▶ /notes — FIELD NOTES FROM THE BOT WAR

Notes

Short, practical write-ups on how bots get caught — fingerprinting, abuse economics, and behavioral analysis. Everything here is the public version of lessons learned defending real traffic.

Jun 9, 2026·5 min read

Your cursor gives you away

Humans physically cannot move a mouse in a straight line. Why motor control makes cursor paths a powerful bot signal, and how velocity variance and micro-corrections expose automation.

behavioral analysisbot detectionbiometrics

Jun 1, 2026·7 min read

Credential stuffing beats brute force. Here's how you stop it.

Attackers don't guess passwords anymore — they replay billions of leaked ones through residential proxies. What makes stuffing hard to stop and the defense layers that actually work.

credential stuffingaccount securityanti-abuse

May 18, 2026·6 min read

JA4: fingerprinting the handshake, not the headers

Bots can fake any HTTP header. They have a much harder time faking how their TLS stack says hello. How JA4 fingerprinting works and why it catches what header checks miss.

TLSJA4fingerprintingbot detection