 2025 10:00:00 +1100

Anti-detect browsers represent one of the most sophisticated threats facing modern web applications and APIs. Learn how these tools work, why they pose a significant threat to application security, and how modern security platforms can detect and mitigate their use.

Residential Proxies - The Growing Threat to Ad Campaigns

AC — Mon, 30 Dec 2024 00:00:00 +1100

Learn how distributed bot networks using residential IPs are evolving to evade traditional fraud detection

Next-Generation Application Security Defence Strategies

AC — Fri, 15 Nov 2024 14:00:00 +1100

Comprehensive analysis of AI-powered cyber threats and how modern application security platforms defend against machine learning-driven attacks. Learn advanced defence strategies for the AI cybersecurity arms race.

Your Anti-Fraud Residential Proxy Detection Sucks

Dan — Fri, 04 Oct 2024 13:00:00 +1000

Your anti fraud IP Intelligence service is no longer fit for purpose. Learn about the challenges in detecting residential proxies and why traditional methods don't work.

The Australian epidemic of Account Takeover attacks

AC — Mon, 29 Jul 2024 10:00:00 +1000

An in-depth look at the growing threat of credential stuffing attacks on Australian businesses, including recent case studies, defense challenges, and practical recommendations.

The Challenge of Proxy Detection

AC — Fri, 19 Jul 2024 10:00:00 +1000

Examine why current security solutions fail to detect and mitigate threats from residential proxies, and the need for comprehensive protection strategies.

Quantifying The Residential Proxy Threat

AC — Thu, 18 Jul 2024 10:00:00 +1000

Explore the complexities of residential proxy detection and its impact on organisational risk, with a focus on quantifying the threat and reframing security approaches.

Application Security Beyond MFA

AC — Mon, 15 Jul 2024 10:00:00 +1000

MFA helps, but it does not stop social engineering, residential proxy abuse, credential stuffing, or session risk on its own.

Addressing Key Cloud Security Categories

AC — Wed, 01 May 2024 10:00:00 +1000

An analysis of Peakhour's role in addressing key cloud security categories identified in recent industry analysis, demonstrating its comprehensive approach to modern cloud security challenges.

Managing Breached Credential Usage

AC — Fri, 15 Mar 2024 00:00:00 +1100

How breached credential checks and risk signals help detect credential stuffing without adding unnecessary login friction.

Rate Limiting for API Security

AC — Wed, 24 Jan 2024 13:00:00 +1100

How advanced rate limiting protects modern applications and APIs from sophisticated threats including proxy networks, distributed attacks, and automated abuse in enterprise security environments.

Dive into CVSS Scores

AC — Fri, 10 Nov 2023 00:00:00 +1100

Understand CVSS by examining the Atlassian CVE-2023-22515 and CVE-2023-22518.

A Risk Based Approach To Vulnerability Scoring

AC — Fri, 10 Nov 2023 00:00:00 +1100

An in-depth exploration of EPSS, its data-driven approach to assessing cybersecurity threats, and how it complements CVSS.

A Tale Of Two Scoring Systems

AC — Wed, 08 Nov 2023 00:00:00 +1100

Reviewing the CVSS an EPSS CVE scoring systems in light of the Atlassian Confluence-Aggedon

JA4 and JA4+ Network Fingerprinting

AC — Wed, 25 Oct 2023 13:00:00 +1100

How JA4 constructs a TLS client fingerprint, what JA4+ names, and which details sorting and hashing discard.

ModSecurity’s End-of-Life

AC — Mon, 16 Oct 2023 13:00:00 +1100

ModSecurity's end-of-life marks a pivotal moment in application security evolution. Discover how modern Application Security Platforms are advancing beyond traditional WAF approaches to provide comprehensive protection for web applications and APIs at the edge.

APRA Cybersecurity Guidelines

Dan — Thu, 12 Oct 2023 12:31:00 +1100

Comprehensive guide to APRA cybersecurity requirements for Australian financial institutions. Learn how application security platforms help meet CPS 234 compliance and Information Security Manual guidelines for protecting financial services infrastructure.

Understanding the HTTP/2 Rapid Reset Attack

AC — Wed, 11 Oct 2023 00:00:00 +1100

A comprehensive breakdown of the HTTP/2 Rapid Reset flaw and guidance on bolstering defences against potential DDoS attacks.

The Rise of OpenBullet

AC — Fri, 01 Sep 2023 14:00:00 +1000

A comprehensive look at OpenBullet, its capabilities, and the implications for cybersecurity in the face of its misuse.

Enterprise DDoS Protection

AC — Mon, 19 Jun 2023 00:00:00 +1000

Analysis of the Microsoft 365 DDoS attack by Storm-1359 reveals critical lessons for enterprise application security platforms. Learn advanced Layer 7 DDoS protection strategies and rate limiting techniques for modern applications.

The Rise of the Dragon

AC — Wed, 17 May 2023 13:00:00 +1000

Residential proxy malware, and its implications for traditional cybersecurity measures, emphasising the need for evolving threat detection and mitigation strategies.

Residential Proxies and MITRE Framework

AC — Wed, 17 May 2023 13:00:00 +1000

Explore residential proxies within the context of the MITRE ATT&CK framework, highlighting the security implications and ethical considerations.

Residential Proxy Detection

AC — Wed, 17 May 2023 13:00:00 +1000

Comprehensive analysis of residential proxy threats and detection strategies for modern application security platforms. Learn how sophisticated threat actors use residential proxies to bypass traditional security measures.

Advanced Anomaly Detection

AC — Mon, 15 May 2023 13:00:00 +1000

Deep dive into Robust Random Cut Forest (RRCF) implementation for real-time anomaly detection in Application Security Platforms. Learn how advanced machine learning algorithms enhance threat detection and automated response capabilities.

Double MAD?

AC — Mon, 15 May 2023 13:00:00 +1000

This article explores the use of Double Median Absolute Deviation (Double MAD) for anomaly detection in time series data, particularly in skewed or non-symmetric distributions.

Scaling anomaly detection with RRCF

AC — Mon, 15 May 2023 13:00:00 +1000

Discusses strategies for scaling the Robust Random Cut Forest (RRCF) algorithm for large-scale anomaly detection, including using summary statistics, buffering input, and parallelisation.

Applied RRCF - thresholding techniques.

AC — Mon, 15 May 2023 13:00:00 +1000

Explores various thresholding techniques like Median Absolute Deviation (MAD), Min/Max, and Z-Score for interpreting Robust Random Cut Forest (RRCF) anomaly scores, crucial for classifying data points as normal or anomalous.

IP Threat Intelligence

AC — Fri, 15 Jul 2022 13:00:00 +1000

Comprehensive guide to IP threat intelligence for modern application security platforms. Learn how managed IP reputation lists and threat intelligence feeds protect applications from known malicious sources and emerging threats.

Intelligent Rate Limiting

AC — Mon, 16 May 2022 13:00:00 +1000

Comprehensive guide to intelligent rate limiting for modern application security platforms. Learn how sophisticated rate limiting protects APIs and web applications from abuse, DDoS attacks, and automated threats whilst maintaining optimal user experience.

Why Manage Bots?

AC — Mon, 30 Nov 2020 13:00:00 +1100

Comprehensive guide to enterprise bot management and advanced countermeasures for protecting applications against sophisticated malicious bot threats. Learn proven strategies for bot detection, mitigation, and automated defence systems.

Application Performance Optimisation

Dan — Sat, 12 Sep 2020 13:00:00 +1000

A practical primer for finding where website requests lose time, from cache state and origin work to browser rendering.

Instant Alerts

Dan — Fri, 31 May 2019 13:00:00 +1000

Introducing Instant Alerts, a new feature for receiving emails or SMS alerts when events happen on your site.