Rolled out to all points of presence on 12 October 2022. No action is required.
- Managed WAF: 26 new signatures for recently disclosed CVEs.
- Deprecated per-tenant rate limits; removal scheduled for the next major release.
- New dashboard widget: JA4 fingerprint matching.
- Faster rule propagation: median 5 seconds to all PoPs.
- Log streaming now supports JA4 fingerprint matching.
- API: new endpoint challenged vs. dropped traffic by ASN.
- Proof-of-work challenge payload reduced by 7%.
Would love a follow-up on how you handle HTTP/3 fingerprinting.
This matches what we see in iGaming around big matches.
Could you share the dataset behind the percentages?
How does the proof-of-work challenge behave on older Android devices? Any numbers below Android 10?
Good question. We will cover that in a follow-up post.
Thanks — sharing this with our on-call team.
Machine-readable ranges are at /ips.json and via the API.
We moved from a scrubbing provider to always-on last year; time to mitigation went from minutes to basically nothing.
Verified good bots and allow-listed partners bypass challenges entirely.
Nice to read a vendor blog that admits what went wrong.
Is the risk score exposed in the logs so we can build our own dashboards on it?
Would love a follow-up on how you handle HTTP/3 fingerprinting.