Peakhour.IO

Neither Consent Nor an App-Store Ban Makes a Residential IP Direct

AC — Mon, 03 Aug 2026 11:00:00 +1000

Consent can govern how a device joins a proxy network. An app-store ban can close one distribution route. Neither tells a destination whether a request from a residential IP originated inside the household.

A Proxy Takedown Is Not a Security Control

AC — Mon, 03 Aug 2026 09:00:00 +1000

Proxy-network enforcement can reduce supply and protect device owners. Your application still needs current intelligence, behaviour correlation, route-specific controls, and measured request decisions.

When a Proxy Network Dies but Its IPs Survive

AC — Mon, 03 Aug 2026 08:30:00 +1000

A proxy takedown can erase a brand without removing all of its former exit addresses. Here is what post-takedown IP overlap proves, what it cannot prove, and the sourcing evidence buyers should demand.

IPIDEA and NetNut: What Two Residential Proxy Takedowns Actually Changed

AC — Mon, 03 Aug 2026 08:00:00 +1000

Google's 2026 actions against IPIDEA and NetNut disrupted control infrastructure, applications and commercial supply. They did not make residential traffic safe by default.

When Home Devices Become Attack Infrastructure

AC — Sat, 01 Aug 2026 12:30:00 +1000

Application teams cannot clean compromised televisions, routers, or household devices. They can stop treating the residential address as proof and control what the relayed request is allowed to do.

Residential Proxies Turn Layer 7 DDoS Into a Route Problem

AC — Sat, 01 Aug 2026 12:20:00 +1000

A distributed pool can keep each residential IP quiet while expensive application routes fail. Mitigation has to follow request cost and behaviour, not only traffic volume.

Five Routes, Five Residential Proxy Decisions

AC — Sat, 01 Aug 2026 12:10:00 +1000

Account creation, login, password reset, checkout, and public APIs should not share one residential-proxy action. Each route needs its own evidence and failure policy.

Privacy Relay, Corporate VPN, or Residential Proxy?

AC — Sat, 01 Aug 2026 12:00:00 +1000

An anonymised connection is not automatically abusive. Security policy should distinguish expected privacy and corporate access from proxy use that appears beside risky behaviour.

What a Residential Proxy Decision Log Should Contain

AC — Sat, 01 Aug 2026 11:50:00 +1000

A useful proxy event records the request, signal provenance, policy, action, and outcome. A timestamp and a risk score are not enough to explain an enforcement decision.

Keep Your CDN. Add Proxy and Bot Decisions at the Edge.

AC — Sat, 01 Aug 2026 11:40:00 +1000

Replacing a CDN is not the only way to improve bot and proxy controls. The harder requirement is preserving trusted client context, enforceable policy, and decision evidence across the request path.

Credential Stuffing Through “Clean” Residential IPs

AC — Sat, 01 Aug 2026 11:30:00 +1000

A residential IP with no bad reputation can still carry a credential-stuffing attempt. Defend the login workflow by joining credential, route, client, and outcome evidence.

The IP Changed. Did the Actor?

AC — Sat, 01 Aug 2026 11:20:00 +1000

Residential proxy rotation defeats IP-only counters. The answer is not a new identity claim, but a carefully chosen set of cohort, account, route, and outcome keys.

Residential Proxy Detection for APIs Without JavaScript

AC — Sat, 01 Aug 2026 11:10:00 +1000

APIs cannot depend on browser JavaScript to expose proxy abuse. They need server-side network, protocol, identity, route, and outcome evidence in the request path.

A Proxy Flag Is Not a Security Policy

AC — Sat, 01 Aug 2026 11:00:00 +1000

Residential proxy detection is useful evidence. The security decision still has to account for the route, credentials, client history, behaviour, and cost of getting the action wrong.

How Bandwidth Sharing Feeds Residential Proxy Networks

AC — Sat, 01 Aug 2026 10:00:00 +1000

Residential proxy capacity can come from bandwidth-sharing apps, monetisation SDKs, compromised servers, and pre-infected consumer devices. Here is why consent and a residential IP are not enough to establish trust.

How to Tune F5 BIG-IP Advanced WAF

AC — Wed, 29 Jul 2026 10:15:00 +1000

Run F5 BIG-IP Advanced WAF in Transparent mode, review staged matches and learning suggestions, and limit each exception to the URL, parameter, cookie or content profile that needs it.

How to Tune Google Cloud Armor WAF Rules

AC — Wed, 29 Jul 2026 10:00:00 +1000

Tune Cloud Armor preconfigured WAF rules with preview traffic, versioned signatures, sensitivity levels, field exclusions and policy priority.

How to Tune Cloudflare WAF When Rule 949110 Blocks a Request

AC — Wed, 29 Jul 2026 09:45:00 +1000

Trace a Cloudflare OWASP anomaly-score block to the rules that raised the score, then choose the right override or exception.

How to Tune Azure Application Gateway WAF

AC — Wed, 29 Jul 2026 09:30:00 +1000

Start Azure Application Gateway WAF in Detection mode, find false positives in Log Analytics, narrow each exclusion and move into Prevention mode.

How to Tune AWS WAF with Count, Labels and Rule Priority

AC — Wed, 29 Jul 2026 09:15:00 +1000

Use Count overrides, managed-rule labels and rule priority to fix AWS WAF false positives while keeping the rest of the managed rule group in force.

How to Tune Coraza on Caddy

AC — Wed, 29 Jul 2026 09:00:00 +1000

Run Coraza and OWASP CRS on Caddy in DetectionOnly, read the audit log and limit each exclusion to the field and route that need it.

How Browsers Decide Whether to Use HTTP/3

AC — Wed, 29 Jul 2026 00:00:00 +1000

HTTP/3 discovery is standardised. The decision to wait, race QUIC against TCP, remember a failure, or fall back is still browser policy.

How to Protect APIs From Unwanted Automation

AC — Wed, 29 Jul 2026 00:00:00 +1000

An API cannot simply block automation. The practical job is to decide which automated use belongs on each route, then control the rest without breaking legitimate clients.

How to Tune Your WAF Without Turning It Off

AC — Tue, 28 Jul 2026 10:30:00 +1000

A practical process for running a CRS-based or managed WAF in detection mode, finding repeatable false positives and writing narrow exceptions that survive real application traffic.

When and Why to Use a WAF: A Guide for WAF Sceptics

AC — Tue, 28 Jul 2026 10:00:00 +1000

WAFs are neither useless nor a security force field. Here is what they are good at, where they fail, and when putting one in front of an application makes sense.

Your Application Needs a WAF. Just Not for the Reason You Think

AC — Tue, 28 Jul 2026 09:30:00 +1000

A web application firewall will not fix insecure code. It can still give applications a valuable layer of protection when bugs, bots and attacks reach the front door.

Everyone Says a WAF Is Useless. Are They Right?

AC — Tue, 28 Jul 2026 09:00:00 +1000

Ten good reasons not to trust a web application firewall—and why most of them are arguments for using one properly, not going without one.

Two Lineages of TLS Fingerprinting: JA3, JA4 and Cisco Mercury

AC — Sun, 26 Jul 2026 09:00:00 +1000

JA4 did not descend from Cisco Mercury. The two projects come from different strands of TLS fingerprinting research and solve different operational problems.

Before JA3: How TLS Handshakes Became Fingerprints

AC — Sun, 19 Jul 2026 09:00:00 +1000

JA3 made TLS fingerprints easy to log and share, but the technical ideas behind it had already been tested in SSL Labs experiments, a p0f patch and FingerprinTLS.

A Network Fingerprint Is a Cohort, Not a Client

AC — Mon, 13 Jul 2026 09:28:00 +1000

TLS fingerprints group similar protocol implementations. They do not prove which application, device or person made a request.

From Joy to Mercury and EVE: Following Cisco's Network Fingerprinting Work

AC — Mon, 13 Jul 2026 09:28:00 +1000

Cisco's open-source collectors, fingerprinting research and Encrypted Visibility Engine form a clear lineage, but they are not interchangeable parts of one public system.

What an Open Network Fingerprint Database Should Publish

AC — Mon, 13 Jul 2026 09:28:00 +1000

A useful open fingerprint database needs provenance, competing labels, raw evidence, format versions and licences—not another unexplained hash list.

Public Fingerprint Databases Are Not Ground Truth

AC — Mon, 13 Jul 2026 09:28:00 +1000

We reviewed the main public fingerprint resources. The formats are open, but current application labels and auditable ground truth remain scarce.

Does TLS Fingerprint Canonicalisation Hide Attacker Variation? How to Test It

AC — Mon, 13 Jul 2026 09:28:00 +1000

Sorting makes TLS fingerprints more stable, but it also removes ordering evidence. Here is how to test whether the discarded variation matters.

Using Network Fingerprints in Bot and Rate-Limit Decisions

AC — Mon, 13 Jul 2026 09:28:00 +1000

A practical way to use network fingerprints for bot and rate-limit decisions without mistaking a shared client cohort for identity.

One ClientHello, Three Fingerprints: JA3, JA4 and Mercury

AC — Sun, 12 Jul 2026 09:00:00 +1000

A reproducible lab runs JA3, JA4 and Cisco Mercury against the same TLS ClientHello and compares what each fingerprint preserves.

How to fix your Adobe Commerce Overages with Fastly

Dan — Wed, 01 Jul 2026 08:13:00 +1000

If you're consistently going over your contracted CDN egress on your Adobe Commerce contract here's how you can easily fix it.

Edge Security is now a Privacy Compliance Issue

Dan — Thu, 25 Jun 2026 08:13:00 +1000

Recent guidelines from the Australian government have specified practical measures businesses need to take to protect personal information. Learn more.

An Operating Model for API and Account Protection