https://www.peakhour.io/Mon, 03 Aug 2026 10:30:00 +1000https://www.peakhour.io/blog/proxy-takedown-is-not-security-control/<p>Proxy-network enforcement can reduce supply and protect device owners. Your application still needs current intelligence, behaviour correlation, route-specific controls, and measured request decisions.</p>ACMon, 03 Aug 2026 09:00:00 +1000tag:www.peakhour.io,2026-08-03:/blog/proxy-takedown-is-not-security-control/SecurityResidential ProxiesBot ManagementFraud PreventionThreat IntelligenceAccount Protectionhttps://www.peakhour.io/blog/application-defence-compromised-home-devices/<p>Application teams cannot clean compromised televisions, routers, or household devices. They can stop treating the residential address as proof and control what the relayed request is allowed to do.</p>ACSat, 01 Aug 2026 12:30:00 +1000tag:www.peakhour.io,2026-08-01:/blog/application-defence-compromised-home-devices/SecurityResidential ProxiesIoT SecurityBot ManagementApplication SecurityThreat Detectionhttps://www.peakhour.io/blog/residential-proxies-layer-7-ddos/<p>A distributed pool can keep each residential IP quiet while expensive application routes fail. Mitigation has to follow request cost and behaviour, not only traffic volume.</p>ACSat, 01 Aug 2026 12:20:00 +1000tag:www.peakhour.io,2026-08-01:/blog/residential-proxies-layer-7-ddos/SecurityDDoSResidential ProxiesRate LimitingBot ManagementOrigin Protectionhttps://www.peakhour.io/blog/privacy-relay-vpn-residential-proxy-policy/<p>An anonymised connection is not automatically abusive. Security policy should distinguish expected privacy and corporate access from proxy use that appears beside risky behaviour.</p>ACSat, 01 Aug 2026 12:00:00 +1000tag:www.peakhour.io,2026-08-01:/blog/privacy-relay-vpn-residential-proxy-policy/SecurityPrivacyResidential ProxiesVPNIP IntelligenceFalse Positiveshttps://www.peakhour.io/blog/residential-proxy-decision-logging/<p>A useful proxy event records the request, signal provenance, policy, action, and outcome. A timestamp and a risk score are not enough to explain an enforcement decision.</p>ACSat, 01 Aug 2026 11:50:00 +1000tag:www.peakhour.io,2026-08-01:/blog/residential-proxy-decision-logging/SecurityResidential ProxiesSecurity LoggingSIEMBot ManagementIncident Responsehttps://www.peakhour.io/blog/proxy-bot-decisions-existing-cdn/<p>Replacing a CDN is not the only way to improve bot and proxy controls. The harder requirement is preserving trusted client context, enforceable policy, and decision evidence across the request path.</p>ACSat, 01 Aug 2026 11:40:00 +1000tag:www.peakhour.io,2026-08-01:/blog/proxy-bot-decisions-existing-cdn/SecurityEdge SecurityCDNBot ManagementResidential ProxiesBring Your Own Edgehttps://www.peakhour.io/blog/proxy-flag-is-not-a-security-policy/<p>Residential proxy detection is useful evidence. The security decision still has to account for the route, credentials, client history, behaviour, and cost of getting the action wrong.</p>ACSat, 01 Aug 2026 11:00:00 +1000tag:www.peakhour.io,2026-08-01:/blog/proxy-flag-is-not-a-security-policy/SecurityResidential ProxiesBot ManagementAccount ProtectionRisk ScoringEdge Securityhttps://www.peakhour.io/blog/two-lineages-tls-fingerprinting/<p>JA4 did not descend from Cisco Mercury. The two projects come from different strands of TLS fingerprinting research and solve different operational problems.</p>ACSun, 26 Jul 2026 09:00:00 +1000tag:www.peakhour.io,2026-07-26:/blog/two-lineages-tls-fingerprinting/SecurityTLS FingerprintingJA3JA4Cisco MercuryNetwork FingerprintingThreat Detectionhttps://www.peakhour.io/blog/before-ja3-tls-fingerprinting-history/<p>JA3 made TLS fingerprints easy to log and share, but the technical ideas behind it had already been tested in SSL Labs experiments, a p0f patch and FingerprinTLS.</p>ACSun, 19 Jul 2026 09:00:00 +1000tag:www.peakhour.io,2026-07-19:/blog/before-ja3-tls-fingerprinting-history/SecurityTLS FingerprintingJA3FingerprinTLSp0fNetwork FingerprintingSecurity Researchhttps://www.peakhour.io/blog/fingerprint-is-a-cohort-not-a-client/<p>TLS fingerprints group similar protocol implementations. They do not prove which application, device or person made a request.</p>ACMon, 13 Jul 2026 09:28:00 +1000tag:www.peakhour.io,2026-07-13:/blog/fingerprint-is-a-cohort-not-a-client/SecurityTLS FingerprintingJA3JA4Cisco MercuryNetwork FingerprintingBot Managementhttps://www.peakhour.io/blog/from-joy-to-mercury-and-eve/<p>Cisco's open-source collectors, fingerprinting research and Encrypted Visibility Engine form a clear lineage, but they are not interchangeable parts of one public system.</p>ACMon, 13 Jul 2026 09:28:00 +1000tag:www.peakhour.io,2026-07-13:/blog/from-joy-to-mercury-and-eve/SecurityCisco JoyCisco MercuryEncrypted Visibility EngineTLS FingerprintingNetwork FingerprintingEncrypted Traffichttps://www.peakhour.io/blog/open-network-fingerprint-database-schema/<p>A useful open fingerprint database needs provenance, competing labels, raw evidence, format versions and licences—not another unexplained hash list.</p>ACMon, 13 Jul 2026 09:28:00 +1000tag:www.peakhour.io,2026-07-13:/blog/open-network-fingerprint-database-schema/SecurityNetwork FingerprintingTLS FingerprintingJA4Cisco MercurySecurity Researchhttps://www.peakhour.io/blog/public-fingerprint-databases-are-not-ground-truth/<p>We reviewed the main public fingerprint resources. The formats are open, but current application labels and auditable ground truth remain scarce.</p>ACMon, 13 Jul 2026 09:28:00 +1000tag:www.peakhour.io,2026-07-13:/blog/public-fingerprint-databases-are-not-ground-truth/SecurityNetwork FingerprintingTLS FingerprintingJA3JA4Threat Intelligencehttps://www.peakhour.io/blog/tls-fingerprint-canonicalisation-attacker-variation/<p>Sorting makes TLS fingerprints more stable, but it also removes ordering evidence. Here is how to test whether the discarded variation matters.</p>ACMon, 13 Jul 2026 09:28:00 +1000tag:www.peakhour.io,2026-07-13:/blog/tls-fingerprint-canonicalisation-attacker-variation/SecurityTLS FingerprintingJA4Cisco MercuryNetwork FingerprintingSecurity Researchhttps://www.peakhour.io/blog/using-network-fingerprints-in-bot-and-rate-limit-decisions/<p>A practical way to use network fingerprints for bot and rate-limit decisions without mistaking a shared client cohort for identity.</p>ACMon, 13 Jul 2026 09:28:00 +1000tag:www.peakhour.io,2026-07-13:/blog/using-network-fingerprints-in-bot-and-rate-limit-decisions/SecurityNetwork FingerprintingTLS FingerprintingJA4Bot ManagementRate Limitinghttps://www.peakhour.io/blog/one-clienthello-ja3-ja4-mercury-lab/<p>A reproducible lab runs JA3, JA4 and Cisco Mercury against the same TLS ClientHello and compares what each fingerprint preserves.</p>ACSun, 12 Jul 2026 09:00:00 +1000tag:www.peakhour.io,2026-07-12:/blog/one-clienthello-ja3-ja4-mercury-lab/SecurityTLS FingerprintingJA3JA4Cisco MercuryNetwork FingerprintingSecurity Researchhttps://www.peakhour.io/blog/edge-security-and-privacy-compliance/<p>Recent guidelines from the Australian government have specified practical measures businesses need to take to protect personal information. Learn more.</p>DanThu, 25 Jun 2026 08:13:00 +1000tag:www.peakhour.io,2026-06-25:/blog/edge-security-and-privacy-compliance/SecuritySecurityCompliancehttps://www.peakhour.io/blog/anatomy-of-a-credential-stuffing-attack/<p>A deep dive into how credential stuffing attacks work, the tools used, and how to build a multi-layered defense.</p>ACMon, 01 Sep 2025 00:00:00 +1000tag:www.peakhour.io,2025-09-01:/blog/anatomy-of-a-credential-stuffing-attack/SecurityCredential StuffingAccount ProtectionFraud PreventionResidential ProxiesDNSThreat Detectionhttps://www.peakhour.io/blog/bots-residential-proxies-anti-detect-browsers/<p>Residential proxies change the network path while anti-detect browsers change the client presentation. Detection works by finding inconsistencies across the request, not by treating either signal as identity.</p>ACMon, 01 Sep 2025 00:00:00 +1000tag:www.peakhour.io,2025-09-01:/blog/bots-residential-proxies-anti-detect-browsers/SecurityBrowser FingerprintingFingerprintingResidential ProxiesBot ManagementTLS FingerprintingCredential Stuffinghttps://www.peakhour.io/blog/bot-management-for-iam-use-cases/<p>Bots are part of account takeover, fraud, scraping, and other abuse. Identity and access management leaders need a clear business case for bot management, or their organisations face avoidable account takeover losses and will be less prepared for the risks introduced when customers use AI agents.</p>ACWed, 20 Aug 2025 00:00:00 +1000tag:www.peakhour.io,2025-08-20:/blog/bot-management-for-iam-use-cases/SecurityBot ManagementAccount ProtectionCredential StuffingAPI SecurityThreat DetectionFraud Preventionhttps://www.peakhour.io/blog/the-negative-impact-of-captchas-on-ecommerce-conversions/<p>CAPTCHAs have long been a mainstay of bot management solutions, but the tradeoffs are lower conversions, find out just how bad it is.</p>DanWed, 06 Aug 2025 13:00:00 +1000tag:www.peakhour.io,2025-08-06:/blog/the-negative-impact-of-captchas-on-ecommerce-conversions/SecurityBot ManagementAccount Protectionhttps://www.peakhour.io/blog/protecting-against-share-point-zero-day/<p>Analysis of attempts to exploit a recent Share Point zero day vulnerability reveal network fingerprinting and classification is a robust defense.</p>DanWed, 23 Jul 2025 13:00:00 +1000tag:www.peakhour.io,2025-07-23:/blog/protecting-against-share-point-zero-day/SecurityThreat DetectionCredential StuffingAccount ProtectionDevSecOpsDDoSApplication Securityhttps://www.peakhour.io/blog/ai-agents-custom-exploits/<p>AI agents with reasoning capabilities like DeepSeek are revolutionizing exploit development, marking the end of traditional security approaches based on static rules and patterns.</p>ACMon, 17 Feb 2025 14:00:00 +1100tag:www.peakhour.io,2025-02-17:/blog/ai-agents-custom-exploits/SecurityApplication SecurityThreat DetectionDevSecOpsBot ManagementAPI SecurityDDoShttps://www.peakhour.io/blog/future-of-apis-bot-primary-users/<p>An exploration of how AI agents are reshaping API design principles and why we must evolve our approach to serve both machine and human consumers.</p>ACWed, 12 Feb 2025 14:00:00 +1100tag:www.peakhour.io,2025-02-12:/blog/future-of-apis-bot-primary-users/SecurityBot ManagementAPI SecurityMachine Learninghttps://www.peakhour.io/blog/agentic-ai-deepseek-changes-everything/<p>How open reasoning models transform automation from rigid scripts to autonomous agents, fundamentally changing our approach to security and digital interactions.</p>ACMon, 03 Feb 2025 08:13:00 +1100tag:www.peakhour.io,2025-02-03:/blog/agentic-ai-deepseek-changes-everything/SecurityDevSecOpsBot ManagementCredential StuffingMachine Learninghttps://www.peakhour.io/blog/preventing-enumeration-attacks-visa-roadmap/<p>An analysis of how Peakhour's solutions help prevent enumeration attacks, aligning with Visa's Security Roadmap 2025-2028 priorities.</p>ACFri, 24 Jan 2025 00:00:00 +1100tag:www.peakhour.io,2025-01-24:/blog/preventing-enumeration-attacks-visa-roadmap/SecurityAccount ProtectionCredential StuffingPCI DSSAPI SecurityFraud PreventionThreat Detectionhttps://www.peakhour.io/blog/protecting-ab-testing-from-bots/<p>Bot traffic corrupts A/B testing results, leading to flawed marketing decisions. Learn how to protect your tests and ensure accurate data for strategic planning.</p>DanWed, 15 Jan 2025 13:00:00 +1100tag:www.peakhour.io,2025-01-15:/blog/protecting-ab-testing-from-bots/SecurityBot Managementhttps://www.peakhour.io/blog/ai-powered-cyber-threats-application-security-defence/<p>Comprehensive analysis of AI-powered cyber threats and how modern application security platforms defend against machine learning-driven attacks. Learn advanced defence strategies for the AI cybersecurity arms race.</p>ACFri, 15 Nov 2024 14:00:00 +1100tag:www.peakhour.io,2024-11-15:/blog/ai-powered-cyber-threats-application-security-defence/SecurityThreat DetectionMachine LearningDevSecOpsBot ManagementDDoSApplication Securityhttps://www.peakhour.io/blog/peakhour-cloud-security-post-wiz/<p>An analysis of Peakhour's role in addressing key cloud security categories identified in recent industry analysis, demonstrating its comprehensive approach to modern cloud security challenges.</p>ACWed, 01 May 2024 10:00:00 +1000tag:www.peakhour.io,2024-05-01:/blog/peakhour-cloud-security-post-wiz/SecurityAPI SecurityThreat DetectionAccount ProtectionDevSecOpsApplication SecurityCDNhttps://www.peakhour.io/blog/account-takeover-fraud-theiconic/<p>Popular Australian fashion website TheIconic recently suffered reputational damage from fraudsters placing orders after an account takeover. Learn how this happens and what you can do to stop it.</p>DanMon, 15 Jan 2024 13:00:00 +1100tag:www.peakhour.io,2024-01-15:/blog/account-takeover-fraud-theiconic/SecurityAccount ProtectionCredential Stuffinghttps://www.peakhour.io/blog/http-security-headers-web-application-protection/<p>Comprehensive guide to HTTP security headers for protecting web applications from client-side attacks. Learn essential browser security configurations for modern application security platforms and DevSecOps workflows.</p>ACTue, 28 Nov 2023 14:00:00 +1100tag:www.peakhour.io,2023-11-28:/blog/http-security-headers-web-application-protection/SecurityApplication SecurityAccount ProtectionAPI SecurityCredential StuffingDrupalDDoShttps://www.peakhour.io/blog/a-tale-of-two-scoring-systems-and-atlassian-confluence/<p>Reviewing the CVSS an EPSS CVE scoring systems in light of the Atlassian Confluence-Aggedon</p>ACWed, 08 Nov 2023 00:00:00 +1100tag:www.peakhour.io,2023-11-08:/blog/a-tale-of-two-scoring-systems-and-atlassian-confluence/SecurityCredential StuffingThreat DetectionAccount ProtectionDevSecOpsSOC 2https://www.peakhour.io/blog/apple-private-relay-vs-google-ip-protection/<p>Apple Private Relay and Chrome IP Protection both reduce IP exposure, but they protect different traffic and should not be treated as residential proxies or automatic fraud signals.</p>ACWed, 25 Oct 2023 13:00:00 +1100tag:www.peakhour.io,2023-10-25:/blog/apple-private-relay-vs-google-ip-protection/SecurityPrivacyIP IntelligenceAccount ProtectionFingerprintingBot Managementhttps://www.peakhour.io/blog/overview-of-ja4-network-fingerprinting/<p>How JA4 constructs a TLS client fingerprint, what JA4+ names, and which details sorting and hashing discard.</p>ACWed, 25 Oct 2023 13:00:00 +1100tag:www.peakhour.io,2023-10-25:/blog/overview-of-ja4-network-fingerprinting/SecurityTLS FingerprintingFingerprintingBrowser FingerprintingTLSSOC 2Threat Detectionhttps://www.peakhour.io/blog/google-chrome-ip-protection-and-online-privacy/<p>Chrome IP Protection masks a user's address for selected third-party requests in Incognito. That is narrower than a VPN and should be treated as privacy infrastructure, not proof of abuse.</p>ACTue, 24 Oct 2023 13:00:00 +1100tag:www.peakhour.io,2023-10-24:/blog/google-chrome-ip-protection-and-online-privacy/SecurityPrivacyIP IntelligenceAccount ProtectionAPI SecurityFingerprintingBot Managementhttps://www.peakhour.io/blog/modsecurity-eol-modern-application-security-platforms/<p>ModSecurity's end-of-life marks a pivotal moment in application security evolution. Discover how modern Application Security Platforms are advancing beyond traditional WAF approaches to provide comprehensive protection for web applications and APIs at the edge.</p>ACMon, 16 Oct 2023 13:00:00 +1100tag:www.peakhour.io,2023-10-16:/blog/modsecurity-eol-modern-application-security-platforms/SecurityApplication SecurityDevSecOpsAPI SecurityDDoSThreat DetectionSOC 2https://www.peakhour.io/blog/http-rapid-reset-attack/<p>A comprehensive breakdown of the HTTP/2 Rapid Reset flaw and guidance on bolstering defences against potential DDoS attacks.</p>ACWed, 11 Oct 2023 00:00:00 +1100tag:www.peakhour.io,2023-10-11:/blog/http-rapid-reset-attack/SecurityDDoSRate LimitingDNSAPI SecurityBot ManagementThreat Detectionhttps://www.peakhour.io/blog/the-rise-of-openbullet/<p>How OpenBullet packages browser and HTTP automation for credential attacks, and which signals defenders can use without treating any one fingerprint as proof.</p>ACFri, 01 Sep 2023 14:00:00 +1000tag:www.peakhour.io,2023-09-01:/blog/the-rise-of-openbullet/SecurityBot ManagementApplication SecurityDevSecOpsAccount ProtectionCredential StuffingThreat Detectionhttps://www.peakhour.io/blog/headless-commerce-security-api-protection/<p>Comprehensive analysis of security challenges in headless commerce and Single Page Applications. Learn how to protect modern e-commerce APIs and microservices architectures from scraping, fraud, and automated attacks.</p>DanWed, 28 Jun 2023 00:00:00 +1000tag:www.peakhour.io,2023-06-28:/blog/headless-commerce-security-api-protection/SecurityAPI SecurityMagentoAccount ProtectionDrupalApplication SecurityBot Managementhttps://www.peakhour.io/blog/advanced-anomaly-detection-rrcf-application-security/<p>Deep dive into Robust Random Cut Forest (RRCF) implementation for real-time anomaly detection in Application Security Platforms. Learn how advanced machine learning algorithms enhance threat detection and automated response capabilities.</p>ACMon, 15 May 2023 13:00:00 +1000tag:www.peakhour.io,2023-05-15:/blog/advanced-anomaly-detection-rrcf-application-security/SecurityThreat DetectionAnomaly DetectionDDoSDevSecOpsBot ManagementApplication Securityhttps://www.peakhour.io/blog/tls-extension-randomisation/<p>Does TLS extension randomisation assist in hiding Chrome?</p>ACThu, 02 Feb 2023 13:00:00 +1100tag:www.peakhour.io,2023-02-02:/blog/tls-extension-randomisation/SecurityTLS FingerprintingTLSBrowser FingerprintingFingerprintingAPI Securityhttps://www.peakhour.io/blog/tls-fingerprinting/<p>What is fingerprinting, and in particular TLS fingerprinting?</p>ACThu, 02 Feb 2023 13:00:00 +1100tag:www.peakhour.io,2023-02-02:/blog/tls-fingerprinting/SecurityTLS FingerprintingBrowser FingerprintingFingerprintingTLSHTTPDDoShttps://www.peakhour.io/blog/ip-threat-intelligence/<p>Comprehensive guide to IP threat intelligence for modern application security platforms. Learn how managed IP reputation lists and threat intelligence feeds protect applications from known malicious sources and emerging threats.</p>ACFri, 15 Jul 2022 13:00:00 +1000tag:www.peakhour.io,2022-07-15:/blog/ip-threat-intelligence/SecurityThreat DetectionDDoSRate LimitingAPI SecurityBot ManagementNetworkinghttps://www.peakhour.io/blog/cve202226134-atlassian-confluence/<p>Peakhour clients are protected against CVF-2022-26134 Atlassian Confluence RCE</p>ACThu, 02 Jun 2022 00:00:00 +1000tag:www.peakhour.io,2022-06-02:/blog/cve202226134-atlassian-confluence/SecurityAPI SecurityDDoSRate LimitingApplication SecurityCredential StuffingFeatures