When Home Devices Become Attack Infrastructure
Application teams cannot clean compromised televisions, routers, or household devices. They can stop treating the residential address as proof and control what the relayed request is allowed to do.
Residential Proxies Turn Layer 7 DDoS Into a Route Problem
A distributed pool can keep each residential IP quiet while expensive application routes fail. Mitigation has to follow request cost and behaviour, not only traffic volume.
Five Routes, Five Residential Proxy Decisions
Account creation, login, password reset, checkout, and public APIs should not share one residential-proxy action. Each route needs its own evidence and failure policy.
What a Residential Proxy Decision Log Should Contain
A useful proxy event records the request, signal provenance, policy, action, and outcome. A timestamp and a risk score are not enough to explain an enforcement decision.
Keep Your CDN. Add Proxy and Bot Decisions at the Edge.
Replacing a CDN is not the only way to improve bot and proxy controls. The harder requirement is preserving trusted client context, enforceable policy, and decision evidence across the request path.
Credential Stuffing Through “Clean” Residential IPs
A residential IP with no bad reputation can still carry a credential-stuffing attempt. Defend the login workflow by joining credential, route, client, and outcome evidence.
The IP Changed. Did the Actor?
Residential proxy rotation defeats IP-only counters. The answer is not a new identity claim, but a carefully chosen set of cohort, account, route, and outcome keys.
Residential Proxy Detection for APIs Without JavaScript
APIs cannot depend on browser JavaScript to expose proxy abuse. They need server-side network, protocol, identity, route, and outcome evidence in the request path.
A Proxy Flag Is Not a Security Policy
Residential proxy detection is useful evidence. The security decision still has to account for the route, credentials, client history, behaviour, and cost of getting the action wrong.
How Bandwidth Sharing Feeds Residential Proxy Networks
Residential proxy capacity can come from bandwidth-sharing apps, monetisation SDKs, compromised servers, and pre-infected consumer devices. Here is why consent and a residential IP are not enough to establish trust.
How to Protect APIs From Unwanted Automation
An API cannot simply block automation. The practical job is to decide which automated use belongs on each route, then control the rest without breaking legitimate clients.
When and Why to Use a WAF: A Guide for WAF Sceptics
WAFs are neither useless nor a security force field. Here is what they are good at, where they fail, and when putting one in front of an application makes sense.
Your Application Needs a WAF. Just Not for the Reason You Think
A web application firewall will not fix insecure code. It can still give applications a valuable layer of protection when bugs, bots and attacks reach the front door.
Everyone Says a WAF Is Useless. Are They Right?
Ten good reasons not to trust a web application firewall—and why most of them are arguments for using one properly, not going without one.
A Network Fingerprint Is a Cohort, Not a Client
TLS fingerprints group similar protocol implementations. They do not prove which application, device or person made a request.
Using Network Fingerprints in Bot and Rate-Limit Decisions
A practical way to use network fingerprints for bot and rate-limit decisions without mistaking a shared client cohort for identity.
How to fix your Adobe Commerce Overages with Fastly
If you're consistently going over your contracted CDN egress on your Adobe Commerce contract here's how you can easily fix it.
API Bot Abuse Does Not Stay in One Endpoint
API bot abuse moves across login, checkout, and account journeys. Defenders need route-aware bot, rate, and account controls that follow the campaign rather than treating each endpoint as a separate incident.
API Protection and Account Protection Are One Request-Path Problem
Account protection does not stop at the login form. The same request path carries API, bot, rate, token, and account-risk evidence, and that is where the decision needs to happen.
The Real Cost of Breached Credentials
Breached credentials keep creating cost after the original breach. They feed credential stuffing, account takeover, fraud, support, and reputation costs across login, recovery, checkout, and API flows.
Credential Stuffing Does Not Stop at the Login Form
Credential stuffing risk continues after a password works. Account protection needs to watch password reset, email change, stored payment, gift card, and checkout flows.
Fingerprints Are Evidence, Not Identity
Browser and network fingerprints are useful security evidence, but they should not be treated as proof of a person's identity.
How Residential Proxies Changed API and Account Abuse
Residential proxies have changed account abuse from obvious bursts into distributed, low-noise workflows across login, account, and API routes. Treat proxy use as a risk signal, not a blunt block rule.
Shadow APIs Are Account-Abuse Paths
Shadow APIs matter because attackers do not care whether a route is documented. Mobile, partner, browser-backed, and legacy APIs can all become account-abuse paths when they remain outside normal controls.
Price Transparency Is Now a Data Access Problem
Price comparison increasingly depends on current web and API data. Retailers need bot and API controls that can distinguish intended automated access from uncontrolled extraction.
The BOTS Act and the War on Ticket Scalping
A deep dive into the BOTS Act, how it's being used to investigate Ticketmaster, and the ongoing battle against ticket scalping bots.
Agentic AI vs. Your API
Understand the shift from scripted bots to reasoning AI agents and how to adapt your security strategy for this new reality.
Beyond the IP Address
Discover why traditional IP-based rate limiting is obsolete and how advanced techniques provide robust protection against modern distributed attacks.
The Invisibility Cloak
Learn how attackers combine residential proxies and anti-detect browsers to evade detection and how modern security tools can fight back.
The CAPTCHA Conundrum
Explore why traditional CAPTCHAs are failing both users and security, and discover modern, invisible alternatives.
Key Considerations for Effective Bot Management
With nearly half of all internet traffic being automated, a robust bot management strategy is essential. This article explores the key considerations for effective bot detection, classification, and response in the face of evolving threats.
The Bot Spectrum
Learn to classify bots into good, bad, and grey categories and apply the right management strategy for each.
How to Use Bot Management for IAM Use Cases
Bots are part of account takeover, fraud, scraping, and other abuse. Identity and access management leaders need a clear business case for bot management, or their organisations face avoidable account takeover losses and will be less prepared for the risks introduced when customers use AI agents.
The Negative Impact of Visible CAPTCHAs on Bounce Rates and Conversions
CAPTCHAs have long been a mainstay of bot management solutions, but the tradeoffs are lower conversions, find out just how bad it is.
AI as the Translator Between Human and Machine
We've gone from command lines to graphical interfaces. The next great leap in how we interact with computers won't be seen, it will be understood. AI is poised to become the ultimate translator between human intent and machine execution.
SMS Pumping Fraud: How Verification Traffic Inflates the Bill
SMS pumping turns verification endpoints into billable traffic. Trace the delivery chain, measure abnormal sends and stop expensive requests before the provider charge lands.
How AI Agents Are Writing Custom Exploits
AI agents with reasoning capabilities like DeepSeek are revolutionizing exploit development, marking the end of traditional security approaches based on static rules and patterns.
A/B Testing, Bots, and the New Normal
How AI agents are skewing marketing metrics and why traditional A/B testing needs to evolve for the age of autonomous digital interactions.
When Bots Are Your Primary Users
An exploration of how AI agents are reshaping API design principles and why we must evolve our approach to serve both machine and human consumers.
Why Reasoning Models Like DeepSeek Change Everything
How open reasoning models transform automation from rigid scripts to autonomous agents, fundamentally changing our approach to security and digital interactions.
Did Residential Proxies enable a $600 Billion loss?
How residential proxy networks may have enabled DeepSeek to bypass AI platform protections, leading to Nvidia's historic market value loss
How Bots Are Corrupting Your A/B Testing Data
Understand the impact of bot traffic on A/B testing results and learn how to protect your optimization efforts
How Bots Contaminate Your A/B Testing Results and Marketing Strategy
Bot traffic corrupts A/B testing results, leading to flawed marketing decisions. Learn how to protect your tests and ensure accurate data for strategic planning.
Anti-Detect Browsers
Anti-detect browsers represent one of the most sophisticated threats facing modern web applications and APIs. Learn how these tools work, why they pose a significant threat to application security, and how modern security platforms can detect and mitigate their use.
The Hidden Cost of Click Fraud
Click fraud drains marketing budgets and corrupts campaign data. Learn how bots and residential proxies impact your ad spend and marketing strategy.
Residential Proxies - The Growing Threat to Ad Campaigns
Learn how distributed bot networks using residential IPs are evolving to evade traditional fraud detection
Next-Generation Application Security Defence Strategies
Comprehensive analysis of AI-powered cyber threats and how modern application security platforms defend against machine learning-driven attacks. Learn advanced defence strategies for the AI cybersecurity arms race.
Managing Bots For Application Security
Comprehensive guide to enterprise bot management for modern application security platforms. Learn how to protect applications and APIs from sophisticated bot threats including anti-detect browsers, credential stuffing, and automated attacks targeting DevOps environments.
The Challenge of Proxy Detection
Examine why current security solutions fail to detect and mitigate threats from residential proxies, and the need for comprehensive protection strategies.
Quantifying The Residential Proxy Threat
Explore the complexities of residential proxy detection and its impact on organisational risk, with a focus on quantifying the threat and reframing security approaches.
2024 Survey Insights
Our 2024 survey of Australian CISOs and CTOs looks at how businesses are approaching account protection, particularly credential stuffing and residential proxies.
2024 Survey Insights
Survey data from Australian CISOs and CTOs shows broad MFA adoption, lower bot protection uptake, and early attention on residential proxy detection for credential stuffing and account takeover risk.
Application Security Beyond MFA
MFA helps, but it does not stop social engineering, residential proxy abuse, credential stuffing, or session risk on its own.
How To Exclude Query String Parameters from Search Engine crawling
Double crawling of pages by search engines due to filtering options and query strings can be a massive drain on server resources. Learn how to control it using robots.txt.
Rate Limiting for API Security
How advanced rate limiting protects modern applications and APIs from sophisticated threats including proxy networks, distributed attacks, and automated abuse in enterprise security environments.
Google Chrome's "IP Protection" vs Apple Private Relay
An exploration of Google Chrome's new "IP Protection" feature and a comparison with Apple's iCloud Private Relay.
Google Chrome's "IP Protection" and Online Privacy
An exploration of Google Chrome's new "IP Protection" feature, its promise of enhanced privacy.
HTTP/2 Rapid Reset Attack Deepdive
The technicalities of the HTTP/2 Rapid Reset vulnerability and steps to fortify against DDoS threats.
Understanding the HTTP/2 Rapid Reset Attack
A comprehensive breakdown of the HTTP/2 Rapid Reset flaw and guidance on bolstering defences against potential DDoS attacks.
The Rise of OpenBullet
How OpenBullet packages browser and HTTP automation for credential attacks, and which signals defenders can use without treating any one fingerprint as proof.
Headless Commerce Security
Comprehensive analysis of security challenges in headless commerce and Single Page Applications. Learn how to protect modern e-commerce APIs and microservices architectures from scraping, fraud, and automated attacks.
The Rise of the Dragon
Residential proxy malware, and its implications for traditional cybersecurity measures, emphasising the need for evolving threat detection and mitigation strategies.
Residential Proxy Detection
Comprehensive analysis of residential proxy threats and detection strategies for modern application security platforms. Learn how sophisticated threat actors use residential proxies to bypass traditional security measures.
When Bots Break Bad
Even 'good' bots can end up abusing your site and impacting performance, learn why and how to stop it.
Advanced Anomaly Detection
Deep dive into Robust Random Cut Forest (RRCF) implementation for real-time anomaly detection in Application Security Platforms. Learn how advanced machine learning algorithms enhance threat detection and automated response capabilities.
Double MAD?
This article explores the use of Double Median Absolute Deviation (Double MAD) for anomaly detection in time series data, particularly in skewed or non-symmetric distributions.
IP Threat Intelligence
Comprehensive guide to IP threat intelligence for modern application security platforms. Learn how managed IP reputation lists and threat intelligence feeds protect applications from known malicious sources and emerging threats.
Intelligent Rate Limiting
Comprehensive guide to intelligent rate limiting for modern application security platforms. Learn how sophisticated rate limiting protects APIs and web applications from abuse, DDoS attacks, and automated threats whilst maintaining optimal user experience.
Rate limiting
How can rate limiting protect your web application and the key items to consider when enabling.
Why Manage Bots?
Comprehensive guide to enterprise bot management and advanced countermeasures for protecting applications against sophisticated malicious bot threats. Learn proven strategies for bot detection, mitigation, and automated defence systems.
Website Performance testing with WebPageTest.org
Use WebPageTest to reproduce a page load from a chosen browser and location, then inspect the waterfall, filmstrip and request-level delays.
Malicious Bot Threats
Comprehensive analysis of malicious bot threats targeting modern applications and APIs. Learn how enterprise bot management protects against automated attacks, credential stuffing, price scraping, and sophisticated bot-driven financial damage.